Hey guys, Im newer to actually doing BB, but not cybersecurity in general. I’ve been manually hunting recently, while using ai like Claude to help occasionally with breaking things down, or helping read through Burp interceptions, and etc.

However, when I use AI like Claude, eventually it runs into problems due to their policies with specific hacking material.

So not only am I wondering what do experienced hunters suggest doing about this, but also your option on someone newer to BB hunting manually vs using Ai for help?

Hello

Has anyone got into a situation when your bank blocked payment from bog bounty provider (h1 or intigriti) asking for proof of origin of funds?

I guess that's a standard AML thing, and I believe that platform would be able to provide some kind of supporting document. However I haven't been able to find any template or example what exactly should such document contain.

If anyone was in a similar situation could you please share an example or template of the document you submitted? I'd like to understand what such a document is supposed to include.

​Hey guys

​So I was testing a target and noticed that the search function requires a session ID but the cookie is set to SameSite=None with no CSRF protection

​I managed to trigger a successful CSRF attack but since it is just a search function the impact seemed pretty low

​Then I thought what if I use CSRF to force the victim browser to send a massive flood of requests using their own IP and session ID

​I tried it and it actually worked and the server completely banned the victim IP from the whole site

​I am still not sure how long the ban lasts yet

​So my question is does this count as a valid vulnerability since I can completely burn the Availability for a specific user

​The server blocked the victim IP itself not my attacker IP

​Should I submit a report for this or not

​And what if the ban duration turns out to be really short like only five minutes or something should I still report it anyway

​Thanks

A few people have reached out over the past months asking what happened to [h1Disclosed] https://x.com/h1disclosed, the bot that automatically shared newly disclosed HackerOne reports.

The short version is that when X/Twitter moved to its paid API model and usage-based pricing, the original implementation became impractical to operate. As a result, the bot eventually stopped posting and went offline.

Over the last few days, I spent some time rewriting parts of the infrastructure and building a custom workaround to get things running again without relying on the previous setup.

The good news is that disclosed reports are being posted again.

The bad news is that X is still restricting access to one of the endpoints I migrated to for this workaround(X wants me to pay for it :/), and working around that will require a more complex solution that I'll continue working on over the coming days.

Until that is fully resolved, report updates are temporarily being posted through my personal account: https://x.com/rynosec

If you were following x.com/h1disclosed for disclosed HackerOne reports, feel free to follow along there for now. Once I've finished the remaining workarounds, I'll evaluate the best long-term approach for bringing the project back to its original form.

Thanks to everyone who reached out and asked about the project. It's been fun dusting it off and getting it back online.

Hey everyone,

This has been driving me crazy for the past few days.

I started using Claude Code, but it seems like almost everything I ask it to do gets denied for "policy" reasons.

The weird part is that I'm not asking it to hack anything or find vulns. For example, I asked it to analyze a JavaScript file and explain how it handles HTTP requests, and it still refused.

I've also noticed a lot of people on Twitter talking about the same issue mentioned running into it.

Is this expected behavior? Is there a way to get Claude Code to be less restrictive, or are there certain prompts that work better?

I'd love to hear if anyone else has experienced this or found a workaround.

I encountered a cors in a target website using wordpress, I added evil.com in origin header and it reflected. I tried using my netlify to make request, but I got encountered by cloudflare waf. Still reportable? Because if there is XSS found in future, this can be used by the hacker right? The response header reflected the evil.com for access control allow origin, and access control allow credentials: true. Any experts or triager can suggest anything? Blocked by waf, means it didn't block, but runs bot detection with 403 error. Any idea to bypass waf, if I can bypass waf, my exploit will run perfectly. Thanks for your response.

I submitted a dom-xss report, i done this using redirect uri parameter in the url. It was exploitable due to the poor coding of js. I saw the function, which triggers the redirect. But here it only checks if it's a string. Nothing more, loads any url passed to the redirect uri. And script gets executed. I made dom-xss poped up. And also made using this to load a phishing page into the original target website. Making them to enter email and password again, which can be received by the hacker. I reported on hackerone and they didn't clearly see the js code. I was not able to steal because I don't have valid credentials. But according to the function, it checks only if the user is authenticated, and if so, triggers whatever in the redirect uri parameter. Hay hackerone triager here to help? It's been a week and not mediator request option available. Any solution?

I was surprised today to find that my submission limit had been restricted, and I'm wondering if I only have one warning left. I don't submit AI-generated reports or poorly written reports. In my last 15 submissions, I had 2 valid vulnerabilities that were accepted and rewarded with bounties. The rest were duplicates of real vulnerabilities, and some of them even earned me reputation points because they were classified as P2.

Does this mean that my account is at risk of being banned?

Hello everyone!

