@yeswehack employee 🪖 | Bug Bounty hunter🐝 & coffee lover ☕ I'm a big fan of breaking into all sorts of things 🌐
In your system
- Tweets 1,191
- Following 509
- Followers 2,055
- Likes 3,683
I'm looking forward to presenting my latest research at @BugBountyDEFCON!
We're excited to announce that Alex Brumen (@brumens2) will be speaking at the Bug Bounty Village during DEF CON 34!
Stay tuned for more details on their talk, you won't want to miss it.
#BugBounty #DEFCON #BBV #BugBountyVillage
1
18
2,121
For everyone who asked during #DEFCON regarding the article, you can find the full research for cache key injection below!
Cache poisoning isn’t always about unkeyed input🔑
At @BugBountyDEFCON, @brumens2 showed how cache key injection can lead to unauthenticated cache deception, CPDoS and stored XSS via scheme fragments 🧪
This research is now live on our blog 👇
yeswehack.com/lab/research-c…
2
1
10
1,067
Brumens retweeted
Cache poisoning isn’t always about unkeyed input🔑
At @BugBountyDEFCON, @brumens2 showed how cache key injection can lead to unauthenticated cache deception, CPDoS and stored XSS via scheme fragments 🧪
This research is now live on our blog 👇
yeswehack.com/lab/research-c…
1
33
123
9,569
Hope to see you there!
Cache Key Poisoning is a really underrated vulnerability class, this talk from @Brumens2 at @BugBountyDEFCON sounds really interesting!
1
13
737
Brumens retweeted
We're at @_leHACK_ until tomorrow! Don’t miss:
🐛 Our Live Hacking Event target reveal, open to all attendees — today at 1 PM!
🧠 Payload Plz Reloaded by @BitK_ and @Brumens2: payload-plz.com/
🎁 Meet the team & grab some swag at booth 49, level S2
See you there 👋
2
46
3,475
Brumens retweeted
Hey, hunters! We just dropped a new deep dive on code analysis 💡 Our latest hunter guide covers advanced techniques such as taint analysis and CodeQL, demonstrated with real tools against a real target 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
2
8
44
4,531
bbscope v2 is out & bbscope.com is live!
A free #bugbounty tool to pull scope from HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi.
Store it all in PostgreSQL, track changes, query it, pipe it into your tools
Thread on what's new👇
11
88
403
54,684
Create article written by @pwnwithlove !
Did you know, XXE vulnerabilities can be chained with SSRF to reach internal services? 🤔
Our latest CWE deep dive explains the root causes and impacts of XXE bugs, and has numerous walk-throughs, including for blind, error-based and file upload-related techniques 👇
yeswehack.com/learn-bug-boun…
1
1
11
937
Brumens retweeted
For those following along with @Brumens2, here are the @yeswehack DOJO labs link:
dojo-yeswehack.com/learn/pyt…
Alex @Brumens2 is taking on the stage and opening #NahamCon2025 Day 1 with "Python Pitfalls: Turning Developer Mistakes into Vulnerabilities"
Join us now 👉🏼 piped.video/live/xmRDR1etnzY
1
15
1,293
Brumens retweeted
Alex @Brumens2 is taking on the stage and opening #NahamCon2025 Day 1 with "Python Pitfalls: Turning Developer Mistakes into Vulnerabilities"
Join us now 👉🏼 piped.video/live/xmRDR1etnzY
1
6
50
4,566
Brumens retweeted
Alex is basically part of NahamCon history at this point… he has spoken at every NahamCon so far 🐍🔥
This year he's back with a workshop packed full of real Python security pitfalls, PoCs, and hands-on examples that will make you look at your code (and other people’s code) very differently.
📆 December 17
ℹ️ Explore the lineup 👉🏼 nahamcon.com
2
9
126
7,165
Brumens retweeted
HTTP request smuggling vulnerabilities have been evolving like crazy in recent years! 🚀
We’ve published a guide to this in-vogue area of research, comprising detection, exploitation and mitigation tips 👇
yeswehack.com/learn-bug-boun…
#BugBounty #BugBountyTips
21
128
6,179
Brumens retweeted
Ever found someone else’s SIM card in your mailbox? 📱📫
It’s one of the wildest bugs @Wlayzz has ever found – and just one of several interesting insights he shares in our latest hunter interview.
Watch his story now 👇
#YesWeRHackers #BugBountyTips
1
2
32
7,001
Brumens retweeted
📢 New research from @Brumens2 is out! Learn how to detect & exploit syntax confusion in real web apps, how he turned an SSRF & blind file read into a full file read, and more besides 👇
yeswehack.com/learn-bug-boun…
1
15
81
4,596
Brumens retweeted
Cross-site request forgery (CSRF) has survived the protections introduced to defeat it, so remains essential #BugBounty knowledge 📖 Our second ‘vulnerability vectors’ instalment details CSRF types and how to exploit them 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
1
25
138
11,380
Brumens retweeted
Microservices, serverless and distributed queues are making race condition bugs a promising avenue for #BugBounty hunters 🏃🏻 Our latest ‘Vulnerability Vectors’ guide deep dives into exploiting and mitigating these concurrency flaws 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
1
8
39
7,015
Brumens retweeted
SQL injection vulnerabilities remain widespread – and potentially lucrative for #BugBounty hunters 💉Our ‘Vulnerability Vectors’ series kicks off with techniques – such as blind SQLi, time-based attacks and OOB callbacks – for this classic CWE 👇
yeswehack.com/learn-bug-boun…
2
18
77
8,488
Brumens retweeted
Want to hack mobile applications? 📱
We’ve just published the ultimate guide to building an Android #BugBounty lab with emulators, real devices and proxies (featuring Genymotion, Android emulator, Magisk, Burp, Frida & Medusa) 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
1
33
149
11,021