🔍 Bug Bounty Hunter | Content Creator | Sharing cybersecurity write-ups & resources | AI | | by @piyush_supiy #bugbounty #bugbountytips

DM for Collaboration
Joined August 2023
🐛 Bug Bounty Writeup • How I Earned 252.60 USDC from an ENS Bug: medium.com/@anandvashishtha/… • 12 Password Cracking Concepts Every Pentester Should Know (Step-By-Step Guide): medium.com/@verylazytech/12-… • Brute Force: The Least Clever Attack That Still Wins: medium.com/@raksharoot/brute… • Header Hunt: Finding a Leaked Debug Header in Production: oxdzubair.medium.com/header-… • SSRF: A Sneaky Way to Bypass URL Filters Using HTTP Redirects: medium.com/@shadow_28/ssrf-a… • I Designed 5 “Unsolvable” Web Hacking Challenges. Here’s How You Can Actually Break Them.: medium.com/@imaakarsh21/i-de… • JSON Viewer: A Faster Way to Explore JSON Data for Bug Bounty Hunting: medium.com/@asadmohsin760/js… • From P4 to P1 — Day 3: Verbose Error Messages and Stack Trace Disclosure in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/from… • An Open Redirect Isn’t a Phishing Bug. It’s a Token Delivery Failure.: medium.com/codetodeploy/an-o… • MatchTheRegex : CyLab Security Academy Write-up | Understanding Regular Expressions: medium.com/@affanhaxor/match…
5
1,178
🐛 Bug Bounty Writeup • Smali By bithowl: Chapter 16 Return Instructions: medium.com/@bithowl/smali-by… • My Bug Bounty Comeback: Two Findings, Two Lessons Learned: doordiefordream.medium.com/m… • The “Bug” that is on 80% of WordPress sites but that pay only 1/2 times | Bug Bounty Story: medium.com/@sadinfinite/the-… • I Built A Tool Because I Was Tired Of Typing: kd-200.medium.com/i-built-a-… • Breaking the Vault: Bypassing Chatbot Limits via Race Conditions & Response Manipulation: medium.com/@aazzazy772/break… • I Tracked Down What Happened to the Bug I Reported. It Wasn’t Fixed.: medium.com/@riyalimba/i-trac… • Reading 400 Million Git Pushes: GitHub OSINT at Full Population: osintteam.blog/reading-400-m… • PHP2Shell: Two Critical Vulnerabilities That Could Let Attackers Take Over Web Servers: medium.com/@munnaza.cyber/ph… • I Automated My Entire Bug Bounty Recon :One Script, Start to Finish: osintteam.blog/i-automated-m… • PHP2Shell: When a Memory Bug Turns Into Remote Code Execution: hackliva.medium.com/php2shel…
1
8
1,616
🐛 Bug Bounty Writeup • When One Login Works Across Multiple Customers: Understanding Cross-Tenant Authentication Bypass: osintteam.blog/when-one-logi… • How to Find File Upload Vulnerabilities: Step-by-Step Bug Bounty Guide: medium.com/h7w/how-to-find-f… • Breaking BigBlueButton’s API With One Query Parameter — Inside CVE-2026–46353: medium.com/@0xTa7on/breaking… • Insufficient Session Expiration leads to Account Takeover via Password Change: medium.com/@xlr99/insufficie… • How Find IDOR & Broken Access Control Bugs: Using Endpoints Found From JS Files: osintteam.blog/how-find-idor… • Blind SSRF Isn’t Blind If You Build the Channel Back: rajnamdev.medium.com/blind-s… • HTTP Request Smuggling: How One Ambiguous Byte Desyncs the Entire Web: xalgord.medium.com/http-requ… • The Ultimate Guide to SSRF: Hunting, Bypassing and Exploiting in Modern Bug Bounty: lostsec.medium.com/the-ultim… • October 2026 Cyber Timeline: nitingavhane.medium.com/octo…
1
3
19
1,956
𝕏 Bug Bounty Writeups 𝕏 retweeted