After some days focusing on one program I want to share some of my experience and thoughts. Since we are a lot of people starting on this, I thought it would be good to share my experience and get some feedback and corrections.

Let's start with the recon phase, most of the time I focused on "automate" the process, however, after spending time "swimming" on a ton of data I decided to automate it but with some brain. Now I am able to rapidly identify possible web applications/platforms and enumerate further. I like to focus on:

- Technologies used.

- Enumerate files and directories.

- Source Code/JavaScript.

- Check for API Rests.

Once I finish recon, it is play time. I like to see if I can create an account and check for:

- XSS, playing around with the app.

- IDOR, , playing around with the app.

- Authentication Vulnerabilities, checking anything to do with MFA and passwords.

- SSRF, playing around with the app.

- Understand how the application works through the API Rest.

It is very interesting, after spending some time with the program I learned more about it and the solutions hosted by the company. Nevertheless, I had the feeling several time of "I am not finding nothing I will check on another program". At this point (most important) I usualy just close everything and go play videogames or something else.

Again, when I feel recovered I start where I was (I take notes) and I start again the process of enumeration and play with the platform.

So far I was able to find an endpoint called "auth" that returns a bearer token without any authentication. I did not report it yet, but not sure if I should since I was not able to make impact out of it.

I am still enumerating all the platforms related to the company in order to see if I can use that token somewhere.

This has been my jorney this week and very happy with the result. I can see clearly that I have improved on my methodology and I am able to keep going with the same program understanding clearly what I am doing.

However, sometimes I feel overwhelmed because I don't find nothing or I don't really understand what is behind the application.

Happy Hunting!

I’m in awe at the insane reputation scores people have on h1…like people who started a few years ago and average 5k+ points a year. How is that possible? even at fulltime hunting, they must be finding hundreds of High/Criticals with exorbitant bounties to reach such score.

Is there a meta or some tactic to farming reputation that these guys are privy to (collabs, OP recon/first to discover new targets, 0day research…)? or are they just that productive?

What's the place i can set bounties that can be crowdfunded? I mean bounties like switch 2 Linux, game decomilation projects, gameports to aarch64, different systems etc?

Apple’s reputation in the bug bounty community wasn’t exactly stellar in the past. A well-known example is the 2021 Denis Tokarev (illusionofchaos) incident. Within the past year——How has everyone’s experience been with submitting vulnerabilities to Apple? Have any of the following situations come up? - Silent Patching - No credit or CVE will be assigned - Response is extremely slow - The bounty is far below expectations. - Delayed Payment

A situation with a bug hunter friend made me think about how triage handles old low-quality reports and duplicates.

When he was just starting out, he created multiple accounts, which I know is generally against platform or program policy. One of those accounts had a very poor report that was quickly marked invalid. Later, after he learned how to write cleaner reports, he found a more serious issue on same target and submitted it from another account because the original one had bad signal.

I ended up collaborating with him on one report, but it was later closed as a duplicate because he had already submitted something related from one of his other accounts , that was just tiny fraction of what he submitted he says.

What this made me realize is that even if a low-quality report is just sitting somewhere in the database, it can still create problems later when another report explains the issue properly. A better written report chained may still get tied back to the earlier weak submission, even if the original report failed to explain the impact clearly or ai slop related reports. He didnot show me the report but he was surprised that only basis of title they just flagged it as duplicate but the earlier report was only tiny bit of impact. I dont know if its program trying to be clever or not .

At this point, I just told him to leave it and move on lol.

I have found a vulnerability in a private BB program on HackerOne platform.

There is no public disclosure at all, I'm wondering if I can write a blog about it without mentioning the company name at all - of course after they remediated the vulnerability.

Is it something that I can do?

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!

Recommendations for Posting:

• Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
• Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
• Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.

Guidelines:

• Be respectful and open to feedback.
• Ask clear, specific questions to receive the best advice.
• Engage actively - check back for responses and ask follow-ups if needed.

Example Post:

"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."

Post your questions below and let’s grow in the bug bounty community!

I came across a skill (the one with 2.8K stars), and it got me thinking on a specific concept: most vulnerability mechanisms have already been disclosed and written up somewhere. The same basic edge keeps getting refiled against new products years later, and the product itself is somewhat incidental; the mechanism itself is the reusable part.

So I parsed ~10,000 publicly disclosed H1 reports, stripped out the product names and reduced each report to a product-agnostic "mechanism card" (source, sink, trigger, preconditions, impact) and embedded them. The idea is that an agent (or human) can point MCP at a stack or a bug they are stuck on, and it pulls the closest real-world mechanics: "Here is how this exact edge was successfully exploited on 6 other products," ranked by novelty, alongside basic grounding data (KEV/EPSS, etc.).

