You've identified a possible XSS 🤑 But CSP is in the way... 😓 What if you could just entirely bypass this CSP and execute your payload? 🤠 In our latest article, we documented multiple methods to bypass CSPs to execute malicious JS code! Read the article today (link in next post)! 👇

It's time for the monthly code challenge! The administrator interface is finally ready, and according to the development team, proper authorization has been deployed, so only administrators have access. 🤠 Can you craft a working payload proving them otherwise? 😎

In the world of JWTs, 'none' can sometimes mean everything... 🤠 As Intigriti 1125 wraps up, we're releasing the official write-up for this month's CTF challenge! We crafted a vulnerable aquarium e-commerce platform where JWT manipulation and template injection chain together for full RCE

Latest Bug Bytes is live! 🚀 This month's issue is as usual packed with bug bounty tips: ✅ Finding an RCE using AI in GitHub ✅ CORS exploitation cheat sheet ✅ Scanning codebases with AI ✅ Bypassing paywalls ✅ SSTIs in AI models + monthly hacking challenge & much more! 😎

DOM-based XSS vulnerabilities are tricky to test for, especially at scale, which often makes them go unnoticed for years... 😬 Yet, these seamless DOM-based bugs can sometimes even lead to account takeovers 👀 In our comprehensive article, we explore how you can identify and exploit this XSS type.

Most JWT vulnerabilities go unnoticed as they're notoriously tricky to test for 😬 Yet, when present, they can allow for account takeovers, SQL injections and in-app privilege escalations 🤠 In our latest article, we break down every common JWT attack vector with practical exploitation techniques.

Latest Bug Bytes is live! 🚀 This month's issue is as usual packed with bug bounty tips: ✅ Cool trick to find disclosed secrets in internal web extensions ✅ A repository full of WAF bypasses ✅ Hacking Intercom misconfigurations ✅ Wayback Machine for hackers + monthly hacking challenge & much more!

It's time for the monthly code challenge! This developer has just completed this new MFA implementation, which provides an added layer of security to protect against credential stuffing attacks! 🤠 Can you craft a working payload to evade this MFA implementation? 😎

XSS vulnerabilities keep haunting applications even today 👻 And they're all over the place... sometimes hiding in plain sight! 👀 In our most recent article, we shared a practical and beginner-friendly methodology for testing for reflected & stored XSS vulnerabilities in any target!

Exposed secrets can have a devastating impact on any organization 👀 But you have to know where to look for them... 🔍 In our article, we explore several methods to search for leaked secrets, such as credential pairs, API keys, and other hard-coded tokens that can expand your initial attack surfaces

It's time for the monthly code challenge! This developer has just finished writing his new input sanitizer function and is certain that it catches all malicious XSS payloads! 🤠 Can you craft a working payload proving him otherwise? 😎

Next.js has become one of the most popular web development frameworks 🤠 But its extensive functionality introduces multiple attack surfaces for security vulnerabilities to arise... 😬 In our recent article, we documented 3 ways to exploit SSRF vulnerabilities in NextJS targets! Link in next post 👇

Latest Bug Bytes is live! 🚀 This month's issue is as usual packed with bug bounty tips: ✅ A common (yet unknown) SSRF attack vector in Next.js Middleware ✅ Exploiting PDF processors by generating and uploading malicious PDF payload files ✅ A full recon breakdown on how to approach any target

Web-based plugin ecosystems introduce an entirely new world of integration possibilities to cloud-based platforms 🤠 But they also open up a new attack surface for us to explore... 👀 In our latest article, we've lined up frequent security risks to test for when you approach your next target

It's time for the monthly code challenge! The latest release has introduced profile customization, including uploading your profile picture! 🤠 Can you craft a payload that enables remote code execution? The web server (Apache) is configured to execute any PHP files in the upload directory! 😎

SSRF vulnerabilities are getting harder to find... But they're still one of the most impactful bugs you can discover 🤠 Our latest community challenge featured a unique SSRF pattern in NextJS Middleware that many developers (& security researchers) don't know about 👀

