Very nice writeup by @J0R1AN

If you’re tired of encountering AI slop blogs, this one’s for you. @busf4ctor made cool website that has a curated collection of bug bounty resources. Check it out👇

With a single command, xnldorker gathers dork results from multiple search engines. Another nice tool by @xnl_h4ck3r Github link 👇 https://github.com/xnl-h4ck3r/xnldorker

Happy New Year everyone! Enjoy the moment, and get ready for the challenges 0x7ea will bring.

Stumbled upon this cool tool, a repeater for Chrome. Rep+ is a Burp-style repeater extension with built-in AI for quick attack suggestions, very handy for BB hunters. It can also extract secrets and endpoints from JS files. Cool stuff by @BourAbdelhadi Check it out

Nice stuff @pxmme1337! https://bugbounty.forum This is the first use case I've seen for DKIM being used like this 😆

Find out if a GraphQL Endpoint is vulnerable to DoS, CSRF or Information disclosure 👇

Do you know you could fingerprint technologies right from the terminal? 🕵️‍♂️ The -td flag of httpx enables Wappalyzer-based detection to identify underlying technologies like CMS, web frameworks, and programming languages.

The AI-powered ffuf wrapper by rez0 just got a cool update, it now generates contextual wordlists! Instead of just suggesting extensions, ffufai can analyze your target and create custom wordlists for fuzzing. Use --wordlists to enable it. Check it out:

While playing the Hack.lu CTF 2025 with xSTF team, I was able to solve a 0day challenge: a new bypass for a previous Grafana CVE, resulting in XSS and Account Takeover! Read my technical deep dive👇

If you need to generate a target-specific wordlist, make sure to check out @xnl_h4ck3r GAP extension. It will scan for sus parameters and generate you a complete wordlist with one click of a button. See it in action 👇

When looking for postMessage vulnerabilities, the FancyTracker Firefox extension can be very useful. It has built-in syntax highlighting and sortes out duplicates. Check it out 👇 https://github.com/Zeetaz/FancyTracker-FF And the original for Chrome: https://github.com/fransr/postMessage-tracker

Want to learn about how a fascinating XSS vulnerability found by @ethiack engine led to an interesting rabbit hole of bypassing WAFs and parameter injection? Read the blog post here 👇

The Amrelsagaei JWT Analyzer @caido.io plugin is super cool. It will decode the JWT for you and let you try common attack vectors.

When doing recon, if you have a file with a bunch of URLs, you can use @xnl-h4ck3r.bsky.social's urless tool to declutter and reduce the amount of noise in the results. Check it out here 👇 https://github.com/xnl-h4ck3r/urless

When faced with a GraphQL endpoint, make sure to run it through amrelsagaei's GraphQL Caido Analyzer plugin.  It will try to expose the server's schema using Introspection queries & you can run custom attacks to test the batch query limit, field suggestions, etc.

When testing GraphQL APIs make sure to run graphw00f (https://github.com/dolevf/graphw00f) to fingerprint the specific GraphQL implementation the application is running. Then you can review the Threat Matrix to get likely attack vectors.

If you still haven't: set up a JS file monitor to send you notifications via Telegram or Slack every time your target app JavaScript gets updated, a great way to stay on top of updates 👾 https://github.com/robre/jsmon There's also a fork with Discord support:

If you found a package.json file in the wild, you might find some internal packages vulnerable to a dependency confusion attack 👀 Check for it quicker using this cool new tool by JSMon: https://app.jsmon.sh/tools/npm-validator 👇

Looking into a potential SSRF or OR but the server checks against a URL whitelist? Try the backslash trick! Due to a difference in URL specifications, some parsers will treat '\' the same as '/', while others will not. Here's an example payload: https://<attacker-url>\@<whitelisted-url>/

Tomorrow I'll be speaking at https://lisbonai.xyz We're building faster than ever with AI. But are we building securely? I'll show how agents can perform penetration testing and introduce Hackian: an autonomous agent that identifies vulnerabilities before attackers do.

Just had an amazing time working with Shopify in Toronto 🍁 Thanks @hacker0x01.bsky.social for organizing such an incredible event and bringing awesome researchers together. #togetherwehitharder #h1416 #shopify #hacking #goleafs

If you found a dangling DNS record, you might be able to take control of it 👀 Be sure to check https://github.com/EdOverflow/can-i-take-over-xyz, which has an extensive list of vulnerable services and guides on how to claim them.

Modern websites use a lot of intermediary servers - caches, load balancers, proxies, and so on. You can try to send the 'Max-Forwards' header with your request to limit the amount of servers it will reach. It's defined in HTTP specs primarily for TRACE and OPTIONS methods, though.

