Disclosed. September 29, 2025. HackAICon Wraps, Stockholm & Singapore LHEs, New H1-Elite, Dojo Expands Training, and More

H1-468 Live Hacking Event in Stockholm [🔗 Tweet]
by HackerOne

HackerOne’s Live Hacking Event in Stockholm kicked off last week. Winners and MVH announced soon.
Read the full announcement →

New Members Inducted into HackerOne H1-Elite [🔗 Tweet]
by Ariel Garcia

Congratulations to the newly inducted members of the Hacker0x01 H1-Elite group, recognizing their contributions and expertise in the community.
Read the full announcement →

HackAICon Wraps Up [🔗 Tweet]
by @_Euzebius

HackAICon 2025, held in Lisbon on September 25, was the first conference dedicated to the intersection of AI and ethical hacking, featuring researchers, hackers, and security leaders exploring how AI can be leveraged for cybersecurity. The sold-out event delivered talks, roundtables, and hands-on challenges with a focus on knowledge-sharing and practical defense strategies rather than sales pitches.

H1-65 Live Hacking Event in Singapore
by HackerOne

HackerOne is running back to back LHEs, with the Singapore event happening THIS WEEK. More to come soon.

Have something you want to Spotlight? Tell me.

Cloud Security CTF Challenge [🔗 Tweet]
by Wiz

This tweet announces an exciting new Capture The Flag (CTF) challenge that integrates advanced bug bounty techniques, inviting security professionals to compete and enhance their skills. 
Read more →

Dojo Launches New Challenges and Training Features for Hackers [🔗 Tweet]
by YesWeHack

The Dojo platform now features new challenges and learning modules designed to help security hunters refine their skills and boost their chances of qualifying for private program invitations.
Read more →

YesWeHack Becomes Official CVE Numbering Authority [🔗 Tweet]
by YesWeHack

YesWeHack has officially become a CVE Numbering Authority, enabling the assignment of CVE IDs and publication of CVE records, which will significantly impact vulnerability management practices.
Read more →

Did I miss an important update? Tell me.

Caido Now Available in Kali Linux 2025.3 for Easy Installation [🔗 Tweet]
by Caido

Caido can now be installed seamlessly in Kali Linux 2025.3, providing both a desktop application and CLI with just a single command.
Read more →

GitHub - RenwaX23/XSSTRON: Electron JS Browser To Find XSS Vulnerabilities Automatically [📁 Tool]
by RenwaX23

XSSTRON is an Electron JS-based browser tool designed to automate the detection of XSS vulnerabilities as users browse the web. It conducts background vulnerability checks and supports GET/POST scenarios.
View the tool →

GitHub - xitmakes/jsberg: Efficient URL Scraper [📁 Tool]
by xitmakes

JSBerg is a powerful Python-based URL scraper that extracts various web resources, including links and JavaScript files, from a list of websites, complete with features for multithreading and inline URL extraction. 
View the tool →

Have a favorite tool? Tell me.

Local File Inclusion via XSS in Prince PDF Generator [📓 Blog]
by Virendra

This detailed write-up examines a local file inclusion vulnerability identified in the Prince PDF generator via an XSS attack, illustrating the exploitation process and potential risks involved.  
Read more →

Regex XSS Exploitation Techniques [🔗 Tweet]
by Mat Rollings

This discussion showcases how overly-greedy regex replacements can lead to serious XSS vulnerabilities, featuring a live demo for practical exploitation.
Read the full thread →

Did I miss an important update? Tell me.

Mastering DOM XSS for Bug Bounties Video Release [🎥 Video]
by Medusa

A newly released video focuses on advanced DOM XSS techniques, emphasizing their significance within the context of Bug Bounty reports.  
Watch video →

PortSwigger BurpAI Found These Exploits [🎥 Video]
by NahamSec

A newly released video demos Burp AI scanning and exploiting vulnerabilities (IDOR, XXE, SQLi, XSS), showing how AI speeds discovery and builds PoCs while underscoring the need for human validation and context-aware testing.
Watch video →

Google Docs 0-day & React Exploits with Nick Copi [🎥 Video]
by Critical Thinking – Bug Bounty Podcast

An in-depth chat on client-side hacking: a Google Docs 0-day (client-side DoS), React.createElement-based XSS chains, CSPT/CSS data exfil tricks, and real-world escalation/triage tactics with guest 7urb0.
Watch video →

Did I miss something? Tell me.

Exploiting Race Condition Bugs in Modern Architectures [🔗 Tweet]
by YesWeHack

This tweet introduces a guide focused on exploiting and mitigating race condition bugs, emphasizing their relevance in microservices and distributed queues for bug bounty hunters.
Read the full thread →

Understanding Client-Side Path Traversal Vulnerabilities [📓 Blog]
by Behi_Sec

Emphasizing the importance of recognizing client-side path traversal vulnerabilities, this resource offers a comprehensive exploration of the issue.
Read the full thread →

Find Misconfigurations First [🔗 Tweet]
by bugcrowd

This blog highlights the critical importance of identifying misconfigurations within security testing, which can often go unnoticed yet yield substantial rewards.  
Read more →

OpenAI Red Teaming Kaggle Competition Submission [🔗 Tweet] 
by Joseph Thacker

The author shares reflections on their participation in the OpenAI red teaming competition, urging others to review their submission for educational purposes.
Read more →

Did I miss something? Tell me.

Using mktemp for Organizing JavaScript Dumps [🔗 Thread]
by Vitor Falcão "busfactor

This tweet advocates the use of mktemp -d for creating temporary directories, facilitating better organization of JavaScript files and proof-of-concept scripts.
Read the full thread →

Learn to Use cd - for Effective Directory Navigation [🔗 Tweet]
by Justin Gardner

The simple cd - command allows users to quickly return to the previous directory in the command line, enhancing productivity.  
Read the full thread →

Using Regex for Advanced Host Field Alerting [🔗 Tweet]
by Sicarius

This tweet details the application of regex in advanced alerting concerning specific domain patterns in the host field, with an emphasis on regex character limits.
Read the full thread →

Google Dorking for XSS Vulnerabilities in Parameters [🔗 Tweet]
by VIEH Group

This tweet provides Google Dork queries aimed at identifying parameters vulnerable to XSS, along with an injection test for demonstration purposes. 
Read the full thread →

Exploring IDOR: Patterns and Related Vulnerabilities [🔗 Tweet]
by Behi

Highlighting the correlation between various vulnerabilities, this tweet emphasizes that discovering an IDOR often suggests the existence of additional issues, urging thorough endpoint testing.
Read the full thread →

Exploiting NoSQL Vulnerability to Achieve DOS Attack [🔗 Tweet]
by Masonhck357

This tweet describes a NoSQL vulnerability that allows a PUT request to persist a faulty data type, resulting in a denial-of-service condition for all users in an organization.
Read the full thread →

Did I miss something? Tell me.

Because Disclosure Matters: This newsletter was produced with the assistance of AI. While I strive for accuracy and quality, not all content has been independently vetted or fact-checked. Please allow for a reasonable margin of error. The views expressed are my own and do not reflect those of my employer.