Mumtaz Khan @Hacker_O

If you seriously want to improve at bug bounty hunting, study real reports. One of the best repositories for that: github.com/reddelexc/hack… Thousands of publicly disclosed HackerOne reports collected in one place. A great resource to understand how top researchers think, approach targets, chain issues, and write impactful reports. Worth spending time on. #BugBounty #CyberSecurity #InfoSec #AppSec

The Claude Code tooling I have been mentioning in my recent bounty posts is a forked version of strix-claude-code Started using it a few months ago. Added a triage step that spawns a new agent with no context to verify findings, cut my false positives down a lot. Got $3000 + $100 on intigriti for bypasses of resolved reports, $500 on h1, an RCE I am still verifying Not full proof. Still get false positives, still spend days verifying pocs. But overall it works really well Open sourcing it today: github.com/arshadkazmi42/…

Best Resources for IDOR

mrdesoky0 @mrdesoky0

9 months ago

Just released the Ultimate IDOR Testing Checklist 🧩 I combined techniques from many sources to cover IDOR scenarios. Know a technique I missed? Drop it in the comments. Notion: mrdesoky0.notion.site/Ultimate-IDOR-… GitHub: github.com/mrdesoky0/vuln… #bugbountytips #IDOR #AppSec #InfoSec

keyboard_arrow_left Previous keyboard_arrow_right Next

11 211 841 59K 1K

A lot of people are now building and using their own hackbots daily. Here's a nice blog on using AI to hunt for vulns by @0xAsm0d3us. Some takeaways that I've also been experiencing: > Instead of asking "is this code secure?", ask "how would you break this?". This shifts the flow from auditor to attacker. It will force it to generate attack strategies. > Avoid bloated prompts. Stuffing big MD files and skills into context degrades reliability of the model. Your scaffolding becomes the haystack and the bug becomes the needle. > Don't just say "find bugs". Assert the bug exists, e.g. this function has 3 vulnerabilities, find them, don't quit. Further reading: devansh.bearblog.dev/needle-in-the-…

🚨 As of tomorrow I am permanently reducing my course cost by 50% to $100 so more people have access to it and can get those bounties while they are still hot. And yes, they are still hot. The internet is still full of stupid problems waiting to be found for those looking, at least for now... t.co/HsobzB2lOi I suspect we have about 2 years of decent #bugbounty hunting left before most companies have access to and properly leverage the tools like Mythos that effectively replace "most" hackers. Using the EXACT methods in this course, I found 20+ critical bugs on a target in a matter of hours the other day. Nothing fancy. The internet is just too dang big to fix and patch in a small amount of time, even if AI is finding the bugs. Internal legacy human processes with 500 steps are still bottle-necking remediation. What the bug bounty world becomes next is anyone's guess. My suspicions, hackers will be paid flat rates for hacking and/or patching targets any way they can (be it AI, manually, or both). So, here's to the next evolution of hacking, which is hopefully round-table LHE's where we all work together on targets to harden them as best as possible, instead of working against each other to try to "be the best hacker". Re-post for a chance to win 1 of 5 course coupons for a give away on May 14th. I'll have Grok pick the winners.

Google Bug Hunter University — Learn to Find & Report Bugs Official learning hub from Google for bug bounty hunters. • Where to hunt (targets) • How to write valid reports • Common mistakes (invalid reports) • Real rewarded submissions If your reports keep getting rejected, start here. bughunters.google.com #BugBounty #AppSec #CyberSecurity #Infosec #Google

Using Claude Code for secure code review (@Sw4mp_f0x) specterops.io/blog/2026/03/2… #infosec #llm

Every JWT writeup online covers 2–3 attacks and stops. I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place. rmrf.tips/en #infosec #appsec #bugbounty #websec #jwt

BREAKING: I asked Claude to upgrade my LinkedIn profile. It didn’t just “upgrade” it. It turned it into a recruiter magnet. Here are the exact 7 prompts I used:

BREAKING: If you're not using Claude at your job, you're already behind. Copy these 7 prompts:

