Once it’s marked as resolved, I’ll drop the $$ details. Private program, no invite yet since it was reported straight to the company and later claimed on @Bugcrowd. Can’t share more for now. #BugBounty #bugbountytips #bugbountytip

Yay, I was awarded a $750 bounty on @Hacker0x01 ! YES, I'm also starting to hunt in H1 🧑‍💻 #TogetherWeHitHarder #BugBounty

Swag raro da @hackingclub_io 🚀@carlos_crowsec #hacking #cybersecurity

Validated! Improper Authorization, escalated to ATO (account takeover) and then mass user data exposure via /api/user, concluding a Critical Severity 9.1. Ty @intigriti #bugbounty #bugbountytips #bugbountytip

Coming soon. #bugbounty

hardcoded credentials in javascript file xxxxxxx/static/js/main.xxxxx.chunk.js 🗣️ dp #bugbounty #bugbountytips #bugbountytip

CRUEL!!! But that’s the game… time to move on to the next ones. 😃 #bugbounty

Amanhã as 19:30 no discord da pirateship! @c4ng4c3ir0 🤝🏻 @Mariobrowww 🤝🏻 @stux_rs 🤝🏻 @ofjaaah 🤝🏻 @adrielsec Link no comentário abaixo.

It’s almost 2026 and this crap is still out in the open… DAMN!! #BugBounty #bugbountytips #bugbountytip

"we take your privacy and security very seriously" BULLSHIT! HAHAHAAAHAH

🕷️ 100 Web App Exploit Ideas for Bug Bounty Hunters 💥 IDOR on user profile update IDOR via email enumeration IDOR on subscription APIs Broken object-level authorization in API Reflected XSS in search bar Stored XSS in comments DOM-based XSS in JS-heavy pages Open

I think @Burp_Suite pro version is one of the most powerful content discovery engine's on the market to date for a very simple reason It can do both content and directory brute forcing ... recursively :o I know not everyone can fork out the subscription fee though :3 so I made

GitHub: https://t.co/LP95GynNGa Read the 🧵 and decide whether the tool makes sense for you 👇🏻

RCE in March, IDOR now in May. Bounties are coming in through study, method, and patience. Grateful to @crd0x49 for the content that accelerated my journey, and to @adrielsec for the steady support throughout. Let’s keep going! 💻

Try import('//X55.is') instead of alert(1)

Midnight 👍🏻

Macbook Air M2, Bateria 100%, 16GB de RAM e 256GB de SSD. R$6.5k leva embora, chama direct ✌️

🚨ID in the URL, parameter in the body is another account data change report, I typed the text of another subsequent report here, it must be sleep 🤣 I'm not going to delete the post, it'll be in context for the next one, which is on the body.

ATO via ResetPasswd Critical passwd reset flaw: after requesting a reset, I intercepted the POST with Burp and changed the parameter ID in the request body. I was able to reset another user's password without prior auth. Any user ID worked ✅ #bugbounty #bugbountytip #intigriti

Back on track! #intigriti #bugbounty