
🔍 Bug Bounty Hunter | Content Creator | Sharing cybersecurity write-ups & resources | AI | | by @piyush_supiy #bugbounty #bugbountytips
DM for Collaboration
Joined August 2023
- Tweets22.4K
- Following3.5K
- Followers40.4K
- Likes7.9K
October 2026 Patch Audit: PHP2Shell, GitLab, Node, LiteLLM
securitycipher.com/2026/10/2…
🐛 Bug Bounty Writeup
• How I Earned 252.60 USDC from an ENS Bug: medium.com/@anandvashishtha/…
• 12 Password Cracking Concepts Every Pentester Should Know (Step-By-Step Guide): medium.com/@verylazytech/12-…
• Brute Force: The Least Clever Attack That Still Wins: medium.com/@raksharoot/brute…
• Header Hunt: Finding a Leaked Debug Header in Production: oxdzubair.medium.com/header-…
• SSRF: A Sneaky Way to Bypass URL Filters Using HTTP Redirects: medium.com/@shadow_28/ssrf-a…
• I Designed 5 “Unsolvable” Web Hacking Challenges. Here’s How You Can Actually Break Them.: medium.com/@imaakarsh21/i-de…
• JSON Viewer: A Faster Way to Explore JSON Data for Bug Bounty Hunting: medium.com/@asadmohsin760/js…
• From P4 to P1 — Day 3: Verbose Error Messages and Stack Trace Disclosure in Bug Bounty Hunting: medium.com/@cyb3rD1vvya/from…
• An Open Redirect Isn’t a Phishing Bug. It’s a Token Delivery Failure.: medium.com/codetodeploy/an-o…
• MatchTheRegex : CyLab Security Academy Write-up | Understanding Regular Expressions: medium.com/@affanhaxor/match…
🐛 Bug Bounty Writeup
• Smali By bithowl: Chapter 16 Return Instructions: medium.com/@bithowl/smali-by…
• My Bug Bounty Comeback: Two Findings, Two Lessons Learned: doordiefordream.medium.com/m…
• The “Bug” that is on 80% of WordPress sites but that pay only 1/2 times | Bug Bounty Story: medium.com/@sadinfinite/the-…
• I Built A Tool Because I Was Tired Of Typing: kd-200.medium.com/i-built-a-…
• Breaking the Vault: Bypassing Chatbot Limits via Race Conditions & Response Manipulation: medium.com/@aazzazy772/break…
• I Tracked Down What Happened to the Bug I Reported. It Wasn’t Fixed.: medium.com/@riyalimba/i-trac…
• Reading 400 Million Git Pushes: GitHub OSINT at Full Population: osintteam.blog/reading-400-m…
• PHP2Shell: Two Critical Vulnerabilities That Could Let Attackers Take Over Web Servers: medium.com/@munnaza.cyber/ph…
• I Automated My Entire Bug Bounty Recon :One Script, Start to Finish: osintteam.blog/i-automated-m…
• PHP2Shell: When a Memory Bug Turns Into Remote Code Execution: hackliva.medium.com/php2shel…
🐛 Bug Bounty Writeup
• When One Login Works Across Multiple Customers: Understanding Cross-Tenant Authentication Bypass: osintteam.blog/when-one-logi…
• How to Find File Upload Vulnerabilities: Step-by-Step Bug Bounty Guide: medium.com/h7w/how-to-find-f…
• Breaking BigBlueButton’s API With One Query Parameter — Inside CVE-2026–46353: medium.com/@0xTa7on/breaking…
• Insufficient Session Expiration leads to Account Takeover via Password Change: medium.com/@xlr99/insufficie…
• How Find IDOR & Broken Access Control Bugs: Using Endpoints Found From JS Files: osintteam.blog/how-find-idor…
• Blind SSRF Isn’t Blind If You Build the Channel Back: rajnamdev.medium.com/blind-s…
• HTTP Request Smuggling: How One Ambiguous Byte Desyncs the Entire Web: xalgord.medium.com/http-requ…
• The Ultimate Guide to SSRF: Hunting, Bypassing and Exploiting in Modern Bug Bounty: lostsec.medium.com/the-ultim…
