Take these tips and go catch your first bug: 👇

Stop the robot apocalypse. 🤖 Learn to hack AI apps and agents to make sure they’re safe and secure. Take our course and develop your AI hacking skills:

Have these 3 types of mentors (or companions) to skyrocket your bug bounty growth. 🚀 This advice also applies to other fields of interest:

LOOK: the actual bug bounty numbers from @NahamSec’s 12-year career. 👀 And the truth behind it, is the reality that every beginner should be prepared to face: 👇

🚨 RCE on WordPress Core: CVE-2026-87902 Here’s an overview of this critical bug:

Ever tried cracking a cipher? 🤓 Here's a quick decoding trick:

This is how you hack an AI chatbot for $100k 🤓 It’s not how you think it looks:

One of the keys to hacking AI chatbots: make your attack prompts subtle enough to slip past the guardrails. 🤓 Here's how attackers disguise intent inside a prompt:

Can feel it through the chest when the IDOR finally returns someone else's data 🥸

LET ME BYPASS!!

What are the odds of finding a dupe......

A few years back, pulling a specific bug bounty dataset meant writing your own scraper or API calls. Today you can grab it with zero code, here's how: 👇

Mass hunting of secrets has never been this easy. 🤓 Here’s the overview of the entire pipeline:

You’ve tried every bypass trick, but nothing worked. What if it’s a Windows server? 🪟 Here’s what you can try:

🚀 LAUNCHING: 40% off our new course! Hacking AI Apps & Agents By Johann Rehberger (@wunderwuzzi23)  Yes, the guy behind some of the wildest prompt injection research out there. 🤓

Aside from encoding tricks, here’s another technique that can also bypass a 403: 💰

How to BYPASS protections and access hidden endpoints? Here’s @NahamSec with his favorite trick: 👇

Have you tried hacking an AI assistant? 🤖 Here’s @rez0__ dropping gold nuggets on how to approach it: 👇

Intercepting the HTTP request your browser sends when you chat with an AI assistant. Turns out there's actually a lot you can tamper with. 🤓

These are the actual prompts you can send when hacking an AI Assistant: 👇

Having a hard time catching SSRF? Maybe you’re hunting in the wrong places. 🤔 Here's where you should look: 👀

This is the first and most important thing you should look at when you’re hunting SSRF: 👀

Stop misidentifying SSRF. Let’s clear things up: 🤓

Web cache deception tricks 🪄 GET /api/me → returns PII Run these to trick the CDN into caching a sensitive endpoint: 🟥 GET /api/me;.css 🟥 GET /api/me/foo.css 🟥 GET /static/..%2fapi/me 🟥 GET /api/me%00.css 🟥 GET /profile%2f%2e%2e%2fstatic

Want to access the /admin panel? Try these variants: 🟥 //admin 🟥 /./admin 🟥 /%2f/admin Didn't work? Add these headers: GET / HTTP/1.1 X-Original-URL: /admin/panel X-Rewrite-URL: /admin

You can still find success in hunting for stored/blind XSS today. 🥸 Here’s why: 👇

These 3 bug classes became harder to find. If you’re starting bug bounty today, here’s why you might want to skip learning them and focus on other bug classes instead: 👇

3 tips to get to a 75% bug bounty report hit rate: 👇

Analyze JS files with a Caido plugin. 🤓 Here’s a quick demo: 👇

Want to hunt WebSockets vulns? Here’s how to do it using Caido: 👇