After a long break, I’m back on the stage! 🔥🎯 Just got a reward for a vulnerability submitted on @yeswehack -- Open Redirect (CWE-601). #YesWeRHackers @BugBountyHunt3r @Hacker0x01 @ctbbpodcast @bountywriteups
🤖 Made with AI
1
3
246
🐛 Bug Bounty Writeup • Three security agent skills for three different jobs: medium.com/@saroyan.zorayr/i… • “Trust ’em — let the app handle it!”: medium.com/@mohammadsoubanli… • I Started Learning Bug Bounty, and I Realized Recon Is Half the Battle: medium.com/@krishikachellapp… • Security Write-Up: Authentication Bypass via Response Manipulation on Email Change Feature: aboutal3b.medium.com/securit… • Information Disclosure via Exposed Swagger Config: medium.com/@v01d19/informati… • Rate Limiting Bypass: Step-by-Step Bug Bounty Guide: meetcyber.net/rate-limiting-… • Hunting Thread Exhaustion: Ischemia for HTTP/1.1 Partial-Entity Holds: medium.com/@d3n14ld15k/hunti… • JaWT Scratchpad : CyLab Security Academy Write-up | JWT Secret Key and Authentication Bypass: medium.com/@affanhaxor/jawt-… • 12 Active Directory Questions You’ll Absolutely Get in Pentesting Interviews: Step-by-Step Mastery…: medium.com/@verylazytech/12-…
1
1
16
1,967
𝕏 Bug Bounty Writeups 𝕏 retweeted
👾 PentAGI - Penetration testing Artificial General Intelligence PentAGI is an open-source, self-hosted multi-agent system for autonomous penetration testing. You describe a target and a goal in plain language; a team of specialized AI agents plans the work, runs 20+ professional tools such as nmap, Metasploit and sqlmap inside an isolated Docker sandbox, remembers what it learned and hands you a report. github.com/vxcontrol/pentagi
1
4
13
1,686
𝕏 Bug Bounty Writeups 𝕏 retweeted
It’s been a chaotic week in the cybersecurity space. If your AppSec team hasn't been busy patching, you might want to double-check your infrastructure. A quick recap of this week's highlights: 🚨 GitLab: Hit with a maximum severity (CVSS 10.0) unauthenticated RCE that spans across 12 years of releases. 🚨 PHP: A critical RCE was disclosed, and early analysis suggests the patch might not fully mitigate the issue. 🚨 Node.js: Forced to push out urgent updates to address multiple RCE flaws. 🚨 LiteLLM (v1.107.0): Caught distributing credential-stealing malware in a classic supply-chain compromise. 🚨 SBI (State Bank of India): Confirmed a data breach exposing thousands of customer KYC records and loan applications on the dark web. 🚨 OpenCode Console: Suffered a leak exposing user API keys. 🚨 eMudhra CA: In a massive cryptographic failure, their private key was discovered to be literally the number 4. Supply chain security and continuous threat modeling have never been more critical. #CyberSecurity #AppSec #VulnerabilityManagement #DevSecOps #InfoSec
1
3
4
1,233
It’s been a chaotic week in the cybersecurity space. If your AppSec team hasn't been busy patching, you might want to double-check your infrastructure. A quick recap of this week's highlights: 🚨 GitLab: Hit with a maximum severity (CVSS 10.0) unauthenticated RCE that spans across 12 years of releases. 🚨 PHP: A critical RCE was disclosed, and early analysis suggests the patch might not fully mitigate the issue. 🚨 Node.js: Forced to push out urgent updates to address multiple RCE flaws. 🚨 LiteLLM (v1.107.0): Caught distributing credential-stealing malware in a classic supply-chain compromise. 🚨 SBI (State Bank of India): Confirmed a data breach exposing thousands of customer KYC records and loan applications on the dark web. 🚨 OpenCode Console: Suffered a leak exposing user API keys. 🚨 eMudhra CA: In a massive cryptographic failure, their private key was discovered to be literally the number 4. Supply chain security and continuous threat modeling have never been more critical. #CyberSecurity #AppSec #VulnerabilityManagement #DevSecOps #InfoSec
