PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bugbounty alert automation tips

josephthacker.com | blog | #bug-bounty | #automation | #bash | #subdomain-enumeration
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Joseph Thacker's bug bounty alerting setup: two-line stdin-to-Slack scripts chained with findomain, httprobe and anew for cron-driven alerts on new and newly-alive subdomains.
Published
Collected

Related coverage

blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · josephthacker.com
bash aliases: command-line tools #3
Part 3 of Joseph Thacker's command-line series: his bash aliases for ffuf (auto-named output, recursive deep fuzzing, vhost discovery), nuclei, custom wordlist management, arjun parameter fuzzing and CIDR expansion.
blog · josephthacker.com
cut: command-line tools #2
Part 2 of Joseph Thacker's command-line series: using cut with -d/-f to slice ffuf CSV output, plus a rev|cut|rev trick to strip path suffixes or top-level domains from URL lists.
blog · josephthacker.com
grep: command-line tools #1
Part 1 of Joseph Thacker's command-line series: grep for bug hunters — the -Hrnia flag combo ("hernia"), regex context windows for minified JavaScript, and using grep as a filter for tool output.
blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
blog · bugcrowd.com
What I learned building AI agents for bug bounty hunting
A hacker's four-agent CrewAI pipeline for finding information-disclosure bugs produced mostly false positives; only report generation kept an agent, while the rest returned to plain Bash automation.
Back