PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to use Codex for Bug Bounty research: explore broadly, validate rigorously

yeswehack.com | blog | #bug-bounty | #vulnerability-research | #codex | #offensive-security | #ai-agents | #llm
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

YesWeHack on using Codex for bug bounty research: in black-box labs it exploited a DOM XSS in under four minutes and won admin access via a JWT flaw, with subagents and skills aiding validation.
Published
Collected

Related coverage

blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
blog · certik.com
CertiK Skills: Bringing Blockchain Security Intelligence Into AI Agents
CertiK open-sourced four AI agent skills that plug its blockchain security intelligence into Claude Code, Codex, and Cursor, letting agents query wallet risk, AML screening, and EVM transaction forensics natively.
blog · projectzero.google
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
Project Naptime evaluates the offensive security capabilities of large language models, presenting a methodology, tooling setup, and early successes finding real vulnerabilities.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back