1
3
4
1,233
👾 PentAGI - Penetration testing Artificial General Intelligence PentAGI is an open-source, self-hosted multi-agent system for autonomous penetration testing. You describe a target and a goal in plain language; a team of specialized AI agents plans the work, runs 20+ professional tools such as nmap, Metasploit and sqlmap inside an isolated Docker sandbox, remembers what it learned and hands you a report. github.com/vxcontrol/pentagi
1
4
13
1,686
🐛 Bug Bounty Writeup • bad bug bounty in smm.socnet.pro: medium.com/@mamatneo30/bad-b… • Client-Side Path Traversal: When Your Frontend Sends the Wrong Request: medium.com/@raksharoot/clien… • 6 Hours = 25 Reflected XSS and 2 Open Redirects: medium.com/@belalmohamed3690… • The Bug Bounty Dream Is Lying to You. Here’s the Real Math.: medium.com/@mohdismail22635l… • The AI Sandbox Is Broken: Inside the OpenAI Agent Escape That Changed Security | by Samadhan…: samadhanshimple.medium.com/t… • IDOR / BOLA: How to Find the #1 API Vulnerability — and Actually Prove It: xalgord.medium.com/idor-bola… • A Practical Guide to Hunting Bugs in GraphQL When Introspection Is Off: medium.com/codetodeploy/a-pr… • JAuth : CyLab Security Academy CTF Write-Up | Understanding JWT Authentication: medium.com/@affanhaxor/jauth… • ️‍♂️ SSRF Deep Dive: Turning a Harmless URL Field into Full Cloud Takeover: xalgord.medium.com/%EF%B8%8F…
1
3
5
1,427
🐛 Bug Bounty Writeup • Command Injection: When the Shell Runs Your Input: medium.com/@raksharoot/comma… • One Race Condition, Nine Projects, One Shared Data: medium.com/@Khouf/one-race-c… • Why developers should never trust a null origin (Portswigger CORS lab #2 ): medium.com/@dwedar98/why-dev… • Intercept HTTP Traffic Using Bettercap | Ethical Hacking Tutorial: medium.com/@pentesterclubpvt… • Logistics Company Admin Panel Compromise: medium.com/@l4zz3rj0d/logist… • Insecure Direct Object Reference (IDOR) — Unauthorized Product Price Modification: medium.com/@mo.muwafak2001/i… • How to Find Business Logic Vulnerabilities in Web Apps: Step-by-Step Bug Bounty Guide: meetcyber.net/how-to-find-bu… • IDOR in a Third-Party AI Chat Widget: Sensitive Data Exposure: infosecwriteups.com/idor-in-… • TCP Flags Explained: Attack Vectors, Real-World Risks & Cybersecurity Mitigation: medium.com/@zoningxtr/tcp-fl…
2
4
22
2,052
🐛 Bug Bounty Writeup API Security Testing Guide Using Burp Suite: A Practical Methodology: osintteam.blog/api-security-… playwright mcp 설치 가이드: medium.com/@2jw2534/playwrig… I Couldn’t Read the Chat, So I Invited Someone Who Could: medium.com/@Tyrion404/i-coul… The Open Redirect Hunter’s Guide: How URL Path Manipulation Leads to Critical Security Risks | by…: medium.com/bug-bounty-huntin… Shellphish Explained | How Social Engineering Attacks Work: medium.com/@pentesterclubpvt… What Bug Bounty Taught Me About Hacking AI Agents: medium.com/@the.air.cyborg/w… Intel Closed Its Bug Bounty. Google Paused Its. curl Quit. I’m Still Here.: medium.com/@riyalimba/intel-… CORS Misconfigurations: When the Browser Hands Over the Keys: medium.com/@raksharoot/cors-… Irish-Name-Repo 2 : picoCTF Write-up | SQL Injection Authentication Bypass: medium.com/@affanhaxor/irish… Could This Have Been a €1,000 Bug? My First Accepted Bug Bounty Report: vicricsec.medium.com/could-t…