• October 2026 Cyber Timeline: nitingavhane.medium.com/octo…
𝕏 Bug Bounty Writeups 𝕏 retweeted
After a long break, I’m back on the stage! 🔥🎯 Just got a reward for a vulnerability submitted on @yeswehack -- Open Redirect (CWE-601). #YesWeRHackers
@BugBountyHunt3r @Hacker0x01 @ctbbpodcast @bountywriteups
🤖 Made with AI
🐛 Bug Bounty Writeup
• Three security agent skills for three different jobs: medium.com/@saroyan.zorayr/i…
• “Trust ’em — let the app handle it!”: medium.com/@mohammadsoubanli…
• I Started Learning Bug Bounty, and I Realized Recon Is Half the Battle: medium.com/@krishikachellapp…
• Security Write-Up: Authentication Bypass via Response Manipulation on Email Change Feature: aboutal3b.medium.com/securit…
• Information Disclosure via Exposed Swagger Config: medium.com/@v01d19/informati…
• Rate Limiting Bypass: Step-by-Step Bug Bounty Guide: meetcyber.net/rate-limiting-…
• Hunting Thread Exhaustion: Ischemia for HTTP/1.1 Partial-Entity Holds: medium.com/@d3n14ld15k/hunti…
• JaWT Scratchpad : CyLab Security Academy Write-up | JWT Secret Key and Authentication Bypass: medium.com/@affanhaxor/jawt-…
• 12 Active Directory Questions You’ll Absolutely Get in Pentesting Interviews: Step-by-Step Mastery…: medium.com/@verylazytech/12-…
𝕏 Bug Bounty Writeups 𝕏 retweeted
👾 PentAGI - Penetration testing Artificial General Intelligence
PentAGI is an open-source, self-hosted multi-agent system for autonomous penetration testing. You describe a target and a goal in plain language; a team of specialized AI agents plans the work, runs 20+ professional tools such as nmap, Metasploit and sqlmap inside an isolated Docker sandbox, remembers what it learned and hands you a report.
github.com/vxcontrol/pentagi
𝕏 Bug Bounty Writeups 𝕏 retweeted
It’s been a chaotic week in the cybersecurity space. If your AppSec team hasn't been busy patching, you might want to double-check your infrastructure.
A quick recap of this week's highlights:
🚨 GitLab: Hit with a maximum severity (CVSS 10.0) unauthenticated RCE that spans across 12 years of releases.
🚨 PHP: A critical RCE was disclosed, and early analysis suggests the patch might not fully mitigate the issue.
🚨 Node.js: Forced to push out urgent updates to address multiple RCE flaws.
🚨 LiteLLM (v1.107.0): Caught distributing credential-stealing malware in a classic supply-chain compromise.
🚨 SBI (State Bank of India): Confirmed a data breach exposing thousands of customer KYC records and loan applications on the dark web.
🚨 OpenCode Console: Suffered a leak exposing user API keys.
🚨 eMudhra CA: In a massive cryptographic failure, their private key was discovered to be literally the number 4.
Supply chain security and continuous threat modeling have never been more critical.
#CyberSecurity #AppSec #VulnerabilityManagement #DevSecOps #InfoSec
It’s been a chaotic week in the cybersecurity space. If your AppSec team hasn't been busy patching, you might want to double-check your infrastructure.
A quick recap of this week's highlights:
🚨 GitLab: Hit with a maximum severity (CVSS 10.0) unauthenticated RCE that spans across 12 years of releases.
🚨 PHP: A critical RCE was disclosed, and early analysis suggests the patch might not fully mitigate the issue.
🚨 Node.js: Forced to push out urgent updates to address multiple RCE flaws.
