Abhishek Meena @aacle_

My strategy for finding bugs is pretty simple: - First, understand what the feature does. - Then use it normally for a while. - After that, start changing things and see what breaks. Sometimes the best bugs come from doing something the developer didn’t expect.

There’s a peculiar thing about using Claude for bug bounties: The first hour can be incredibly productive. The next five hours? Sometimes, it’s just a matter of becoming overly confident about the wrong ideas. That’s when I realized: The real skill isn't just prompting Claude. The real skill lies in knowing when to stop it or tell it to abandon a fruitless path. "Stop. This approach is a dead end. Look here instead." AI-assisted bug hunting probably isn't about giving the AI ​​more freedom. It’s likely about getting better at steering the investigation in the right direction.

"Bug bounty is dead." Meanwhile, someone just made $200K using one prompt. Maybe the real story isn't that bug bounty is dying. Maybe we're watching the definition of a bug bounty hunter change. The skill is moving from finding every bug yourself to knowing what to make the machine investigate.

Some bug bounty content just never gets old. STÖK's ( @stokfredrik ) content, old videos with TomNomNom... ( @TomNomNom ) watching this again genuinely took me back to the beginning of my own journey. Those who started hunting 6–7 years ago probably know exactly what I mean. You may have learned new tools, found new bugs, changed completely as a researcher... But some content still hits like it did on day one. 🫶 youtu.be/l8iXMgk2nnY

Repository :👇 github.com/devploit/nomor…

Tried nomore403 recently. Not just another 403 bypass tool throwing random payloads. It baselines responses, filters the noise, and scores results. Pretty useful for quickly testing access-control edge cases. Keeping this one around.

Yeah, I’ve tested it across multiple runs. For bug bounty work, Deepseek v4 pro was consistently better for me. Aikido's benchmark showed similar results: Deepseek had strong recall, while flash was highly cost-effective. Not saying it wins every single task, but for bug bounty work? hard to ignore.

If you doing bug bounty, try DeepSeek V4 Pro. its better than fable 5 in CyberGym bench: It’s also much cheaper, so you can run more testing. Not saying DeepSeek > Claude. But damn… hard to ignore 👀

Yesterday I said I forked Burp’s official MCP server because it was holding me back. Here’s what I actually changed. The official MCP server is mostly one-way. Claude can send a request to Burp Repeater. But it can't read the response back. It can't see Intruder results. It can't start or manage scans. So I fixed that. Now the AI can: → Stage Repeater requests and read them back by name → Set up Intruder attacks and read the results → Run crawls + active scans, check progress and stop them → Read site maps and history → Access scope + cookie jars when approved → Add notes and highlight findings → Use it with Claude, OpenCode, Copilot CLI and Codex CLI And I also built a live dashboard inside Burp to see what the AI is actually doing: requests, traffic, scans and activity. One honest limitation: Burp still doesn't expose an API for reading tabs you manually typed into. But anything the AI sends through the MCP is captured and can be read back. So yeah. I didn't plan to build all of this. I just wanted the MCP to stop getting in my way. 😭 GitHub release is coming. 🔥

I was going through a bunch of public SSRF reports on HackerOne while researching for this article. I ended up analyzing around 286 reports using claude, and one thing stood out to me. 8 of the top 20 didn't just end at SSRF. Researchers were able to take it further: → access internal services → hit cloud metadata endpoints → extract credentials → access cloud infrastructure That's what I find interesting about SSRF. Finding the SSRF is only one part of the bug. The more important question is: "What can the server reach from there?" I broke down some of the real patterns I found across the reports, along with examples of how SSRF ended up exposing AWS keys, GCP tokens and other cloud credentials. Full breakdown in my latest article 👇 medium.com/codetodeploy/s…

Minified JavaScript can look impossible to read. But sometimes the source map is still publicly accessible: app.js.map If it's exposed, the original source structure may be much easier to understand. Always check what developers accidentally ship alongside production code.

