Writeups

When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS)

Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States. In today’s interview, we discuss his journey into bug hunting, his recommended tools and techniques, and share advice for hunters just getting started. Ryan, how did you get started? To put it frankly, I got fired from my first pentesting jo

When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS)

Ryan Bonner, also known as Roll4CombatUS, is a respected Bug Bounty hunter, consultant, speaker, and Intigriti Hacker Ambassador based in the United States. In today’s interview, we discuss his journey into bug hunting, his recommended tools and techniques, and share advice for hunters just getting started. Ryan, how did you get started? To put it frankly, I got fired from my first pentesting jo

Web fuzzing for hackers

Fuzzing has been around for as long as web applications have. In fact, the term itself was coined back in 1988, when Barton Miller, a professor at the University of Wisconsin, was working over a dial-up connection during a thunderstorm and noticed that the resulting line noise was consistently crashing the UNIX utilities he was running. Web fuzzing is no different. Despite the rise of automated sc

Supply Chain Security Analysis of a 9.5M-Install VS Code Extension

Your code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials. Using Neo we audited one of the most popular ones, Markdown Preview Enhanced has roughly 9.5 million installs. The neo found five CVEs across two attack surfaces. A WaveDrom render

CrowdRecon is coming: turning hacker reconnaissance into security intelligence

At DEF CON 34, our team introduced something exciting. Something the Intigriti team has been building for months, and our Senior Product Manager, Radu Voloaga, took to the stage in the Bug Bounty Village to give everyone the first real look at CrowdRecon. How CrowdRecon closes the gap It started with a question we kept running into: what happens to all the reconnaissance work hackers do before a v

Beyond CVSS: rethinking scoring systems amidst AI Safety and Security

CVSS no fue diseñado para bugs de sistemas de IA. El artículo discute por qué la escala se rompe y qué alternativas hay sobre la mesa.

CSS: the bomb inside your inbox

CSS sanitizado en clientes de webmail resulta suficiente para exfiltrar tokens con attribute selectors, spoofear UI y montar un keylogger sin una línea de JavaScript. Afecta a Gmail, Outlook, Fastmail y ProtonMail.

Episode 186: Is Sol 5.6 SuperHuman for Bug Bounty?

Can AI do novel security research? Meet the HTTP Terminator

CRLF-Powered Desync Attacks: Beheading HTTP Streams

Intigriti named new provider for Adobe's Bug Bounty Program

Adobe empowers everyone to create through industry-leading platforms and tools that unleash creativity, productivity, and personalized customer experiences. Starting September 1, 2026, Intigriti will be the new home of the Adobe Bug Bounty Program. Why Intigriti and Adobe? As AI reshapes how organizations build and ship products, security testing needs to keep pace. Intigriti's global community of

Watching Agents Work: A Behavioral Audit of Offensive-Security LLM Runs

Intigriti Bug Bytes #238 — July 2026

How to appeal a bug bounty submission

Qué hacer cuando un reporte válido se cierra como N/A o duplicado. Proceso concreto, no consejos genéricos.

RAG and ruin: why your existing controls may miss AI poisoning attacks

Key takeaways RAG systems expand the application’s trust boundary by adding external, mutable content to the model context. If a threat actor can influence what gets indexed and retrieved, they can influence what the model says or does. In simple QA systems, that may mean misinformation or unsafe recommendations. In agentic systems with tools and permissions, it can become data leakage, un

AI’s convenience cost. The impact of the lethal trifecta on organizations today

The lethal trifecta matters more now than ever because AI tools can read your data, absorb instructions, and act on your behalf. That means a poisoned email, webpage, or document could trick your AI into leaking information or taking actions you never approved. The more AI becomes your assistant, the more its access, permissions, and actions need guardrails. This blog takes a look at the lethal

Episode 184: 750+ Bugs in 2026 with 0xMoose (Ads Dawson)

Cómo se sostiene un ritmo de 750+ bugs en un año. Entrevista con Ads Dawson sobre proceso y automatización.

Oh My Rogue Agent

Introducing Internal Network Scanning: see your network the way an attacker inside it would

Most breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Internal scanning was supposed to catch exactly that but most scanners match a host's banner and version against a CVE list and flag everything potentially affected, so the few reachable exposures sit lost

The between-reports problem: why security teams miss what attackers see

What you will learn Why faster discovery and higher volume can still leave teams blind between vulnerability reports. Why scanners and inventories are necessary, but not enough to explain attacker focus and intent. What “between-reports visibility” actually means (without the product pitch). What we believe security teams will need next: earlier signals that support action before the next repor

Episode 183: PortSwigger Research Impossible XSS SOLVED

Community Spotlight: Rishi (@rxerium)

“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Cente

Reconnaissance for exposure management: why context matters in the AI era

Over the last few weeks, we’ve explored what AI is changing in security: discovery is faster (Vulnpocalypse now?), volume is higher (Common AI misconceptions debugged!), and the human layer triage (The AI Impact), judgment, and prioritization has become more important, not less (CEO Insights). But there’s a deeper implication hiding underneath all of that: most security teams still only learn from

Exploiting insecure cookie policies

The Vulnerability Curve Bent With the AI Curve

Red-Teaming Cloud Infrastructure with Neo

Top 10 web hacking techniques of 2025

El ranking anual de la comunidad. Punto de partida obligado para entender qué técnicas movieron la aguja el año pasado.

The Fragile Lock: Novel Bypasses For SAML Authentication

Introducing HTTP Anomaly Rank

WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine

La superficie WebSocket queda casi sin testear en la mayoría de los programas. Esta herramienta la vuelve accesible.

From Open Redirect to Account Takeover

An open redirect in a phone-based login flow chained into account takeover — a redirectTo parameter carrying the auth token was bypassed with the classic @ URL trick, escalating a commonly-dismissed low-severity bug into full token theft.

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

Inline Style Exfiltration: leaking data with chained CSS conditionals

Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling

Lectura obligada antes de reportar un smuggling: la mayoría de los falsos positivos vienen de confundir pipelining con desync.

HTTP/1.1 must die: the desync endgame

Repeater Strike: manual testing, amplified

Drag and Pwnd: Leverage ASCII characters to exploit VS Code

Document My Pentest: you hack, the AI writes it up!

Vulnerabilities to Master in 2025: Your Path to $100k in Bug Bounties

Breaking Free from Duplicate Submissions: A Strategic Approach to Bug Bounty Success

My Expense Report resulted in a Server-Side Request Forgery (SSRF) on Lyft

Un flujo de expense report que renderiza PDF del lado del servidor termina en SSRF. Clásico del género y todavía vigente como patrón.