🚨BsidesLisbon CTF Quals starts now! 🔓Join at: quals.bsideslisbon.org #CTF #BSidesLisbon

Recon tip: Run xnl-h4ck3r's waymore on the target you're testing. It searches for URLs from multiple sources, the Wayback Machine, Common Crawl, URLScan and more. It also provides a lot of options to filter your results. Check it out here 👇

Found an XSS but got blocked by the CSP? https://cspbypass.com has a compiled list of ways to bypass the Content-Security Policy. Check out the video below 👇

Thanks @hacker0x01.bsky.social for the amazing LHE! Had the chance to work with TikTok and OKX and found some cool vulns, including two 0days. Will try to publish a write up once they're fixed! Also, big congrats to the new MVH champion @corraldev.bsky.social for the huge mic-drop at this event 🤯

Need to search through JSON output? Make JSON greppable with @tomnomnom's gron 👇

On my way to @hacker0x01.bsky.social #h165 to pop some shells on TikTok and OKX ✈️

#HackAIcon is finally here! 🚀

How to extract endpoints from JS using @pdiscoveryio's katana 👇

Just one week to go until hackAIcon in Lisbon! 🤖🇵🇹 Can't believe tickets have officially sold out already! Thank you to everyone that has supported the event 🙏 I can't wait to see you all there!

If you need a list of trusted resolvers, e.g. to be used with puredns for active enumeration, @trick3st has a great one. Just run this:  ⌨️ curl https://raw.githubusercontent.com/trickest/resolvers/refs/heads/main/resolvers-trusted.txt -O More stuff at👇 https://github.com/trickest/resolvers

If you look at the AI-generated code below, you may notice that path traversal is prevented via basename functions. Can you still exploit it? Try here 👉 https://ai4eh.ethiack.ninja

The Hack the Agent challenge is finished. GG to all the hackers who played! We hope you enjoyed it. We will leave it running for those who still want to play with it at https://hacktheagent.com Stay tuned on @ethiack socials for more challenges.

This one-liner by @tomnomnom.com finds all Git repos, creates a git-objects/ folder for each one and dumps every object (commits, trees, blobs, tags) into files named by their hash. Effectively exporting the raw Git database into human-readable files, repo by repo!

Bypassing WAFs with traditional payloads is getting harder. Here's how clever payload splitting can bypass them 👇

Some thoughts from @rez0__ on the future of bug bounty and AI 🔥 As someone working on hackbots, I agree that human + AI symbiosis will likely be more effective than either alone.

Want to put your AI model hacking skills to the test? See if you can solve all the challenges in our Hack The Agent challenge! Try it at: https://hacktheagent.com

Want to learn how AI can be used for ethical hacking?  Check out the contents from my workshop on Github!  You'll find: ✅ Workshop guide ✅ Scripts ✅ Tools ✅ CTF Challenges Get stuck in (feedback welcome!) at 

HackAICon is just around the corner! If you wanna join us in Lisbon and haven't got your ticket yet, grab one here: https://hackaicon..com Or try to win a ticket! (🔗 link in comments)

Time to reveal what I was doing with @teknogeek.io back in '19. All the hard work and sleepless nights have paid off!

The AI-powered hacking space is moving fast. CAI was already pretty solid, and Strix just dropped last week. Strix: https://github.com/usestrix/strix CAI: https://github.com/aliasrobotics/cai Anyone tried these yet?

Want to win a ticket to HackAICon, @caido.io licenses or even a @ctbbpodcast.bsky.social discord subscription?  We're currently running a simple 5-level LLM CTF Challenge. Complete all levels to enter our weekly raffles. Good luck! Start hacking: https://hacktheagent.com

Typical CSS injection often relies on repeated context loading (usually via iframes) to exfiltrate sensitive tokens. I found this tool that works in Chrome / Safari. It can leak tokens with just a single CSS import by leveraging -webkit-cross-fade 🤯 Check it out 👇

Try this out on your next target! Some more gold from the guys at @ctbbpodcast.bsky.social! 🔥

How to turn iframes and window.open into weapons for XSS. From origin manipulation to sandbox escape, this paper by Huli is stacked with juicy info.  Read at: https://blog.huli.tw/2022/04/07/en/iframe-and-window-open

What happens after Black Hat and Defcon? HackAIcon 2025.  We're hosting a conference dedicated to combining AI and ethical hacking in Lisbon! And we have some incredible speakers lined up for you. Early Bird tickets are available! Get your ticket: https://hackaicon.com