CewlAI by @rez0__ takes your domains, learns the naming patterns, and generates new variations using Gemini, OpenAI, WhiteRabbitNeo, or a local Ollama model. It's great to expand recon and improve permutations👇

Vulnerability Spoiler Alert Action by @spaceraccoonsec It monitors repositories and uses Claude to detect patching of security vulns. This early warning can give security teams more time to patch before the CVE drops. GitHub repo👇

Hackian uncovered interesting business logic flaws in SonarQube and n8n. Blog post by @pcuco92👇

Did you know that you can subscribe to topics using RSS on Medium? For example, if you want to receive updates about cross-site scripting, simply use this link:  https://medium[.]com/feed/tag/cross-site-scripting

ASN/CIDR lookups are massively underrated for recon. Start with a company name. Find all their assets. Get instant ASN to CIDR lookups, IP/DNS/ORG resolution, and JSON/CSV output 👇

ASN/CIDR lookups are massively underrated for recon. Start with a company name. Find all their assets. Get instant ASN to CIDR lookups, IP/DNS/ORG resolution, and JSON/CSV output 👇

Agentic ProbLLMs: Exploiting AI Computer-use and Coding Agents - by @wunderwuzzi23

Exposing Instagram posts from private users. A writeup by @rub003 

Openclaw (Clawdbot) is cool and all but it’s also risky. Make sure you get your bot audited with some better security practices 👇  https://auth0.com/blog/five-step-guide-securing-moltbot-ai-agent/

Manually hunting for endpoints and hidden parms in web apps? Another nice tool from xnl_h4ck3r is xnLinkFinder that crawls targets, extracts links, discovers secrets, and builds target-specific wordlists. Try it out 👇 https://github.com/xnl-h4ck3r/xnLinkFinder

404 page to RCE. A report by Spaceraccoon Chained CVE-2007-0450 (mod_proxy traversal via %5C../) + CVE-2007-1036 (exposed JBoss console) + Java deserialization RCE with jexboss Full report 👇

💥 One click could completely compromise a OpenClaw / Moltbot / Clawdbot (CVE-2026-25253) The vulnerability is now fixed, but here's how it worked:

Very interesting techniques by Slonser. If your AI agent is reading external data (especially from MCP servers), proceed with caution. Incoming data might trick your model into executing unintended actions. Blog link 👇

Need to find the APIs the devs forgot about? Combine waymore with xnLinkFinder or similar. - waymore: Gathers the archived URL responses. - xnLinkFinder: Extracts the hidden paths and parameters. GitHub repos 👇 https://github.com/xnl-h4ck3r/waymore https://github.com/xnl-h4ck3r/xnLinkFinder

Our pentesting agent found a 1-click ATO to RCE in @moltbot Gateway Control UI in under 2 hours. Local instances can also be exploited with one click. Patched in main, update now. Watch the exploit 👇

It's been a while since I've tried to find bugs in Facebook. Maybe it's time to look into the new stuff. I remember the days when we spent one entire day intercepting mobile app traffic by patching a native lib when nobody knew about it and finding an open redirect on instagram[.]com///evil.com

Looking for S(security) in MCP? 👀 You’re probably already familiar with MCP but did you know that it’s not secure out of the box?

Ryotak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯 Claude Code allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.  Blog link 👇

It's crazy how hallucinated AI CVE PoCs keep ending up in NIST NVD references. One recent example is CVE-2026-21962, a 10.0 CVE in Oracle HTTP Server / Apache Proxy Plugin. https://nvd.nist.gov/vuln/detail/CVE-2026-21962 links to a GitHub repository with a fake PoC.

Active crawling is powerful, but combining it with passive leads to even better results. GAU fetches historical URLs from external sources like AlienVault OTX, Wayback Machine, and Common Crawl. It’s great for uncovering forgotten endpoints and parameters. 👉https://github.com/lc/gau

Have you ever tried to find JSON Web Token (JWT) bugs? 5 ideas to try 👇

Manually going through multiple web archiving sites while hunting can be a tedious task. Here is a browser extension to help you do that quickly. https://chromewebstore.google.com/detail/web-archives/hkligngkgcpcolhcnkgccglchdafcnao https://addons.mozilla.org/en-US/firefox/addon/view-page-archive/

The questions you need to ask to learn about a new vuln class or technique 🐛 Why does it occur (root cause) and how to exploit it? Are there labs or challenges to practice on? Any related disclosed reports, blog posts or writeups? What are the best targets to hunt for it? What tools can detect it?