Latest Bug Bytes is live! 🚀 This month's issue is as usual packed with bug bounty tips: ✅ Evading WAFs like Cloudflare,Akamai & AWS Cloudfront ✅ Creating your complete bug bounty automation system ✅ A powerful, targeted backup file scanner ✅ Bypassing CSP to achieve XSS via a cool trick with PDFs

Firebase targets are often overlooked... Causing security misconfigurations to stay undiscovered for months 😬 Firebase uses custom security rules that are more complex to get right. In our latest article, we covered several ways to find security misconfigurations in Firebase targets 😎

Come and find the @intigriti.com team at BsidesLV. I have stickers and challenge coins… 👀

🔒 Security isn’t an afterthought at UpCloud, it’s built in. Thanks to our partnership with @intigriti.com, we’ve integrated bug bounty, VDP & PTaaS to stay ahead of threats and protect what matters most: our customers. 🎥 www.youtube.com/watch?v=Jf_D... 📖 www.intigriti.com/customer-sto...

It's time for the monthly code challenge! This new text-to-image tool has been added to the collection of conversion tools. It also accepts URLs! 🤠 Can you craft a working proof of concept that is capable of reaching the internal-only AWS metadata endpoint? 😎

You've identified a possible SQLi 🤑 But WAF is in the way... 😓 What if you could just bypass this WAF and get your payload through? 🤠 In our latest article, we documented several ways to identify the origin IP of your target behind popular CDNs and firewalls! 🔗 www.intigriti.com/researchers/...

Latest Bug Bytes is live! 🚀 This month's issue is as usual packed with bug bounty tips: ✅ Exploiting Log4Shell (Log4J) in 2025 ✅ Indispensable GH recon tool (not the one you have in mind) ✅ Advanced WAF evasion techniques ✅ One of the most comprehensive guides on finding exposed S3 buckets

Most bug bounty hunters overlook GitHub... It's the place where developers accidentally commit API keys, database credentials, and internal URLs (almost every single day) 🤠 In our most recent article, we documented how you can use GitHub dorking to find more vulnerabilities! Read the article now👇

For some bug bounty hunters, the Log4Shell hunt never truly ended... 😈 While most moved on, some researchers know this vulnerability is still present today 👀 We just published a comprehensive guide showing exactly how to uncover Log4Shell vulnerabilities! 👇 www.intigriti.com/researchers/...

It's time for the monthly code challenge! Junior dev just finished with a new sandbox security policy to verify that only safe templates are rendered on his Twig 2.0 playground! 🤠 Can you craft a working proof of concept that executes the 'whoami' command? 😎

Template injections (SSTIs) are still common and can often be escalated to RCE! 🤑 But only if you know where to look for them! 🧐 In our latest article, we've outlined several SSTI exploitation techniques, including limited cases where sandboxes prevent functions! 😎 intigriti.com/researchers/...

Hidden parameters can lead to all sorts of vulnerabilities, from XSS to SQLi and potentially even command injections! 🤑 But they are also hard to find... 😓 In our latest article, we documented 5 methods to find hidden input parameters in API endpoints & app routes! 😎 intigriti.com/researchers/...

It's time for the monthly code challenge! New support employee blindly clicks on any links you send in the chat! 🤠 Can you spot the CORS issue and craft a working proof of concept that fetches the contents of the internal-only host intranet\.example\.com? 😎

CORS misconfigurations are one of the most underestimated vulnerability types!👀 If you're neglecting them...you're potentially missing out on high severity bugs! In our latest article, we've outlined 8+ CORS exploitation scenarios—including some advanced cases! 🔗 www.intigriti.com/researchers/...

Developers just finished migrating to a NoSQL database but something looks off...🧐 Can you manage to exploit this NoSQLi vulnerability and gain access to the administrator account? 😎 Reply with a working proof of concept before May 6th (12 PM UTC) and get a chance to win exclusive Intigriti swag!