🚀 One of the most common questions I see from beginners: “How do I actually start bug bounty?” My honest answer: don't start by trying to learn everything. Pick one vulnerability. Understand: • How it works • Why it happens • Where it usually appears • How to test it • How to prove real impact Then practice it again and again. The mistake many beginners make is jumping between XSS, SQLi, SSRF, IDOR, APIs, recon, tools, and 20 YouTube videos at the same time. You don't need to understand the entire internet before finding your first bug. 🎯 Pick one thing. Understand it deeply. Test it repeatedly. Depth first. Then breadth. What vulnerability did you start with? 👇

One of the most underrated skills in bug bounty is knowing what not to investigate. You can spend hours testing a feature that will never lead anywhere. And on the same day, ignore a small weird behavior that could lead to a critical bug. The difference isn't always technical knowledge. Over time, good researchers develop an instinct for: - "This is probably nothing." - "This is interesting." - "I should spend another hour here." I think bug bounty is partly about finding vulnerabilities. But a huge part of it is learning where to spend your attention.

AI can make us faster, but if we outsource our thinking, we may become worse researchers. After testing AI in security workflows, here’s what I learned 👇

I can understand charging a fee to stop AI-generated spam. But as researchers, imagine this 👇 You spend hours testing a target. You find a real vulnerability. You validate it properly and submit the report. Then it gets closed as a duplicate because someone else found it before you. Fair enough. They were first. But losing $50 on top of that? That's the part I don't think researchers have much control over. A valid duplicate is still a real bug. Maybe it deserves submission credit instead.

Jiri123 @Jiri123_eth

2 days ago

This is how to lose $50 in 4 minutes.

21 4 165 63K 17

While working on my upcoming Medium article on SSRF, I made this simple visual to explain where the bug actually lives. The attacker controls the input, but the server makes the request. 👇

I think this is the right approach. AI can save a huge amount of time on recon, repetitive testing, and exploring attack surfaces. But if we outsource too much of the actual thinking, we might become faster while becoming worse researchers. And I also agree on the model side. The best model isn't always the most expensive one. In my own testing, DeepSeek V4 Pro has been giving me an edge. In some cases, I've found it performing better than some of the more highly recognized top models. I think model selection should be based more on the actual task and testing workflow than the price or hype around the model.

Jiri123 @Jiri123_eth

2 days ago

This is how to lose $50 in 4 minutes.

21 4 165 63K 17

I made Burp Suite’s MCP extension way better. And honestly, I got frustrated with how much it was holding me back. So I forked it. Started making a few changes and ended up building something way more capable than I originally planned. I’ve made the Burp Suite MCP way more powerful for the kind of testing I wanted to do. A lot more to share soon. Details tomorrow. GitHub release coming. 🔥

This is a great example of how impactful bugs often start from something that looks small.

zack0x01 @zack0x01_

2 days ago

Today I found a pretty interesting bug chain 👀 Started with a file upload extension filter bypass, then found a way to overwrite files belonging to other users. From there, I discovered a way to enumerate platform UUIDs. The final impact was crazy: I could potentially execute

8 4 170 8K 46

AI is giving cybersecurity people something extremely valuable: More attempts. A researcher who could investigate 10 ideas in a day might now investigate 50. Most of those ideas will still fail. But security research has always been a numbers game. - More hypotheses. - More experiments. - More code understood. - More attack paths explored. The intelligence of AI isn't just replacing work. It's reducing the cost of being curious. And I think that will change cybersecurity far more than people expect.

A bug bounty hunter posts a subdomain enumeration technique. It gets millions of impressions. And now everyone is acting like they discovered a new life hack. “This is a new way to apply for jobs!” No, it isn't. It's a recon technique. The use case is discovering an organization's attack surface during authorized security research. But once something gets millions of impressions, people who don't understand the original context start reposting it with whatever angle might also go viral. This is the part of viral cybersecurity content I dislike the most: People don't learn the technique. They learn that the post is trending. And then suddenly everyone has their own “use case” for something they don't actually understand.

govi @kirtandopamine

3 days ago

fuck linkedin, i just found a new way to apply for jobs!!

46 178 4K 522K 5K