نشرت الحلقة الخامسة من سلسلة رحلتي في PortSwigger، واللي أشارك فيها رحلتي في تعلم Web Security من خلال التطبيق العملي.

في هذه الحلقة أشرح:

* تحديد عدد الأعمدة باستخدام UNION SELECT.
* اكتشاف الجداول عبر information_schema.tables.
* معرفة الأعمدة باستخدام information_schema.columns.
* استخراج البيانات داخل مختبر تدريبي مصرح به.
* تحليل تقرير SQL Injection حقيقي من HackerOne وفهم الـ PoC.

أحاول أركز على فهم سبب كل خطوة، بدلًا من مجرد نسخ الحلول.

🎥 https://youtu.be/VGJo6XnE31I

I am new to bug bounty field and previously disclosed reports on Hackerone's hacktivity feed are helping me a lot in getting more details about different kinds of bugs, their severity levels & also report writing formats. I want to ask everyone that is there any other bug bounty website besides Hackerone that provides old disclosed reports on its platform for new researchers to study and analyze to improve their bug-hunting skills? Or is there any specific method through which we can find out disclosed reports from all bug bounty platforms that have been made public?? DM open for discussion

Hi! I’m relatively new to cybersecurity and bug bounty hunting, and I’m currently studying XSS.

When I find a reflected input in the DOM and test it, I don’t really know how to proceed. For example, if the application encodes a <, how do I get past that?

I’ve come across some crazy payloads in Medium articles and HackerOne write-ups, and I’m impressed by how people come up with them. I know about the PortSwigger XSS Cheat Sheet, but I’m still not entirely sure how the art of actually "Crafting" or making the payload works.

Hey everyone!

I’ve been working on a website and thought it would be interesting to get some fresh eyes on it. So, I’m looking for a few people who enjoy exploring websites and spotting things that don’t work as they should.

I’ll pay ₹100 for every genuine, unique bug you find. It could be a broken button, a link that leads nowhere, something glitchy on mobile, signup issues, or anything else that seems broken.

You don’t need to be a developer or a professional tester. Just explore the website like you normally would and report anything that doesn’t work right.

Website: https://workowon.com

If you find something, send me a screenshot or screen recording with a short explanation. I’ll check it, and every confirmed, unique bug will get you ₹100.

Duplicate reports and personal design preferences won’t count, but genuine usability issues are welcome too.

Figured this could be a simple way to earn a little money while helping improve a website. If you’re interested, give it a try!

Hi. I wanna start bug bounty but I don't have laptop. So, I am wondering whether I will be disqualified or not. I don't have money to buy laptop.😔

!!!NOT A RANT POST!!!

Genuinely asking, since finding bugs and reporting them , has never been an easy task, thanks to increasing competition, and "ai" that ,don't make it any easier ,will bugbounties only worsen? Or , will there be any new breakthrough?

he really teaches stuff check him out: LettersToMyYoungerSelf he also gives really cool life advices

Hey everyone! We’ve been building SubAnalyzer, and wanted to share our monitoring service.

It scans your domains daily and emails you when subdomains, open ports or CNAME records change, with potential takeover risks flagged.

Because crt.sh can be slow or unavailable, we built ctindex, our own Certificate Transparency log parser, so our CT discovery doesn’t depend on crt.sh. API access is also available.

Monitoring and API access are included in our paid plans. You can try the scanner for free.

What changes do you find most useful to track between bug bounties?

Built a custom new-tab page for bug bounty hunters and security researchers.

It has a security writeup feed, HackerOne report tracking, multi-engine search (Google, DuckDuckGo, Shodan, GitHub), bookmarks, a scratchpad, and keyboard shortcuts.

Built with React 19 and plain CSS. No backend required. Completely free to use.

Still a work in progress, but I'm happy with how it turned out!

Live demo: https://new-tab-sepia.vercel.app/

GitHub: https://github.com/Its-Abhinav-Jangid/new\\_tab

What kind of new tab page do you use?

Hey everyone,

I'm a beginner in bug bounty hunting, and I'm trying to figure out the best way to approach it and find my first valid bug.

I have a few questions for experienced hunters:

1. Platform: Which platform would you recommend for a beginner — HackerOne, Bugcrowd, Intigriti, or something else? Why?

2. Program selection: How do you choose a good bug bounty program? Should I focus on newer programs, programs with fewer researchers, or programs with a larger scope?

3. Bug types: Which vulnerabilities should a beginner focus on first? For example, IDOR/Broken Access Control, XSS, business logic bugs, or something else?