A critical Supabase JWT bug by @BourAbdelhadi And he used rep+ for this impactful finding Tool👇

Hacking a GraphQL API but introspection is disabled? Clairvoyance, a tool by @_nikitastupin, can reconstruct GraphQL API schema even if the introspection is disabled.  For installation and usage 👇

A researcher showed that for SSO users, the Firefox password hash check could be bypassed using the attacker's session to delete arbitrary accounts. I guess the password DB values were None/NULL, causing the bug. Super interesting. Always check SSO edge cases!

Very nice writeup by @J0R1AN

If you’re tired of encountering AI slop blogs, this one’s for you. @busf4ctor made cool website that has a curated collection of bug bounty resources. Check it out👇

With a single command, xnldorker gathers dork results from multiple search engines. Another nice tool by @xnl_h4ck3r Github link 👇 https://github.com/xnl-h4ck3r/xnldorker

Happy New Year everyone! Enjoy the moment, and get ready for the challenges 0x7ea will bring.

Stumbled upon this cool tool, a repeater for Chrome. Rep+ is a Burp-style repeater extension with built-in AI for quick attack suggestions, very handy for BB hunters. It can also extract secrets and endpoints from JS files. Cool stuff by @BourAbdelhadi Check it out

Nice stuff @pxmme1337! https://bugbounty.forum This is the first use case I've seen for DKIM being used like this 😆

Find out if a GraphQL Endpoint is vulnerable to DoS, CSRF or Information disclosure 👇

Do you know you could fingerprint technologies right from the terminal? 🕵️‍♂️ The -td flag of httpx enables Wappalyzer-based detection to identify underlying technologies like CMS, web frameworks, and programming languages.

The AI-powered ffuf wrapper by rez0 just got a cool update, it now generates contextual wordlists! Instead of just suggesting extensions, ffufai can analyze your target and create custom wordlists for fuzzing. Use --wordlists to enable it. Check it out:

While playing the Hack.lu CTF 2025 with xSTF team, I was able to solve a 0day challenge: a new bypass for a previous Grafana CVE, resulting in XSS and Account Takeover! Read my technical deep dive👇

If you need to generate a target-specific wordlist, make sure to check out @xnl_h4ck3r GAP extension. It will scan for sus parameters and generate you a complete wordlist with one click of a button. See it in action 👇

When looking for postMessage vulnerabilities, the FancyTracker Firefox extension can be very useful. It has built-in syntax highlighting and sortes out duplicates. Check it out 👇 https://github.com/Zeetaz/FancyTracker-FF And the original for Chrome: https://github.com/fransr/postMessage-tracker

Want to learn about how a fascinating XSS vulnerability found by @ethiack engine led to an interesting rabbit hole of bypassing WAFs and parameter injection? Read the blog post here 👇

The Amrelsagaei JWT Analyzer @caido.io plugin is super cool. It will decode the JWT for you and let you try common attack vectors.

When doing recon, if you have a file with a bunch of URLs, you can use @xnl-h4ck3r.bsky.social's urless tool to declutter and reduce the amount of noise in the results. Check it out here 👇 https://github.com/xnl-h4ck3r/urless

When faced with a GraphQL endpoint, make sure to run it through amrelsagaei's GraphQL Caido Analyzer plugin.  It will try to expose the server's schema using Introspection queries & you can run custom attacks to test the batch query limit, field suggestions, etc.

When testing GraphQL APIs make sure to run graphw00f (https://github.com/dolevf/graphw00f) to fingerprint the specific GraphQL implementation the application is running. Then you can review the Threat Matrix to get likely attack vectors.

If you still haven't: set up a JS file monitor to send you notifications via Telegram or Slack every time your target app JavaScript gets updated, a great way to stay on top of updates 👾 https://github.com/robre/jsmon There's also a fork with Discord support:

If you found a package.json file in the wild, you might find some internal packages vulnerable to a dependency confusion attack 👀 Check for it quicker using this cool new tool by JSMon: https://app.jsmon.sh/tools/npm-validator 👇

Looking into a potential SSRF or OR but the server checks against a URL whitelist? Try the backslash trick! Due to a difference in URL specifications, some parsers will treat '\' the same as '/', while others will not. Here's an example payload: https://<attacker-url>\@<whitelisted-url>/

Tomorrow I'll be speaking at https://lisbonai.xyz We're building faster than ever with AI. But are we building securely? I'll show how agents can perform penetration testing and introduce Hackian: an autonomous agent that identifies vulnerabilities before attackers do.

Just had an amazing time working with Shopify in Toronto 🍁 Thanks @hacker0x01.bsky.social for organizing such an incredible event and bringing awesome researchers together. #togetherwehitharder #h1416 #shopify #hacking #goleafs

If you found a dangling DNS record, you might be able to take control of it 👀 Be sure to check https://github.com/EdOverflow/can-i-take-over-xyz, which has an extensive list of vulnerable services and guides on how to claim them.