every group chat I'm in this week is the same three messages:
"did you see PHP2SHELL" "yeah" "are we affected" "…checking"
nobody's affected until the inventory says so. and nobody has an inventory 🚨
Abhishek retweeted
Are bug bounties dead in 2026?
Not even close. @simonkoeck just found an RCE in Google.
A Flask session cookie on developers.google.com was signed with a secret key, and that same key let him forge a session into deserializing a malicious pickle payload, straight to code execution across Google's dev sites.
Google paid him $90,000.
Bug bounties aren't dead. You just need the mindset to look for angles nobody else has checked yet.
I wrote a full guide on how to start (or come back to) bug bounties in 2026
Link below, plus Simon's write-up. 👇
Abhishek retweeted
when my agents has gone crazy
@rez0__
blog:josephthacker.com/hacking/20… is always the perfect motivation to bring my mindset and to remind me of any mistake im doing. love you bro😀
just came across this claude-kit by yeswehack 👀
the part i found interesting is how it handles things like IDOR, SSRF and race conditions when reviewing bug bounty reports.
it actually pushes back on claims you haven't proven instead of just helping you write a convincing report lol
especially the part about race conditions. multiple 200 responses don't necessarily mean the bug is real. you need to verify what actually changed.
might give this one a try 👇
github.com/yeswehack/claude-…
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
hackbot is killer
I'm genuinely amazed by what Hackbot can do 🔥.
If you've trained your hackbot properly, it could easily handle 70% of your workflow, help you find more bugs, and let you submit more valid reports.
And we're still just getting started.
A good hackbot isn't just about feeding it CVE data. It's about teaching it how to think and approach a hunt.
Give it your past bug bounty reports, your findings, and publicly available historical HackerOne reports. This helps the agent understand where bugs are actually found and what patterns to look for.
Then let it turn what it learns into reusable skills or .md files. Keep improving those skills by observing its testing and refining them day by day.
After a few weeks or months, the agent can perform much better than it did initially, and more of the work can be handled by your hackbot harness.
Also, keep testing your harness with different models. Understand which models perform better for which vulnerability types, where they struggle, and which ones give you the best results for less money.
That's a simple way to build, train, and continuously improve your own hackbot.
🧠 Using AI for bug bounty? These tips are worth a read.
Everyone is using the same frontier models for bug bounty now, which means generic prompts just put you in a race to the duplicate queue.
Things that gives you an edge is not the best model.
Because the model is accessible to everyone, the one thing that matters is the proprietary context and the past report data you feed into the harness to make them think better, find better vulnerabilities, and catch something different than duplicates.
Abhishek retweeted
A few bypasses that keep working for me in hunts. There are huge lists out there, but these are my go-to checks:
1 - Edge vs. router path drift
/api;/v1/..., /admin/./, /API/..., or a trailing / on a 403. The proxy and the backend parse paths differently.
2- Fake static extensions
/api/users/123.photo or file.docx.pdf. WAFs and bot managers like DataDome often treat these as static media and wave them through.
3 - GraphQL comment prefix
#x\nmutation { ... } gets past gateways that regex-block anonymous mutations.
4 - Pre-MFA surface swap
Log in with the password, stop at the 2FA screen, then send that session to /graphql or /connect/token (grant_type=password). Not every endpoint checks that MFA finished.
5 - Case-varied JSON keys
suppliername write-blocked by RBAC? Send Suppliername. The authz check and the deserializer don't always agree.
6 - Null/empty OTP race
Request an OTP, then immediately verify with code: "" before the async DB write lands.
What's on your list? 👇
Abhishek retweeted
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
Abhishek retweeted
I just spent the last 6 hours with two different models to exploit an XSS and I think I finally figured it out
all of this to get a dupe?
Abhishek retweeted
Telegram Desktop: one-click account takeover via IPC injection
beaksec.github.io/posts/tele…
Abhishek retweeted
A Google API key is not always just a Low or Informational finding.
The Story of Submitting some P1s in the last months by the same method
Sometimes the real impact is in what you can do with it.
For example, with Firebase / Google Identity Toolkit, a leaked key may allow account creation directly through the API:
curl -sk -X POST \
"identitytoolkit.googleapis.c…" \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]","password":"Test12345!","returnSecureToken":true}'
Now imagine the application trusts users based on the email domain and does not properly verify ownership.
In that case, you may be able to create an account using an organization email, receive a valid auth token, and access parts of the application that were supposed to be limited to internal users.
At that point, this is no longer about an "exposed Google API key".
The impact can become unauthorized registration, authentication bypass, internal access, sensitive data exposure, or even full access to the application depending on how the backend handles authorization.
So before marking a Google API key as Low, always check what the key actually allows you to do.
The key itself may be Low. The impact behind it may not be.
#bugbountytips #bugbountytip #infosec #Bugbounty
