VC0D3R @VC0D3R

Full Stack Web Developer & Bug Hunter blog.vc0d3r.com root Joined December 2020

Tweets

2K
Followers

1K
Following

2K
Likes

12K

Ben Sadeghipour @NahamSec

22 hours ago

Really disappointed to see @Hacker0x01 do this. I also had a similar interaction with h1 about a month ago where they questioned my nationality and place of residence after 10+ on the platform.

YS @YShahinzadeh

2 days ago

Really disappointed to see @Hacker0x01 do this. I also had a similar interaction with h1 about a month ago where they questioned my nationality and place of residence after 10+ on the platform.

35 127 627 105K 83

Download Image

15 53 488 43K 58

I’ve been hunting on H1 for almost 3 years, ranked #18 in 2025, have always tried to contribute positively to the hacker community. I’ve earned around $500k in bounties and was on the road to $1M. Yet I don’t even have HSM, and I feel I haven’t been recognized as I should 1/4

Youssef Sammouda (sam0) @samm0uda

3 days ago

13 82 462 81K 48

35 127 627 105K 83

Download Image

H4x0r.DZ 🇰🇵 @h4x0r_dz

3 days ago

Yesterday it was me and @GodfatherOrwa. Today, HackerOne banned @YShahinzadeh — one of the most talented hackers on the platform. Tomorrow it could be any of us… unless you’re a big content creator with a huge following. HackerOne grew because of hackers. We deserve to be…

11 17 273 27K 42

AmirMohammad Safari @AmirMSafari

2 days ago

I respect that HackerOne has rules, and we all try to follow them. But banning someone without explanation or a chance to clarify feels unfair. At the very least, there should be a warning or an open line for communication. My hope is that HackerOne rethinks these policies

Youssef Sammouda (sam0) @samm0uda

3 days ago

13 82 462 81K 48

0 5 100 6K 3

RootSys @RootSysAt

a week ago

🚨 Next.js and the Mutated Middleware [CVE-2025-57822] - a powerful SSRF primitive enabling full control over HTTP methods, headers & URLs. See how a subtle middleware bug can result in a high-impact vulnerability: 🔗 blog.rootsys.at/posts/nextjs-a… #AppSec #Nextjs #SSRF

1 45 157 22K 103

Youssef Sammouda (sam0) @samm0uda

3 days ago

After that, it’s up to you. PS: Don’t fool yourself, you're just the middleman in this game. You're not doing anything special. Without the honest, talented hackers that companies came looking for, you'd be nothing but a spam folder clogged up by bunch of AIs and script kiddies.

0 4 186 7K 2

Youssef Sammouda (sam0) @samm0uda

3 days ago

@Hacker0x01 is now banning people without explanation or providing how the terms and conditions were violated. While other platforms are advancing, H1 revolutionary new vision is to track hackers on social media, make assumptions and ban them without a real proof.

13 82 462 81K 48

Muntrive @Muntrive

7 days ago

I’m a junior bug bounty hunter. I submitted a bug and got NA. The bug was a 1-click ATO: send a link, the victim clicks, and the ATO is guaranteed. The triage team considered it social engineering and replied (image). 1/2 @Hacker0x01 #bugbounty

45 16 313 27K 47

Download Image

Critical Thinking - Bug Bounty Podcast @ctbbpodcast

a week ago

We announced the Critical Research Lab this week. And for our FIRST post, we got @J0R1AN's: - Exploiting Web Worker XSS with Blobs Go check it out! lab.ctbb.show/research/Explo…

2 49 216 16K 137

terjanq @terjanq

2 weeks ago

We published a blogpost about SafeContentFrame - a library for rendering untrusted content inside an iframe. The library is a big party of what I've been up to in the few last years! Check out the blog and take a slice of my birthday cake 🎂! bughunters.google.com/blog/671552987…

3 52 189 13K 95

Download Image

SinSinology @SinSinology

2 weeks ago

NEED YOUR HELP! My Friend/Teacher Soroush (@irsdl) Is looking for a new company to join, you know him as the .NET-God, the guy who has popped exchange, sharepoint, has maintained ysoserial_.net for years, contributed to the exploitation scene numerous times, taught all of you…

15 126 238 68K 36

Dirk-jan @_dirkjan

2 weeks ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

145 897 3K 435K 1K

Alvaro Balada @nightbloodz_

3 weeks ago

I published a video explaining my CVE-2025-4123 in Grafana. It’s a complex open redirect that I chained with multiple other issues to achieve full read SSRF and account takeover. I break down the entire exploitation chain. youtu.be/HsLco4xzJr0 #Cybersecurity #BugBounty

3 37 197 16K 131

omid @omidxrz

a month ago

after a long time, I decided to write a blog post about one of the old bugs I found in an Android app, which finally led me to achieve 0-Click Mass Account TakeOver it's now published, you can read it here : blog.voorivex.team/0-click-mass-a…

23 51 335 16K 159

Tur.js @Tur24Tur

a month ago

Finally, with @hw16, we managed to bypass the @Cloudflare mTLS protection after around 5 days of work. I'd like to share a few golden tips for bug bounty hunters who might face something similar in the future. But first, here's a quick summary: The target was a banking app with…

Tur.js @Tur24Tur

2 months ago

14 18 232 93K 178

Download Image

23 111 635 64K 547

Download Image

James Kettle @albinowax

2 months ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 247 749 78K 337

pdnuclei-bot @pdnuclei_bot

2 months ago

🚨 CVE-2025-53770 - critical 🚨 Microsoft SharePoint Server - Remote Code Execution (ToolShell) > Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows a... 👾 cloud.projectdiscovery.io/library/CVE-20… @pdnuclei #NucleiTemplates #cve

0 5 40 3K 18

VC0D3R @VC0D3R

2 months ago

Please don't report open redirects if you can't increase impact ! , I just found a xss to account take over, and it was a duplicate of p4 open redirect 😑😑 wtfff #bugbounty #bugbountytip

10 0 47 3K 5

Masato Kinugawa @kinugawamasato

2 months ago

3 38 237 14K 110

PentesterLand @PentesterLandEn

3 months ago

Bugcrowd sent me another threatening message, accusing me of “disclosure” with zero evidence, just vague references to my educational posts. I redact everything. no program, no PoC, just ethical content. Stop punishing researchers . @Bugcrowd @BugcrowdSupport @Bcdisclosed