🚨 LiteLLM (v1.107.0): Caught distributing credential-stealing malware in a classic supply-chain compromise.
🚨 SBI (State Bank of India): Confirmed a data breach exposing thousands of customer KYC records and loan applications on the dark web.
🚨 OpenCode Console: Suffered a leak exposing user API keys.
🚨 eMudhra CA: In a massive cryptographic failure, their private key was discovered to be literally the number 4.
Supply chain security and continuous threat modeling have never been more critical.
#CyberSecurity #AppSec #VulnerabilityManagement #DevSecOps #InfoSec
👾 PentAGI - Penetration testing Artificial General Intelligence
PentAGI is an open-source, self-hosted multi-agent system for autonomous penetration testing. You describe a target and a goal in plain language; a team of specialized AI agents plans the work, runs 20+ professional tools such as nmap, Metasploit and sqlmap inside an isolated Docker sandbox, remembers what it learned and hands you a report.
github.com/vxcontrol/pentagi
🐛 Bug Bounty Writeup
• bad bug bounty in smm.socnet.pro: medium.com/@mamatneo30/bad-b…
• Client-Side Path Traversal: When Your Frontend Sends the Wrong Request: medium.com/@raksharoot/clien…
• 6 Hours = 25 Reflected XSS and 2 Open Redirects: medium.com/@belalmohamed3690…
• The Bug Bounty Dream Is Lying to You. Here’s the Real Math.: medium.com/@mohdismail22635l…
• The AI Sandbox Is Broken: Inside the OpenAI Agent Escape That Changed Security | by Samadhan…: samadhanshimple.medium.com/t…
• IDOR / BOLA: How to Find the #1 API Vulnerability — and Actually Prove It: xalgord.medium.com/idor-bola…
• A Practical Guide to Hunting Bugs in GraphQL When Introspection Is Off: medium.com/codetodeploy/a-pr…
• JAuth : CyLab Security Academy CTF Write-Up | Understanding JWT Authentication: medium.com/@affanhaxor/jauth…
• ️♂️ SSRF Deep Dive: Turning a Harmless URL Field into Full Cloud Takeover: xalgord.medium.com/%EF%B8%8F…
🐛 Bug Bounty Writeup
• Command Injection: When the Shell Runs Your Input: medium.com/@raksharoot/comma…
• One Race Condition, Nine Projects, One Shared Data: medium.com/@Khouf/one-race-c…
• Why developers should never trust a null origin (Portswigger CORS lab #2 ): medium.com/@dwedar98/why-dev…
• Intercept HTTP Traffic Using Bettercap | Ethical Hacking Tutorial: medium.com/@pentesterclubpvt…
• Logistics Company Admin Panel Compromise: medium.com/@l4zz3rj0d/logist…
• Insecure Direct Object Reference (IDOR) — Unauthorized Product Price Modification: medium.com/@mo.muwafak2001/i…
• How to Find Business Logic Vulnerabilities in Web Apps: Step-by-Step Bug Bounty Guide: meetcyber.net/how-to-find-bu…
• IDOR in a Third-Party AI Chat Widget: Sensitive Data Exposure: infosecwriteups.com/idor-in-…
• TCP Flags Explained: Attack Vectors, Real-World Risks & Cybersecurity Mitigation: medium.com/@zoningxtr/tcp-fl…
🐛 Bug Bounty Writeup
API Security Testing Guide Using Burp Suite: A Practical Methodology: osintteam.blog/api-security-…
playwright mcp 설치 가이드: medium.com/@2jw2534/playwrig…
I Couldn’t Read the Chat, So I Invited Someone Who Could: medium.com/@Tyrion404/i-coul…
The Open Redirect Hunter’s Guide: How URL Path Manipulation Leads to Critical Security Risks | by…: medium.com/bug-bounty-huntin…
Shellphish Explained | How Social Engineering Attacks Work: medium.com/@pentesterclubpvt…
