VC0D3R @VC0D3R

Full Stack Web Developer & Bug Hunter blog.vc0d3r.com root Joined December 2020

Tweets

2K
Followers

1K
Following

2K
Likes

12K

Omid Rezaei @omidxrz

2 weeks ago

after a long time, I decided to write a blog post about one of the old bugs I found in an Android app, which finally led me to achieve 0-Click Mass Account TakeOver it's now published, you can read it here : blog.voorivex.team/0-click-mass-a…

23 51 330 13K 157

Tur.js @Tur24Tur

3 weeks ago

Finally, with @hw16, we managed to bypass the @Cloudflare mTLS protection after around 5 days of work. I'd like to share a few golden tips for bug bounty hunters who might face something similar in the future. But first, here's a quick summary: The target was a banking app with…

Tur.js @Tur24Tur

3 weeks ago

14 18 233 90K 178

Download Image

23 110 625 60K 538

Download Image

James Kettle @albinowax

a month ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 250 747 75K 334

pdnuclei-bot @pdnuclei_bot

2 months ago

🚨 CVE-2025-53770 - critical 🚨 Microsoft SharePoint Server - Remote Code Execution (ToolShell) > Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows a... 👾 cloud.projectdiscovery.io/library/CVE-20… @pdnuclei #NucleiTemplates #cve

0 5 40 3K 18

VC0D3R @VC0D3R

2 months ago

Please don't report open redirects if you can't increase impact ! , I just found a xss to account take over, and it was a duplicate of p4 open redirect 😑😑 wtfff #bugbounty #bugbountytip

10 0 46 3K 5

Masato Kinugawa @kinugawamasato

2 months ago

3 39 237 13K 110

PentesterLand @PentesterLandEn

2 months ago

Bugcrowd sent me another threatening message, accusing me of “disclosure” with zero evidence, just vague references to my educational posts. I redact everything. no program, no PoC, just ethical content. Stop punishing researchers . @Bugcrowd @BugcrowdSupport @Bcdisclosed

5 6 103 6K 11

PentesterLand @PentesterLandEn

2 months ago

I hope to enjoy my senario: t.me/pentesterlande… I recorded video message, about how can i chained some boring vulnerabilities and made P1 report #BugBountytips #BugBounty #redteam #mindset #BugBountytip #xss #broken_access_control #writeup

PentesterLand @PentesterLandEn

2 months ago

16 18 287 32K 53

Download Image

7 10 108 13K 31

zhero; @zhero___

2 months ago

new discovery: cache poisoning on next.js - CVE-2025-49826 indefinite caching of a 204 response, rendering the affected pages inaccessible affected versions: >15.0.4 and <15.2.0 there will be no research paper for this one

inzo @inzo____

2 months ago

3 21 222 49K 74

Download Image

14 86 484 36K 229

Download Video

shubs @infosec_au

3 months ago

IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: github.com/assetnote/newt…

14 239 879 45K 630

VC0D3R @VC0D3R

4 months ago

Nice Challenge! :] (learned something new 🫡) x.com/omidxrz/status…

Omid Rezaei @omidxrz

4 months ago

Nice Challenge! :] (learned something new 🫡) x.com/omidxrz/status… https://t.co/pJ992KLr9k

5 7 96 13K 54

Download Image

4 1 52 5K 25

Download Image

Meydi @mehdiparandin

4 months ago

Just found an interesting behavior in Firefox that can be used for XSS: If a response lacks the Content-Type header, Firefox renders it as text/plain. But if the URL ends with an extension like .html, Firefox treats it as that. #bugbounty #bugbountytips

21 56 540 34K 359

Download Image

YS @YShahinzadeh

4 months ago

just wrote a blog post based on this technique and described the methodology to take advantage of it, the post also includes an easy-to-set-up testbed to practice with, hope you find it useful blog.voorivex.team/leaking-oauth-…

slonser @slonser_

4 months ago

22 182 1K 260K 856

Download Image

12 59 311 46K 197

Download Image

slonser @slonser_

4 months ago

Today I used a technique that’s probably not widely known in the community. In what cases could code like this lead to a vulnerability? ->

22 182 1K 260K 856

Download Image

James Kettle @albinowax

5 months ago

I just built a custom action to let you test for race conditions with a single click! No tab groups required, and it uses the cutting edge single-packet attack under the hood.

10 63 357 24K 178

Download Image

Andrea Palazzo @cogitoergor00t

5 months ago

Remember this ̶g̶u̶y̶ bug? This is him today. Feel old yet?

SSD Secure Disclosure @SecuriTeam_SSD

5 months ago

Remember this ̶g̶u̶y̶ bug? This is him today. Feel old yet? https://t.co/c4gEDPPub5

1 34 261 322K 122

3 9 35 6K 8

Download Image

Milad Safdari (Ξulex) @eulex0x

5 months ago

Write-Up is released :) medium.com/@eulex/how-i-m… x.com/eulex0x/status… #togatherwehitharder #BugBounty #CyberSecurity #EthicalHacking #PaymentsSecurity #HackerMindset #BugBountytips #BugBountytip

Milad Safdari (Ξulex) @eulex0x

5 months ago

27 41 503 60K 164

Download Image

13 31 202 11K 103

shubs @infosec_au

6 months ago

We recently looked deeper at the authentication bypass vulnerability in Next.js (CVE-2025-29927) and discovered some intelligent and comprehensive ways to check for the vulnerability. Read more in our blog post: slcyber.io/assetnote-secu…

8 122 412 38K 200

Download Image

zhero; @zhero___

6 months ago

the research paper is out: Next.js and the corrupt middleware: the authorizing artifact result of a collaboration with @inzo____ that led to CVE-2025-29927 (9.1-critical) zhero-web-sec.github.io/research-and-t… enjoy the read!

74 449 2K 167K 705

Download Image

Sergey Bobrov @Black2Fan

6 months ago

I have published a tool based on jadx that helps analyze Java applications. github.com/BlackFan/BFScan BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations. It also searches strings that look like URIs, paths, or secrets.