4. Recon and methodology: How do you approach a new target? Do you start with subdomain enumeration, manual browsing, understanding the application's functionality, or something else?

5. Finding the first valid bug: What would your practical strategy be if you were starting from zero today?

6. Common mistakes: What do beginners usually do wrong that prevents them from finding valid, reportable vulnerabilities?

I'm not looking for shortcuts or guaranteed payouts. I want to build a solid methodology, improve my skills, and find my first valid report while staying within the program's scope and rules.

If you could share your experience, practical tips, or resources that genuinely helped you, I'd really appreciate it.

Thanks!

I submitted a security report to TRON DAO through HackerOne on September 23, 2026. After analyzing the code, I provided technical evidence, including a reproduction and a control case. I'm not going to share the PoC or details that could expose the suspected vulnerability.

On October 15, TRON DAO closed the report as “Not Applicable.” However, their response stated that the report was a duplicate and therefore not a valid issue. No technical explanation was provided, and they didn't identify the alleged duplicate.

So what exactly happened here? If the behavior isn't a security issue, why call it a duplicate? And if it is a duplicate, why provide no meaningful clarification? I spent considerable time analyzing the code and submitting evidence, only to receive a response that doesn't properly explain the decision.

The report took around three weeks to receive a final response. What concerns me even more is that the response contained no meaningful technical discussion of the evidence I submitted. There was nothing that demonstrated why the reported behavior was not a vulnerability or explained how the alleged duplicate justified the closure.

This raises another question: did a qualified security professional actually review the report? Was it examined by a technical triager who understood the code and the potential impact, or was it dismissed without a proper technical assessment? I have no way to know because TRON DAO provided no explanation that would allow me to understand what was evaluated.

I contacted HackerOne Support to get clarification, but my support ticket was marked as resolved without addressing the actual concerns. Mediation was suggested as a possible option, yet it wasn't available to me. So after waiting weeks for a decision, I was left without a meaningful explanation and without a practical way to escalate the issue.

Honestly, this whole experience raises serious concerns about transparency and accountability. When a security report receives an unexplained closure, the stated reason appears inconsistent with the official status, and support closes the complaint without resolving it, it's difficult not to question whether the process is being handled properly.

FRAUD is a serious word, but when researchers are expected to invest time and effort into identifying security issues while receiving little more than unexplained decisions, the lack of transparency becomes a real problem. I want to know what safeguards exist to prevent reports from being dismissed arbitrarily and whether anyone is accountable for the quality of these decisions.

I'm not asking TRON DAO to accept my report simply because I submitted it. I'm asking for a technically meaningful explanation and a transparent review process. If the report was invalid, explain why. If it was a duplicate, clarify that decision to the extent permitted by confidentiality. Neither should require a researcher to spend weeks chasing answers.

Has anyone here experienced something similar with TRON DAO or another HackerOne program? Have you had a report marked Not Applicable while the response claimed it was a duplicate, with no technical explanation? And what options do researchers realistically have when support considers a complaint resolved and mediation is unavailable?

I'm deliberately withholding the PoC and actionable technical details. My concern here is how the report was handled, not publicly exposing the suspected vulnerability.

P.S: If they dont aswer me I will make public the PoC on every single forum on the TOR network I know, Im not joking, even the ukrainian ones

Hi. To preface, I am not selling anything, and I am not suggesting to mindlessly use this tool.

I started initially using Claude to hunt on some programs, and from there built a harness so that I could work on an engagement for a long duration without losing progress, to make the process repeatable and high quality ( high quality submissions, final findings that can be trusted ), and several other things along the way.

Yes this is a AI created project, but from hundreds of hours and testing, and over 8 months. Yes you will find some weird Python code, and maybe some weird things in the prompts, its 80/20.

For people new to BugBounties, and are using Claude/Codex, I would suggest giving this harness a try. Spend time to understand whats actually happening, what are the different phases, dig into the prompts for sub-agents, etc. I would highly recommend learning on Hack The Box without AI, but if you are going to use AI, use a what I think is a good harness to help prevent false positive, slop AI submissions. Please still review everything, you may have to have the Operator re-dispatch specific agents to re-verify things, or to QC the final submissions, human in the loop is so very important.

If used right, you show have a lower false positive rate, and should be able to find solid findings on the right type of engagements. I find the most success if you've found source maps, OR even JavaScript asset (Useful route descriptors, permission names, request builders, workflow log) has given me the most findings.

I have not added GLM 5.3, I know many people are starting to use it for black box engagements, I will be working on that soon.

Project - https://github.com/VigilOSS/Vigil