@zomasec @GodfatherOrwa جزاكم الله خيرًا. أنا كنت لخصت أغلب فيديوهات Orwa في صفحة Notion وساعدتني كتير وأنا بتعلم Recon، وحابب أشاركها لعلها تفيد أي حد بيبدأ. بس الرابط مش راضي يتحط في التعليقات على اليوتيوب، فلو حضرتك ممكن تضيفه في تعليق مثبت عندك هتفيد الناس notion.so/sources_Orwa-2…

INSTEAD OF WATCHING NETFLIX TONIGHT, WATCH THIS 1 HOUR FULL CLAUDE COURSE. THANK ME LATER!!!

🧠🔥 CLAUDE “100% MODE” — PRO BUG BOUNTY SYSTEM ⸻ ⚙️ 1. MASTER SYSTEM PROMPT (CORE ENGINE) Paste this FIRST into Claude: You are an elite offensive security researcher operating at a top-tier bug bounty level. You think like a professional attacker but act strictly within authorized security testing. Your mindset: - You hunt broken assumptions, not just vulnerabilities - You prioritize real-world impact over theoretical issues - You think in systems, flows, and trust boundaries - You chain weaknesses into meaningful impact - You ignore noise and focus only on high-probability findings You are not a scanner. You are a strategist. --- CORE MODEL: 1. System Decomposition Break the target into: - APIs, frontend, backend, auth, background jobs, integrations 2. Trust Boundary Mapping Identify where the system assumes: - identity is valid - ownership is enforced - state is consistent 3. High-Value Zones Focus only on: - Access control (IDOR, privilege escalation) - Auth/session flaws - Business logic abuse - SSRF/internal access - Injection in non-obvious contexts - Race conditions 4. Edge Case Thinking - Type confusion - Missing/null values - Encoding tricks - Flow manipulation - Alternate formats 5. Chaining Always ask: → “How does this become critical?” --- EXECUTION: - Explain WHY something may be vulnerable - Provide precise, non-destructive testing strategies - Highlight validation signals - Think like a triager: clear, reproducible, impactful --- OUTPUT: 1. Attack Surface 2. Broken Assumptions 3. Top Vulnerability Hypotheses 4. Testing Strategy 5. Signals 6. Impact 7. Chains --- Stay within ethical, authorized testing only. ⸻ 🔁 2. THE 6-PHASE HUNTER LOOP (REAL SECRET) This is how top hunters think — you’ll run Claude through this loop every target. ⸻ 🔍 PHASE 1 — SYSTEM MAPPING Break this target into components and data flows. Where does user input enter and where is it trusted? ⸻ 🧠 PHASE 2 — ASSUMPTION BREAKING List all assumptions this system makes about: - identity - ownership - state - sequencing Which of these can be broken? ⸻ 🎯 PHASE 3 — HIGH-PROBABILITY BUGS Give ONLY top 5 real vulnerabilities likely to exist. Rank by likelihood and impact. No generic answers. ⸻ ⚔️ PHASE 4 — PRECISION TESTING Design exact step-by-step testing for the #1 vulnerability. Focus on: - edge cases - bypass techniques - validation signals ⸻ 🔗 PHASE 5 — CHAINING If this vulnerability is valid, how can it escalate? Combine with: - access control - logic flaws - race conditions ⸻ 💰 PHASE 6 — REPORT MODE Write a HackerOne-quality report: - Title - Summary - Steps to reproduce - Impact - Severity justification ⸻ 🎯 3. ELITE MICRO-PROMPTS (HIGH ROI) Use these to zoom into specific bug classes: ⸻ 🔐 Access Control Killer Find non-obvious IDOR and privilege escalation paths. Focus on multi-tenant and indirect references. ⸻ 🧾 Business Logic Breaker Break this workflow. Where can steps be skipped, repeated, or abused? ⸻ 🌐 SSRF Hunter Where can the server be forced to make internal requests? Think beyond obvious URL inputs. ⸻ 🔑 Auth & JWT How can identity or roles be confused or escalated? ⸻ ⚡ Race Conditions Where can timing or parallel requests break consistency? ⸻ 💉 Injection (Advanced) Where could injection exist in non-traditional inputs? (JSON, filters, background jobs) ⸻ ⚙️ 4. REAL-WORLD STACK (YOUR FLOW) You already use tools — here’s how Claude fits: Your stack: •gau / waybackurls •httpx •nuclei (optional) •Burp Flow: 1.Collect endpoints 2.Feed into Claude: Analyze attack surface: [paste endpoints] 3.Run 6-phase loop 4.Only test top 1–2 hypotheses 5.Validate manually 6.Generate report ⸻ 💀 WHAT “100% MODE” ACTUALLY MEANS This is the difference: Average Hunter100% Mode Runs toolsBreaks systems Tests payloadsBreaks assumptions Finds low bugsChains into critical Spams reportsWrites 1 winning report

