iiinova — where your digital self keeps evolving

Bug Bounty Reports Explained @gregxsunday.bsky.social · 24/06/2025

GraphQL isn’t just an API to deliver our payloads. Often, its implementations are what actually cause them. To see what bugs it can lead to, studied disclosed bug bounty reports. IDORs, privescs, DoS, CSRFs, SQLis - it's all there. Enjoy!

youtu.be

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

030

Bug Bounty Reports Explained @gregxsunday.bsky.social · 16/06/2025

If your GraphQL testing stops at introspection and ID swapping, you’re missing out. SQLi, CSRF, caching bugs, race conditions, WebSocket bypasses - it’s all there. I studies 90 real reports to find what actually works.

020

Bug Bounty Reports Explained @gregxsunday.bsky.social · 14/06/2025

This is why you should run bug bounty tools from a VPS feat. Arthur Aires #bugbounty #bugbountytips #bugbountyhunter

000

Bug Bounty Reports Explained @gregxsunday.bsky.social · 10/06/2025

In today’s episode, Arthur Aires shares his bug bounty methodology which starts with heavy fuzzing and automation to find the best assets for manual exploitation and escalation. Enjoy!🔥

youtu.be

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

010

Bug Bounty Reports Explained @gregxsunday.bsky.social · 28/05/2025

In this video, Arthur Aires walks us through two real-world deserialization RCEs that include bypassing a class allowlist and then exfiltrating data via DNS. Techniques you'll want in your toolbox. Enjoy!

youtu.be

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

030

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/05/2025

An ATO that doesn’t make sense feat. Jasmin “JR0ch17” Landry #bugbounty #bugbountytips #bugbountyhunter

030

Bug Bounty Reports Explained @gregxsunday.bsky.social · 20/05/2025

Manipulating referer policy when DOM Purify is used feat. Jasmin “JR0ch17” Landry #bugbounty #bugbountytips #bugbountyhunter

000

Bug Bounty Reports Explained @gregxsunday.bsky.social · 17/05/2025

Using match and replace rules for quickly applying polyglot payloads feat. Jasmin “JR0ch17” Landry #bugbounty #bugbountytips #bugbountyhunter

011

Bug Bounty Reports Explained @gregxsunday.bsky.social · 14/05/2025

In this episode, Jasmin “JR0ch17” Landry breaks down how he consistently lands highs and crits - from SSRFs to less common bugs like XXEs and SQLis. Enjoy🔥

youtu.be

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

020

Bug Bounty Reports Explained @gregxsunday.bsky.social · 12/03/2025

XSS is still the most common bug class that can be insanely profitable if you master it like my today's guest - Renniepak. In this interview, we talk XSS, CSP bypasses, access control, JS bookmarks, and more... Enjoy🔥

youtu.be

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.

161

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Having them as separate products allows me to dedicate a few weeks straight to them instead of just spending a few days here and there. This way, I can focus better without dealing with the context switching. I might even add a video layer to them.

000

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Future content I do plan to create more products in the future. For example, I’d like to create courses about code review, Burp, or advanced SSRF techniques.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Because of this, I missed a few issues last year, and I’m really sorry to all the members for that.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

I remember coming back from h1-702 feeling fired up to hunt more bugs right after the event, but instead, I had to create content during that time. The context switching was also pretty frustrating and sometimes made me waste two or three days on work that should’ve only taken one.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Personal reasons With me starting to attend LHE and AWC in-person hacking events, it was hard to keep up with writing articles regularly. During the events, I wanted to focus 100% on bug bounty, which meant I either had to write the articles before the event or catch up afterward.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Therefore, I feel it makes more sense for both you and me to separate certain materials into different products and sell access to them with a one-time fee.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

For example, I feel like the value of all the case studies is worth much more than the yearly BBRE Premium, which gives you access to all of them.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

The subscription model creates a situation where new members gain access to dozens of articles that might not be their priority, and at the same time, because it is a subscription, it becomes difficult for me to justify a higher price.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Business reasons Most members have joined BBRE Premium for the Case Studies or for one of the series, such as the OAuth course.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

For example, the price of just the case study package will be $299 so if you don’t join now for $128, you may regret it later.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Later this year, it will be possible to purchase access to case studies, the OAuth course or the Devtools course as separate products. However, their price will be significantly higher than the current price of $128.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

For non-members - this is the good opportunity to join for a lifetime access to the entire BBRE Premium archive before it’s gone forever on February 28th

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

Current members, don't worry — you'll have a lifetime access with no charge.

100

Bug Bounty Reports Explained @gregxsunday.bsky.social · 21/02/2025

I am discontinuing BBRE Premium in its membership form.

120