Professional Hacker | OSCP | CRTO | Bug Bounty Hunter
Washington, DC
Joined June 2012
- Tweets1.2K
- Following174
- Followers113
- Likes433
Found a bug… it was a duplicate, which I am not mad about. The thing that truly bothers me is that the report was originally sent in 2024 and they still have not fixed it….
Submitted 4 reports to a VDP via @Hacker0x01 but has been 3 days and I have yet to hear if the reports are valid or not…. Is this the new normal?
So far my updated hackbot harness has found 2 bugs that I just submitted. This is version 6 from a lot of trial and error but seems to be working properly now. Let’s hope it can find more stuff
If anyone has seen the amazing blog post of Google cookie RCE, I have created a lab environment through docker for beginners to learn how the exploit works. This is a CTF style lab with 3 flags. I would love any feedback from the community github.com/MrR0b0t23/Google-…
#BugBounty
Are individual bug bounty hunters able to get red team access at Anthropic? From what I am seeing we can only get Defense
Santiago T retweeted
Shitty move!! Basically telling bug bounty hunters and independent red teamers to piss off…
- Max/Pro users only get cyber defense—no red teaming.
- Red teaming is limited to team plans and requires business verification. 🤦
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Santiago T retweeted
Separating red team and defense access imo shows a very poor understanding of what it means to work in security.
How can you “defend” your product if you can’t attempt offensive actions?
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Just submitted my first ever report and it’s a High vulnerability to a private program. Let’s hope I can get my first ever bounty.
#hacking #bugbounty
Just submitted my second ever critical to @Hacker0x01! Thank you to @infinitelogins and @Arl_rose for the BB Village this year. It gave me the hacking bug to get hacking again. Also thank you @galnagli for your WIZ BB Bootcamp, that truly helped my recon so much.
Just submitted a medium which was triaged and closed. But also a high finding to @Hacker0x01. After some time away from bug hunting I got the itch again.
On my way back to DC but I have to say, my second DEFCON ever was a blast. Thank you so much to everyone who put the time to create the villages and all the amazing talks. I am already counting the days for @defcon 35. Thank you @thedarktangent
#hackerone #defcon
Does anyone in a veteran DEFCON group know where I could get merch for my dad who is a veteran? @defcon
Cannot wait to see you guys @infinitelogins @Arl_rose at the BB village. I will also be in attendance at HackerOne’s hangout.
Hey @galnagli I love the bug bounty masterclass course! Thank you so much to you and the Wiz team for putting that together. I wanted to ask though, I noticed that you are doing your recon through a VPS. Do you have any recommendations which one to use?
After some weeks of “vibe coding” with cursor AI, I wanted to learn how to do HTTP Request Smuggling. I developed my first ever CTF lab with AI to practice. If interested you can close the repo:
github.com/MrR0b0t23/Request…
Ok… so I may or may not have found my first ever HTTP Request Smuggling vulnerability… hoping that it’s a valid bug but we will see. #hacking #bugbounty