What Bug Bounty Taught Me About Hacking AI Agents: medium.com/@the.air.cyborg/w…
Intel Closed Its Bug Bounty. Google Paused Its. curl Quit. I’m Still Here.: medium.com/@riyalimba/intel-…
CORS Misconfigurations: When the Browser Hands Over the Keys: medium.com/@raksharoot/cors-…
Irish-Name-Repo 2 : picoCTF Write-up | SQL Injection Authentication Bypass: medium.com/@affanhaxor/irish…
Could This Have Been a €1,000 Bug? My First Accepted Bug Bounty Report: vicricsec.medium.com/could-t…
🐛 Bug Bounty Writeup
• Client-Side Template Injection: When the Browser Executes Your Input: medium.com/@raksharoot/clien…
• Toxssin: Exploring XSS Exploitation with an Open-Source Security Tool: medium.com/@bensec/toxssin-e…
• Web Reconnaissance & Enumeration: A Practical Guide for Penetration Testers: medium.com/@mdripon667702/we…
• Can Your Phone Spy on You Even When You Are Not Using It? A Cybersecurity Case Study: medium.com/@asadmohsin760/ca…
• Inside a Bug Bounty Investigation : From Reconnaissance to a Reproducible Security Finding: medium.com/@Akarsh_Chaturved…
• One Pending Invitation Was Enough to Restore Revoked Admin Privileges: cyghost.medium.com/one-pendi…
• How I Turned a Language Parameter Into DOM-Based XSS Across Multiple Affiliate Portals: medium.com/@redhunter01/how-…
• Bypassing an AWS WAF Challenge Through URL-Encoding: An Edge-versus-Origin Normalization Mismatch: medium.com/@redhunter01/bypa…
• I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.: infosecwriteups.com/i-analyz…
🐛 Bug Bounty Writeup
• JEB MCP 설치 가이드: medium.com/@2jw2534/jeb-mcp-…
• mobile-mcp 설치 가이드: medium.com/@2jw2534/mobile-m…
• File Inclusion Explained | Find LFI & RFI Bugs in Bug Bounty: medium.com/@pentesterclubpvt…
• Exposed MCP Server: From Recon to OAuth Security Flaws: scriptjacker.medium.com/expo…
• How a 56KB PNG Brought Down a Library with Millions of Downloads (CVE-2026–109398): medium.com/@shaikikram2005/h…
• I Just Learned a Term That Changed How I Think About Every Report I Submit.: medium.com/@riyalimba/i-just…
• IDOR + RBAC Vulnerability: Finding the Attack Scenario That Earned Me $100: medium.com/@Muhammad_Wageh/i…
• $1,000 in bug bounties.: medium.com/@Muhammad_Wageh/1…
• Smart Contract Vulnerabilities —Reentrancy Attack — Part III: osintteam.blog/smart-contrac…
• My Complete Hunting Methodology: From First Recon to First Bounty: osintteam.blog/my-complete-h…
🐛 Bug Bounty Writeup
• 15 Programs That Actually Pay Fast (And How to Find More Like Them): medium.com/@bughuntersjourna…
• PortSwigger Web Security Academy Erisim Kontrolu Uzman Lablari Detayli Cozum Serisi: medium.com/@furkannyildiizz0…
• PortSwigger Web Security Academy Access Control Expert Labs Detailed Solution Series: medium.com/@furkannyildiizz0…
• Bypass the Bypass (XSS): medium.com/@belalmohamed3690…
• Your AI Coding Assistant Just Became a Hacker. Here’s the Proof.: medium.com/@CyberSunil/your-…
• AWS STS AssumeRole Explained: How Temporary Credentials Work and What Security Researchers Should…: medium.com/@paraskhorwal9/aw…
• Clickjacking: When the User Clicks Without Knowing: medium.com/@raksharoot/click…
• Stored XSS in an Admin Alert Component via an Admin-Editable Store Name: medium.com/@zyadatef2462003/…