4
7
32
2,879
🐛 Bug Bounty Writeup • Client-Side Template Injection: When the Browser Executes Your Input: medium.com/@raksharoot/clien… • Toxssin: Exploring XSS Exploitation with an Open-Source Security Tool: medium.com/@bensec/toxssin-e… • Web Reconnaissance & Enumeration: A Practical Guide for Penetration Testers: medium.com/@mdripon667702/we… • Can Your Phone Spy on You Even When You Are Not Using It? A Cybersecurity Case Study: medium.com/@asadmohsin760/ca… • Inside a Bug Bounty Investigation : From Reconnaissance to a Reproducible Security Finding: medium.com/@Akarsh_Chaturved… • One Pending Invitation Was Enough to Restore Revoked Admin Privileges: cyghost.medium.com/one-pendi… • How I Turned a Language Parameter Into DOM-Based XSS Across Multiple Affiliate Portals: medium.com/@redhunter01/how-… • Bypassing an AWS WAF Challenge Through URL-Encoding: An Edge-versus-Origin Normalization Mismatch: medium.com/@redhunter01/bypa… • I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.: infosecwriteups.com/i-analyz…
1
11
47
3,999
🐛 Bug Bounty Writeup • JEB MCP 설치 가이드: medium.com/@2jw2534/jeb-mcp-… • mobile-mcp 설치 가이드: medium.com/@2jw2534/mobile-m… • File Inclusion Explained | Find LFI & RFI Bugs in Bug Bounty: medium.com/@pentesterclubpvt… • Exposed MCP Server: From Recon to OAuth Security Flaws: scriptjacker.medium.com/expo… • How a 56KB PNG Brought Down a Library with Millions of Downloads (CVE-2026–109398): medium.com/@shaikikram2005/h… • I Just Learned a Term That Changed How I Think About Every Report I Submit.: medium.com/@riyalimba/i-just… • IDOR + RBAC Vulnerability: Finding the Attack Scenario That Earned Me $100: medium.com/@Muhammad_Wageh/i… • $1,000 in bug bounties.: medium.com/@Muhammad_Wageh/1… • Smart Contract Vulnerabilities —Reentrancy Attack — Part III: osintteam.blog/smart-contrac… • My Complete Hunting Methodology: From First Recon to First Bounty: osintteam.blog/my-complete-h…
1
7
33
3,963
🐛 Bug Bounty Writeup • 15 Programs That Actually Pay Fast (And How to Find More Like Them): medium.com/@bughuntersjourna… • PortSwigger Web Security Academy Erisim Kontrolu Uzman Lablari Detayli Cozum Serisi: medium.com/@furkannyildiizz0… • PortSwigger Web Security Academy Access Control Expert Labs Detailed Solution Series: medium.com/@furkannyildiizz0… • Bypass the Bypass (XSS): medium.com/@belalmohamed3690… • Your AI Coding Assistant Just Became a Hacker. Here’s the Proof.: medium.com/@CyberSunil/your-… • AWS STS AssumeRole Explained: How Temporary Credentials Work and What Security Researchers Should…: medium.com/@paraskhorwal9/aw… • Clickjacking: When the User Clicks Without Knowing: medium.com/@raksharoot/click… • Stored XSS in an Admin Alert Component via an Admin-Editable Store Name: medium.com/@zyadatef2462003/… • Broken Access Control in a Study Platform’s Class Materials API When “Delete My Own Stuff” Became “D: medium.com/@yasser0hamoda1/b…
