Bet you haven't seen a hacker aka bug hunter in a tailcoat in your feed. Now you have 😜 I disappeared a bit in the last few months because of a lot of urgent stuff to close. 1/x

🌊 2025 YTD #BugBounty stats update, June: 📄 13 issues Reported (5 Crit, 2 High, 6 Medium) 💰 10 issues Paid ⚪ 1 Informative Late update this time, just came back from vacation and started digging for new targets to research. I've had my eye on browser extensions for a while.

🤓 2025 YTD #BugBounty stats update, May: 📄 11 issues Reported (4 Crit, 2 High, 5 Medium) 💰 9 issues Paid A new month means 2 more RCEs reported 👌 This time I hit Chromium headless browser for the first time in BBPs.

👌 2025 YTD #BugBounty stats update, April: 📄 9 issues Reported (2 Crit, 2 High, 5 Medium) 💰 8 issues Paid Switched to monthly updates instead of weekly. Why? I don't drop new vulns every week 😅 My stats from the last months confirm my "capacity": ~2 RCEs per month.

Just noticed @elastic.co shipped a bunch of CVEs for the 0-days I reported. Threading them here for memory and tipping my hat to the Elastic Security Team ❤️ top-tier BBP and meticulous triage. Highly recommended for Bug Hunters 😎 #bugbounty #0day #rce

🫡 2025 YTD #BugBounty stats update, March: 📄 7 issues Reported (2 Crit, 1 High, 4 Medium) 💰 2 issues Paid Reported 2 RCEs and some "collateral damage" for March. Still investigating new targets and developing my own tools.

😵‍💫 2025 YTD #BugBounty stats update, Week 8: 📄 2 issues Reported (1 Crit, 1 Medium) As you can see, the stats became even worse this week 😆 One RCE got classified as Medium for the first time in my life 🤯 Trying to negotiate and explain its impact, let's see how it goes...

😐 2025 YTD #BugBounty stats update, Weeks 6-7: 📄 2 issues Reported (2 Crit) Reported 2 RCEs and sticking to my plan of focusing on Criticals. Not too much for two weeks, but chaining vulns takes more time than expected.

🚀 2025 YTD #BugBounty stats update, Week 5: 📄 0 issues Reported I took the last days of my parental leave in Jan and spent most of the time with kids and family. No reports, no vulns, just quality time 👨‍👩‍👧‍👦

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2024! portswigger.net/research/top...

Server-Side Prototype Pollution gadget collection https://github.com/KTH-LangSec/server-side-prototype-pollution #BBRENewsletter87

Now's the time to vote for the Top 10 Web Hacking Techniques of 2024! I'm excited to see my research "Exploiting the Unexploitable Insights from the Kibana Bug Bounty" nominated this year! 😎

🎄 2024 YTD #BugBounty stats update, Week 51: 📄 12 issues Reported (5 Crit, 3 High, 4 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Reported Prompt Injection, so I'm in the club now, bro 😎

🫡 2024 YTD #BugBounty stats update, Week 50: 📄 11 issues Reported (5 Crit, 3 High, 3 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Keeping my promise to report something every week, even if it's not super critical or exciting.

✌️ Bug Bounty Tip: If you don't have time to watch the full video, just check out this slide! If you find a very restricted Prototype Pollution where you can only add empty objects or arrays to the prototype, but the gadget requires properties with payloads.. #bugbounty #bugbountytips #bugbountytip

Dear Bug Bounty programs, You cannot simultaneously prohibit bug escalation and pivoting _and_ insist reports include accurate evidenced risk calculations. Regards, A tired bug hunter

🤒 2024 YTD #BugBounty stats update, Week 48-49: 📄 9 issues Reported (5 Crit, 3 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS me: Starting full-time BB 😎💻✨ Universe: Here, have the flu and a fever for a week 😜 me: Cool... not quite the "hot start" I had in mind 🥲

Developers: “Finally…” Bug Hunters: “We had a good run, old friend!”

oh.. 2 days is very optimistic for me 😆 I've got a few stories where I spent a LOT of time turning Info/Low into Critical. After 1-2 weeks with no results, it becomes obvious that it's not worth it financially, but I just can't stop.. Bug Bounty is kind of an addiction 😳 Here are some of my stories:

If you missed it, my #DEFCON talk "Exploiting the Unexploitable: Insights from the Kibana Bug Bounty" is now live on YouTube! youtu.be/H-bhmSwnRdY

🫡 2024 YTD #BugBounty stats update: 📄 7 issues Reported (4 Crit, 2 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS

Most common question for freshly defended PhDs: What's next? Honestly... I'd love to know too! God, give me a sign! God: Your defense will be in room 1337. me: Say no more. I shall become a Bug Hunter! Full-time Bug Hunter! God: 😳

In case you missed it...the DEF CON video of my talk 'Splitting the Email Atom' is finally here! 🚀 Watch me demonstrate how to turn an email address into RCE on Joomla, bypass Zero Trust defences, and exploit parser discrepancies for misrouted emails. Don’t miss it: youtu.be/JERBqoTllaE?...

Hey BlueSky! I case you missed it: I've created cspbypass.com A site where you can search for known CSP bypass gadgets to gain XSS. It already contains a bunch of useful gadgets with contributions from your favourite hackers. If you have some CSP bypasses to share, feel free to contribute!

🎓 Major November Update: I successfully defended my Ph.D. thesis, "Code-Reuse Attacks in Managed Programming Languages and Runtimes"! 📖 Full text: github.com/yuske/PhD_Th... Check it out if you're interested in attacks based on Prototype Pollutions, Object Injection Vulnerabilities, and want to...