One of my less known-about tools is called hakoriginfinder, but it's really impactful. It finds origin servers behind WAFs using a technique that I haven't seen anywhere else (at least, not at scale). It's a weird one because, unlike my other tools, the messages I get about this tool only come from really top hackers. Check it: github.com/hakluke/hakori…

I published one of the techniques that I've been using against OAuth providers, honetly, it's led me to discover many flaws, and recently I used it to find a 1-click ATO on one of the most widely visited websites,I hope you find it useful :-) blog.voorivex.team/story-of-abusi…

Use this prompt for a thorough JS analysis: You are an expert JavaScript reverse engineer and code analyst. I will provide you with a JavaScript file. Perform a structured analysis with the following objectives: ## 1. High-Level Overview - What is this code's purpose? - Architecture pattern - Key dependencies and frameworks used - Execution flow: how does the code initialize and what is the main entry path? ## 2. Attack Surface & Endpoints Extract and list ALL of the following in structured tables: | Category | Examples to look for | |-----------------------|---------------------------------------------------------| | API routes/endpoints | paths, HTTP methods, route patterns | | Parameters | query params, body fields, URL params, headers expected | | Auth mechanisms | tokens, cookies, session logic, OAuth flows, API keys | | WebSocket events | event names, channels, message schemas | | External calls | fetch/axios URLs, third-party APIs, webhook targets | ## 3. Hidden & Interesting Artifacts Look beneath the surface for: - Hardcoded strings: URLs, IPs, hostnames, ports, internal service names - Environment variables referenced (process.env.*) - Database schemas, table/collection names, field names - Role names, permission levels, feature flags - Debug/admin/test routes or commented-out functionality - Error messages that reveal internal structure - Regex patterns (what are they validating/extracting?) - File system paths (uploads, logs, configs, temp dirs) ## 4. Data Flow Map Trace how user input moves through the code: - Entry point (where does external data come in?) - Transformations (parsing, validation, sanitization, or lack thereof) - Storage (where does it end up: DB, file, cache, external service?) - Output (what gets returned/rendered to the user?) ## Formatting Rules - Use tables for structured data (endpoints, params, env vars) - Use code snippets with line references for each finding - Flag anything that seems intentionally obscured or unusual - If the code is minified/obfuscated, note patterns and attempt to identify the original framework or library --- Here is the code:

Spent a week testing AI for vulnerability research. 14 confirmed bugs in 20 min on one target. 5% hit rate on a hardened one. Same AI, same setup. 4 approaches, what worked, what failed, why target selection matters more than model sophistication. xclow3n.github.io/post/7

Hello Folks, I have just published a Writeup on: How I hacked AI Agent and worth bounty of $$$$ medium.com/@manan_sanghvi… @Bugcrowd #hackingonsteroids #llmsecurity #aisecurity #promptinjection #bugbounty #bugcrowd #aiagent #agenticai #agent #cybersecurity #ai #medium #writeup

Added 3,600+ publicly disclosed HackerOne reports that paid a bounty to the MCP. 👇 github.com/PatrikFehrenba… This should help Claude to decide where to focus on, what attack surface was looked at before, and where new vulnerabilities could be 👀 (in theory 😏)