Here's a quick one-liner for finding open redirects to chain with something more impactful. This will hit all archived URL variants, replace parameter values with your payload, and confirm live redirects using HTTPX response matching.

We've all been there: found an XSS, blocked by CSP. There's a bunch of CSP bypasses that you can try by @renniepak.nl: https://cspbypass.com It has a compilation of bypasses, based on the exact CSP you're up against.  Here’s a quick tutorial on how to use it 👇

Here's a simple concept that's helped me find a lot of bugs. Once it clicks you can't unsee it. A huge family of bugs is basically the same bug: two components read the same input and disagree about what it means.

When @jameskettle.com dropped his last-byte synchronization research back in 2019 I started hunting for race conditions. It's crazy that this still works so often 7 years later. It's such a common, widespread issue and I don't think most hackers are checking for it (usually low dupe count)

GTFOBins is a curated list of Unix binaries that may be exploited to bypass local security restrictions: SUID, sudo, capabilities, file read/write. On real targets you often land in a restricted shell, but those may help you escalate privileges, reading unauthorized files, etc

Hacking ≡ Magic

New redirect tricks from @castilho101 just dropped 🥷

Found an IDOR vulnerability but the IDs are UUIDs? Don't drop the report yet 👇

Submitting alert(document.location) will probably get you a medium. Proving impact can make a real difference. Escalating an XSS used to be as easy as leaking cookies. That often doesn't work anymore because the HttpOnly flag is typically present on the juicy session cookies.

Are you getting a forbidden status code hitting a sensitive endpoint on a Node.js app? It may be using Fastify. The middleware may check the exact path, e.g. /internal. If the app has router normalization options enabled, the following or variations may work: //internal /internal;a=b

A lot of people are now building and using their own hackbots daily. Here's a nice blog on using AI to hunt for vulns by 0xAsm0d3us. Some takeaways that I've also been experiencing:

Claude being careful

On my way to #H121 in Lisbon 🌞 Super cool to see the first LHE from @Hacker0x01 in Portugal.

You're attacking an OAuth implementation, but it properly validates if the redirect_uri starts with https://victim.com/callback - are we cooked? Not necessarily.  We should still check if it enforces strict path matching.

It's really nice to see a lot of hackers finally coming around to the idea of using AI. Here's a cool episode from @ctbbpodcast.bsky.social on building Claude skills for hacking. Been playing with connecting Claude Code to @caido.io and loving it.

CI/CD pipelines provide a lot of juicy attack surface. One common pattern: a build system lets you specify an output path for artifacts. If that path isn't sanitized, a ../ sequence lets you write files anywhere on the build server.

Reverse engineering MCPs like IDA Pro MCP or Ghidra MCP are really powerful to find memory corruption 0days or reversing CVEs.

Race conditions in OAuth flows can still happen in custom implementations. Tools like Turbo Intruder or even a simple multi-threaded script sending concurrent requests to the callback URL with different tokens may trigger it. Further reading here:

Hackerone MCP Server (unofficial). An MCP server that gives you quick access to your HackerOne reports, programs, earnings, and scope data. Very useful tool by @OriginalSicksec for anyone that's automating but bounty hunting. GitHub repo 👇

Super cool work by @s3bsrt HTTP trailers can be a blind spot. Proxies usually ignore them, but backend servers will happily merge them into the main headers, letting you sneak payloads right past security filters. Blog link 👇

Find hidden API parameters in seconds, not hours.  Arjun scans 25,890 parameter names with just 50-60 requests in under 10 seconds.

Scanning 65,000 ports in just a few seconds with the power of Rust! 🦀

WontFix can be an RCE Goldmine SOAPwn by chudyPB #5 in PortSwigger Web Hacking Techniques of 2025 Blog link 👇

The ETag Oracle Cross-Site ETag Length Leak by @arkark_ This technique weaponizes 1-byte ETag length variations to trigger 431 header overflows, detectable via Chromium's history API. Blog here👇

A really nice Cross-Site Leak writeup by salvatoreabello For client-side hackers, you would love this in your arsenal because it relies on browser architecture. Since Google marked it "WAI", this vector is still open. Blog 👇

I may have organized a challenge (or two) for upCTF by @xstf_team, starting in 14 hours! Register now for a chance to win cool prizes 🥷

This blog site of @samm0uda is a treasure trove of everything Meta (Facebook, Instagram, Oculus) hacking 👇

Lost in Translation: Exploiting Unicode Normalization With this research, ryancbarnett and 4ng3lhacker added another layer of understanding to this area. They introduced a lot of very interesting techniques. Check it out 👇

Playing with HTTP/2 CONNECT by @fl0mb.bsky.social  This research explores how HTTP/2 CONNECT can be utilized for port scanning. It may also bypass traditional network inspection tools, which opens up a lot of possibilities. Check the blog👇

Many people overlook Android hacking due to the challenges associated with configuring emulators and proxies. Thankfully, there's a comprehensive guide from @bugcrowd.com that walks you through the setup process.