Video for the HackDonalds Challenge by @intigriti.com 💜 youtu.be/KwD_TKZr0YY

The hunt for subdomain takeover vulnerabilities is always on! 🔥 Yet most hunters miss out on these issues… 👀 In our latest article, we documented how you can as well identify and exploit subdomain takeover vulnerabilities into higher severity issues! Read the article on our blog 👇 buff.ly/dluVPzD

Who wants a bonus @intigriti.com challenge? Easier than usual 👀 First blood + best writeup win a €50 swag voucher 😎 Find the flag before 15/04/25 👇 hackdonalds.intigriti.io

Due to popular demand, we've extended the challenge by 48 hours! You now have until Wednesday to find the flag! 🚩

Check out the walkthrough for the fourth (and currently final) @portswigger.net lab on NoSQL injection by @cryptocat.me 😼 youtu.be/aSXlmJ3lN4o

⏰ It's CHALLENGE O'CLOCK! 👉 Find the FLAG before Monday the 30th March 👉 Win €400 in SWAG prizes 👉 We'll release a tip for every 50 likes on this tweet Thanks @0x999.net for the challenge 👇 challenge-0325.intigriti.io

This developer just fixed an XXE injection vulnerability by blocking unsafe keywords! 🤠 Can you still manage to exploit this XXE vulnerability? 😎 Reply with a working proof of concept before March 23rd (12 PM UTC) and make chance to win exclusive Intigriti swag! 😎

🌍 Switzerland, we’re coming for you! 🔥 #Intigriti is heading to Insomni’Hack 2025, and we can’t wait to connect with the amazing local #hacking community! 🏴‍☠️💻 Let’s share insights, stories, and maybe even a few hacking secrets! 🤫🔍 📅 When? 13 - 14 March See you there! 💙 #HackWithIntigriti

New @portswigger.net video released over on the @intigriti.com channel! 💜 youtu.be/mVYu_3b_dOE

Met one of my favourite @intigriti.com hackers today! ngyostuan 💜

WordPress sites aren’t always as secure as you might think. 🔓 Learn how to find vulnerabilities and how to protect them! 🚀 Head to the blog below to read more 👇 www.intigriti.com/researchers/... #HackWithIntigriti #Cybersecurity #ethicalhacking #BugBounty

🔔 Intigriti is in San Francisco! 🔔 Any hackers in San Francisco —want to meet up? 😎 Stijn and @ctglenn4.bsky.social are ready to connect. Drop Colin a message for the location 📩 Let’s make it happen! 🚀 #HackWithIntigriti #Cybersecurity #ethicalhacking #BugBounty

#intigriti #treasurehunt 2. Same rules - find them and send us a selfie with them and I’ll send you a swag store vouchers too

#intigriti #treasurehunt - and it has to start with a certain address …… If you get them AND also send us a selfie with them - I have swag store vouchers for you too!! Happy hunting

Here's the second @portswigger.net lab on NoSQL Injection by @intigriti.com 💜 It covers NoSQL injection using MongoDB operators, leading to an authentication bypass 😎 youtu.be/DBNmAJaWcGk

Beautiful morning for a walk and to leave the treasure hunt - if anyone gets them, posts a selfie with them- I’ll also send you a voucher for our swag store…onto the next city and more great people to meet. #intigriti #bugbounty #hackers

We're attending BSides Galway! Swing by our booth, meet the team and grab some swag 😎 👉 Access passes: bsidesgalway.com 🗓 Saturday 22nd Feb, 09:00 - 17:00 📍 University of Galway, Ireland #HackWithIntigriti #Cybersecurity #ethicalhacking #BugBounty

This is a new implementation of magic links for a SaaS company. 🤠 But... how many issues can you spot? 🧐 Let us know in the comments section 👇 #HackWithIntigriti #Cybersecurity #ethicalhacking #BugBounty

February's Bug Bytes is live 🚀 This issue includes: ✅A challenge to win an #Intigriti hoodie ✅ Articles to advance your exploit tactics ✅ Top tools to use at your next #bugbounty target ✅ Upcoming #cybersecurity events to meet us in person Read the latest issue👇 intigriti.com/researchers/...