• Broken Access Control in a Study Platform’s Class Materials API When “Delete My Own Stuff” Became “D: medium.com/@yasser0hamoda1/b…
🐛 Bug Bounty Writeup
• One Random Search Led Me to Exposed PDFs During a Bug Bounty Hunt: medium.com/@mansigolecha84_1…
• $18,000 for a Serialized String in a Cookie: PHP Object Injection to Remote Code Execution: medium.com/@t4nv1/18-000-for…
• How I found a Zero-Click Account Tack over via password rest link: cyghost.medium.com/how-i-fou…
• A one-tap token drain in Unstoppable Wallet, and the $20 bug bounty it earned: medium.com/@mikeystrauss/a-o…
• I Read HackerOne’s New Report So You Don’t Have To. Here’s the One Number That Matters.: medium.com/@riyalimba/i-read…
• Bypassing Login with SQL Injection: PortSwigger Lab Walkthrough.: vivek0x.medium.com/bypassing…
• Security Misconfiguration : OWASP Top 10 (2025) — A02: medium.com/@shrutishinde1319…
• My First Blockchain Bug Bounty Investigation: What a Duplicate Report Taught Me About Security…: medium.com/@nsm10a01akhil/my…
• RECON Part 1: Finding Subdomains — How a Hardcoded Password Got Me $$$$: medium.com/@dhruv.gup707/rec…
• I found a secret door into an admin panel — and got paid $1350 for it: medium.com/@dhruv.gup707/i-f…
🐛 Bug Bounty Writeup
• Jackpot: How I Emptied an ATM Without a Card or PIN: skin-security.medium.com/jac…
• How I Found an Unauthenticated GraphQL API Leaking User Data: medium.com/@OmarTamer0/how-i…
• Another perspective on Bug Bounties: medium.com/@rodrigorosamuniz…
• From Recon to Full Read/Write DB Access — A Bug Bounty Story: medium.com/@sadinfinite/from…
• What Is a Bug Bounty? Is This Really Important for a Crypto Trading Platform?: medium.com/@BitbeginExchange…
• Your target already tells you what it runs. Here Is How to Listen.: osintteam.blog/your-target-a…
• The Server Nobody Remembered: How Hunters Find Forgotten Subdomains: osintteam.blog/the-server-no…
• The Quiet Part of Hacking: How I Learn Everything About a Target Without Touching It: osintteam.blog/the-quiet-par…
• I Tested 50 AI Security Tools. These 10 Are the Only Ones That Matter | by Samadhan Shimple: radiohackers.com/i-tested-50…
• Login - CTF Write-up | Finding Exposed Credentials in JavaScript: medium.com/@affanhaxor/login…
🐛 Bug Bounty Writeup
• I Thought Knowing the Payloads Made Me a Hacker — I Was Wrong: medium.com/codetodeploy/i-th…
• I Used Burp Suite for Months Before Realizing What I Was Missing: medium.com/codetodeploy/i-us…
• GitHub Halved Its Bug Bounty Payouts. The People Who Lose Most Aren’t the Ones You Think.: medium.com/@riyalimba/github…
• Forced Browsing Explained | Find Hidden Pages & Access Control Bugs: medium.com/@pentesterclubpvt…
• Finding an Exposed Admin Panel on a Government Portal: A Responsible Disclosure Story: medium.com/@byteshubh1717/fi…
• LFI Bypass: Double URL Encoding Path Traversal: medium.com/@cybersecplaygrou…
• How I Identified a Potential Subscription Payment Enforcement Issue Despite Insufficient Funds: medium.com/@molapomanuel709/…
• Nobody Bans AI Bug Reports. You Can Still Get Permanently Banned.: meetcyber.net/nobody-bans-ai…
• What Hackers Are Actually Finding in 2026: I Went Through the Bug Bounty Reports So You Don’t Have…: osintteam.blog/what-hackers-…
• Visible Error-Based SQL Injection: A PortSwigger Lab Walkthrough: medium.com/@tagmadiyadhrupal…