Tired of hitting 403 errors during your security testing?  NoMore403 by @devploit automates bypass techniques to get past those pesky restrictions.  Try it at 👇 github.com/devploit/nomore403

CewlAI by @rez0__ takes your domains, learns the naming patterns, and generates new variations using Gemini, OpenAI, WhiteRabbitNeo, or a local Ollama model. It's great to expand recon and improve permutations👇

Vulnerability Spoiler Alert Action by @spaceraccoonsec It monitors repositories and uses Claude to detect patching of security vulns. This early warning can give security teams more time to patch before the CVE drops. GitHub repo👇

Hackian uncovered interesting business logic flaws in SonarQube and n8n. Blog post by @pcuco92👇

Did you know that you can subscribe to topics using RSS on Medium? For example, if you want to receive updates about cross-site scripting, simply use this link:  https://medium[.]com/feed/tag/cross-site-scripting

ASN/CIDR lookups are massively underrated for recon. Start with a company name. Find all their assets. Get instant ASN to CIDR lookups, IP/DNS/ORG resolution, and JSON/CSV output 👇

ASN/CIDR lookups are massively underrated for recon. Start with a company name. Find all their assets. Get instant ASN to CIDR lookups, IP/DNS/ORG resolution, and JSON/CSV output 👇

Agentic ProbLLMs: Exploiting AI Computer-use and Coding Agents - by @wunderwuzzi23

Exposing Instagram posts from private users. A writeup by @rub003 

Openclaw (Clawdbot) is cool and all but it’s also risky. Make sure you get your bot audited with some better security practices 👇  https://auth0.com/blog/five-step-guide-securing-moltbot-ai-agent/

Manually hunting for endpoints and hidden parms in web apps? Another nice tool from xnl_h4ck3r is xnLinkFinder that crawls targets, extracts links, discovers secrets, and builds target-specific wordlists. Try it out 👇 https://github.com/xnl-h4ck3r/xnLinkFinder

404 page to RCE. A report by Spaceraccoon Chained CVE-2007-0450 (mod_proxy traversal via %5C../) + CVE-2007-1036 (exposed JBoss console) + Java deserialization RCE with jexboss Full report 👇

💥 One click could completely compromise a OpenClaw / Moltbot / Clawdbot (CVE-2026-25253) The vulnerability is now fixed, but here's how it worked:

Very interesting techniques by Slonser. If your AI agent is reading external data (especially from MCP servers), proceed with caution. Incoming data might trick your model into executing unintended actions. Blog link 👇

Need to find the APIs the devs forgot about? Combine waymore with xnLinkFinder or similar. - waymore: Gathers the archived URL responses. - xnLinkFinder: Extracts the hidden paths and parameters. GitHub repos 👇 https://github.com/xnl-h4ck3r/waymore https://github.com/xnl-h4ck3r/xnLinkFinder

Our pentesting agent found a 1-click ATO to RCE in @moltbot Gateway Control UI in under 2 hours. Local instances can also be exploited with one click. Patched in main, update now. Watch the exploit 👇

It's been a while since I've tried to find bugs in Facebook. Maybe it's time to look into the new stuff. I remember the days when we spent one entire day intercepting mobile app traffic by patching a native lib when nobody knew about it and finding an open redirect on instagram[.]com///evil.com

Looking for S(security) in MCP? 👀 You’re probably already familiar with MCP but did you know that it’s not secure out of the box?

Ryotak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯 Claude Code allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.  Blog link 👇

It's crazy how hallucinated AI CVE PoCs keep ending up in NIST NVD references. One recent example is CVE-2026-21962, a 10.0 CVE in Oracle HTTP Server / Apache Proxy Plugin. https://nvd.nist.gov/vuln/detail/CVE-2026-21962 links to a GitHub repository with a fake PoC.