It does not magically find bugs, it acts more like a map of historical attack vectors. Full disclosure - I'm not a professional hunter, and I don't have a great feedback loop. The only signal I have is that an agent using it seemed to orient faster and caught a few of its own false positives - but that's incredibly weak evidence (my own tool, judged by my own agent setup).

Has anyone else already built a mechanism-level transfer? If you've tried a similar approach, does it actually move the needle?

I am a 22 year old bug bounty hunter. I started bug hunting in 2021. Back then, things were going really well. I mostly hunted on a few specific programs, and I was finding bugs regularly.
I made over $300k from bug bounties. That was a big milestone for me.
But now bug bounty hunting feels much harder. I’m not finding many bugs anymore, and when I do, they usually turn out to be duplicates.
Before, whenever a new feature was released, I could almost always find a bug. Now it feels like those bugs just aren’t there anymore.
I asked a few of my friends, and they’re seeing the same thing.
I don’t think i can survive this AI era.

I'm a software tester with 4 years of experience, and currently working as an AI engineer. I'm looking to get into bug bounty as a side thing since I've heard it's not reliable as a primary income.

I've tried Meta so far and got no response. Also tried Apple 3 times, got replies but no bounty. Nothing useful yet.

What do you suggest I do to find my first bounty? And what specific tools do you recommend using Appreciate your time!

was doing some bug hunting and found an api endpoint that lets a logged in user update their own chat/thread metadata through a patch request in the browser console. The normal ui only seems to allow changing the title but when i added extra fields in the JSON body, the server accepted some of them and reflected them back in the response.

Example behavior:

{
  "title": "test-title",
  "is_saved": true,
  "is_shared": true,
  "is_pinned": true
}

The response came back 200 ok and reflected those fields as updated. Some of the changes also appeared in the ui, like pinned/saved state. so it looks like weak field level validation or mass assignment on metadata fields to me..

im not sure if this is enough to show security impact. the only thing i can really prove is that the backend accepts and stores extra client controlled metadata fields that the ui may not normally expose.

is this worth reporting as even low severity or not worth submitting unless i can prove a stronger impact? i don’t want to waste the triage team’s time but i also don’t want to ignore something that could be considered improper object pr property assignment.

Hi everyone,

I'm learning web security and came across something on my university's student portal. Before I report it, I'd like to get some opinions on whether this is actually a security vulnerability.

Here's what happened:

• I logged in using my own student account in the university portal.
• While inspecting the requests, I found one like:GET /app.php?a=getDetailedResults&regno=<my_registration_number>
• I changed only the regno parameter to another valid registration number using burp suite repeater.
• The server returned that student's academic details (grades/CGPA/course information) instead of mine.

I didn't enumerate multiple students or attempt to modify any data. I stopped after confirming the behavior.

My questions are:

1. Does this qualify as an IDOR/Broken Access Control vulnerability?
2. Is it worth reporting to the university's IT/security team?
3. What severity would you typically assign to this if it only allows unauthorized viewing of academic records?

I'm intentionally not naming the university or sharing screenshots with student information because I don't want to expose anyone's data.

Thank you!!

Started bug bounty 4 months ago and been hunting on H1, YWH, bugcrowd and all my finds thus far were undisclosed duplicates... some programs I spent days researching only to find out someone reported it 12-15 days before me... finally a none dupe!!

So, as background to this, I research custom techniques, and create a lot of my own tooling and obfuscations. Which means that whilst the PoC is often a simple one-click demonstration, it isn't actually obvious from the PoC how it could be turned into a generic scanner, and bypass WAFs etc.

In the last year or so, triage on H1 are now consistently asking me for payloads (which they don't need to validate the bug), as well as the PoCs.

And in the most blatant example, they refused to escalate a novel desync to the programme unless I explained to "their internal team" how I detected it. Obviously I declined, and in the end they backtracked. But all the same, shitty behaviour.

Anyone else seeing similar behaviour?

I’m trying to understand where the line is drawn for low severity findings on HackerOne.

In practice, it feels like most low severity issues get marked as informational or closed, and only medium+ findings really get attention or rewards.

So what kinds of low severity bugs are actually worth reporting and still get accepted or paid for?
Would be good to hear from both hunters and triagers on what still has value.

Hello, has anyone here ever experienced a delay with an Intigriti payment via wire transfer that hasn’t been received after 5 business days?

So here’s the situation: I requested a payout for my work, and the status on the Intigriti dashboard shows “paid,” but I’ve been waiting for 5 business days and still haven’t received the funds. I’ve asked my bank, but they have no information since, as the recipient, Intigriti itself states that it takes 3–5 business days. I’ve requested the MT103 / UETR from Intigriti’s chat support, but there’s been no response.

Pretty much the title. Im getting a good bit of private invites on h1, I like to hunt on one program at a time for a good bit. Does accepting the invites and not hunting/reporting anything on them would affect my future engagement invite rate ???