AI Just Made Bug Bounty Way Easier
Feeding an open-source target's own source code to an AI assistant, with a local and VPS setup, so you stop guessing how your input is handled.
Blog
Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.
Client Side 01: postMessage Bugs
postMessage bugs sit unnoticed in checkout pages, auth flows and chat widgets. Origins, senders, receivers, sinks, and the mistakes that expose them.
SSTI From Input To RCE
Server-side template injection from first principles: how template engines work, where they break, and Jinja2 exploitation from input to RCE.
The Bug Bounty Report Blueprint Triagers Don’t Ignore
A real vulnerability still gets rejected if the report fails to tell the story. The anatomy of a report triagers act on, section by section.
GraphQL for Bug Bounty Hunters
How GraphQL really works and why its flexibility is a goldmine: schemas, queries, mutations, fragments, and testing an endpoint like an attacker.
Deploy Your Next Hacking Lab in 30 Seconds
Three ways to deploy a vulnerable web app lab: manual Docker commands, Docker Compose, and a visual Compose manager that removes the command line entirely.
3 Tricks to Hunt Faster in Bug Bounty
Three small workflow changes that remove friction from a hunt: proxy match-and-replace rules, repeatable workflows, and a fast note-taking system.
The TrashCash | Turning Deleted Files Into Bounties
TrashCash: restoring deleted files from Git history to recover the secrets developers thought they wiped. The biggest payouts aren't always payloads.
How I Found IDORs That Shouldn’t Exist
IDORs that survive modern access control: trailing slashes, path normalisation, double slashes and obfuscated paths, with testable examples.