1
10
1,833
DeepSeek V4.1 Flash is now free in OpenCode
1
18
1,944
🐛 Bug Bounty Writeup • One Random Search Led Me to Exposed PDFs During a Bug Bounty Hunt: medium.com/@mansigolecha84_1… • $18,000 for a Serialized String in a Cookie: PHP Object Injection to Remote Code Execution: medium.com/@t4nv1/18-000-for… • How I found a Zero-Click Account Tack over via password rest link: cyghost.medium.com/how-i-fou… • A one-tap token drain in Unstoppable Wallet, and the $20 bug bounty it earned: medium.com/@mikeystrauss/a-o… • I Read HackerOne’s New Report So You Don’t Have To. Here’s the One Number That Matters.: medium.com/@riyalimba/i-read… • Bypassing Login with SQL Injection: PortSwigger Lab Walkthrough.: vivek0x.medium.com/bypassing… • Security Misconfiguration : OWASP Top 10 (2025) — A02: medium.com/@shrutishinde1319… • My First Blockchain Bug Bounty Investigation: What a Duplicate Report Taught Me About Security…: medium.com/@nsm10a01akhil/my… • RECON Part 1: Finding Subdomains — How a Hardcoded Password Got Me $$$$: medium.com/@dhruv.gup707/rec… • I found a secret door into an admin panel — and got paid $1350 for it: medium.com/@dhruv.gup707/i-f…
3
5
23
2,799
🐛 Bug Bounty Writeup • Jackpot: How I Emptied an ATM Without a Card or PIN: skin-security.medium.com/jac… • How I Found an Unauthenticated GraphQL API Leaking User Data: medium.com/@OmarTamer0/how-i… • Another perspective on Bug Bounties: medium.com/@rodrigorosamuniz… • From Recon to Full Read/Write DB Access — A Bug Bounty Story: medium.com/@sadinfinite/from… • What Is a Bug Bounty? Is This Really Important for a Crypto Trading Platform?: medium.com/@BitbeginExchange… • Your target already tells you what it runs. Here Is How to Listen.: osintteam.blog/your-target-a… • The Server Nobody Remembered: How Hunters Find Forgotten Subdomains: osintteam.blog/the-server-no… • The Quiet Part of Hacking: How I Learn Everything About a Target Without Touching It: osintteam.blog/the-quiet-par… • I Tested 50 AI Security Tools. These 10 Are the Only Ones That Matter | by Samadhan Shimple: radiohackers.com/i-tested-50… • Login - CTF Write-up | Finding Exposed Credentials in JavaScript: medium.com/@affanhaxor/login…
1
6
22
2,399
🐛 Bug Bounty Writeup • I Thought Knowing the Payloads Made Me a Hacker — I Was Wrong: medium.com/codetodeploy/i-th… • I Used Burp Suite for Months Before Realizing What I Was Missing: medium.com/codetodeploy/i-us… • GitHub Halved Its Bug Bounty Payouts. The People Who Lose Most Aren’t the Ones You Think.: medium.com/@riyalimba/github… • Forced Browsing Explained | Find Hidden Pages & Access Control Bugs: medium.com/@pentesterclubpvt… • Finding an Exposed Admin Panel on a Government Portal: A Responsible Disclosure Story: medium.com/@byteshubh1717/fi… • LFI Bypass: Double URL Encoding Path Traversal: medium.com/@cybersecplaygrou… • How I Identified a Potential Subscription Payment Enforcement Issue Despite Insufficient Funds: medium.com/@molapomanuel709/… • Nobody Bans AI Bug Reports. You Can Still Get Permanently Banned.: meetcyber.net/nobody-bans-ai… • What Hackers Are Actually Finding in 2026: I Went Through the Bug Bounty Reports So You Don’t Have…: osintteam.blog/what-hackers-… • Visible Error-Based SQL Injection: A PortSwigger Lab Walkthrough: medium.com/@tagmadiyadhrupal…
1
7
26
2,825