iiinova — where your digital self keeps evolving

Mikhail Shcherbakov @yu5k3.bsky.social · 26/11/2025

Bet you haven't seen a hacker aka bug hunter in a tailcoat in your feed. Now you have 😜 I disappeared a bit in the last few months because of a lot of urgent stuff to close. 1/x

120

Mikhail Shcherbakov @yu5k3.bsky.social · 23/07/2025

🌊 2025 YTD #BugBounty stats update, June: 📄 13 issues Reported (5 Crit, 2 High, 6 Medium) 💰 10 issues Paid ⚪ 1 Informative Late update this time, just came back from vacation and started digging for new targets to research. I've had my eye on browser extensions for a while.

110

Mikhail Shcherbakov @yu5k3.bsky.social · 11/06/2025

🤓 2025 YTD #BugBounty stats update, May: 📄 11 issues Reported (4 Crit, 2 High, 5 Medium) 💰 9 issues Paid A new month means 2 more RCEs reported 👌 This time I hit Chromium headless browser for the first time in BBPs.

120

Mikhail Shcherbakov @yu5k3.bsky.social · 13/05/2025

👌 2025 YTD #BugBounty stats update, April: 📄 9 issues Reported (2 Crit, 2 High, 5 Medium) 💰 8 issues Paid Switched to monthly updates instead of weekly. Why? I don't drop new vulns every week 😅 My stats from the last months confirm my "capacity": ~2 RCEs per month.

140

Mikhail Shcherbakov @yu5k3.bsky.social · 07/05/2025

Just noticed @elastic.co shipped a bunch of CVEs for the 0-days I reported. Threading them here for memory and tipping my hat to the Elastic Security Team ❤️ top-tier BBP and meticulous triage. Highly recommended for Bug Hunters 😎 #bugbounty #0day #rce

120

Mikhail Shcherbakov @yu5k3.bsky.social · 02/04/2025

🫡 2025 YTD #BugBounty stats update, March: 📄 7 issues Reported (2 Crit, 1 High, 4 Medium) 💰 2 issues Paid Reported 2 RCEs and some "collateral damage" for March. Still investigating new targets and developing my own tools.

010

Mikhail Shcherbakov @yu5k3.bsky.social · 25/02/2025

😵‍💫 2025 YTD #BugBounty stats update, Week 8: 📄 2 issues Reported (1 Crit, 1 Medium) As you can see, the stats became even worse this week 😆 One RCE got classified as Medium for the first time in my life 🤯 Trying to negotiate and explain its impact, let's see how it goes...

230

Mikhail Shcherbakov @yu5k3.bsky.social · 17/02/2025

😐 2025 YTD #BugBounty stats update, Weeks 6-7: 📄 2 issues Reported (2 Crit) Reported 2 RCEs and sticking to my plan of focusing on Criticals. Not too much for two weeks, but chaining vulns takes more time than expected.

130

Mikhail Shcherbakov @yu5k3.bsky.social · 06/02/2025

🚀 2025 YTD #BugBounty stats update, Week 5: 📄 0 issues Reported I took the last days of my parental leave in Jan and spent most of the time with kids and family. No reports, no vulns, just quality time 👨‍👩‍👧‍👦

140

Reposted by Mikhail Shcherbakov

Bug Bounty Reports Explained @gregxsunday.bsky.social · 25/01/2025

Server-Side Prototype Pollution gadget collection github.com/KTH-LangSec/server-side-… #BBRENewsletter87

1111

Mikhail Shcherbakov @yu5k3.bsky.social · 15/01/2025

Now's the time to vote for the Top 10 Web Hacking Techniques of 2024! I'm excited to see my research "Exploiting the Unexploitable Insights from the Kibana Bug Bounty" nominated this year! 😎

110

Mikhail Shcherbakov @yu5k3.bsky.social · 27/12/2024

🎄 2024 YTD #BugBounty stats update, Week 51: 📄 12 issues Reported (5 Crit, 3 High, 4 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Reported Prompt Injection, so I'm in the club now, bro 😎

130

Mikhail Shcherbakov @yu5k3.bsky.social · 16/12/2024

🫡 2024 YTD #BugBounty stats update, Week 50: 📄 11 issues Reported (5 Crit, 3 High, 3 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Keeping my promise to report something every week, even if it's not super critical or exciting.

110

Mikhail Shcherbakov @yu5k3.bsky.social · 11/12/2024

✌️ Bug Bounty Tip: If you don't have time to watch the full video, just check out this slide! If you find a very restricted Prototype Pollution where you can only add empty objects or arrays to the prototype, but the gadget requires properties with payloads.. #bugbounty #bugbountytips #bugbountytip

150

Reposted by Mikhail Shcherbakov

Alex Chapman @ajxchapman.bsky.social · 09/12/2024

Dear Bug Bounty programs, You cannot simultaneously prohibit bug escalation and pivoting _and_ insist reports include accurate evidenced risk calculations. Regards, A tired bug hunter

4234

Mikhail Shcherbakov @yu5k3.bsky.social · 09/12/2024

🤒 2024 YTD #BugBounty stats update, Week 48-49: 📄 9 issues Reported (5 Crit, 3 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS me: Starting full-time BB 😎💻✨ Universe: Here, have the flu and a fever for a week 😜 me: Cool... not quite the "hot start" I had in mind 🥲

140

Mikhail Shcherbakov @yu5k3.bsky.social · 03/12/2024

Developers: “Finally…” Bug Hunters: “We had a good run, old friend!”

000

Reposted by Mikhail Shcherbakov

Mikhail Shcherbakov @yu5k3.bsky.social · 30/11/2024

oh.. 2 days is very optimistic for me 😆 I've got a few stories where I spent a LOT of time turning Info/Low into Critical. After 1-2 weeks with no results, it becomes obvious that it's not worth it financially, but I just can't stop.. Bug Bounty is kind of an addiction 😳 Here are some of my stories:

122

Mikhail Shcherbakov @yu5k3.bsky.social · 27/11/2024

If you missed it, my #DEFCON talk "Exploiting the Unexploitable: Insights from the Kibana Bug Bounty" is now live on YouTube! youtu.be/H-bhmSwnRdY

youtu.be

DEF CON 32 - Exploiting the Unexploitable Insights from the Kibana Bug Bounty - Mikhail Shcherbakov

YouTube video by DEFCONConference

1136

Mikhail Shcherbakov @yu5k3.bsky.social · 25/11/2024

🫡 2024 YTD #BugBounty stats update: 📄 7 issues Reported (4 Crit, 2 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS

121

Mikhail Shcherbakov @yu5k3.bsky.social · 22/11/2024

Most common question for freshly defended PhDs: What's next? Honestly... I'd love to know too! God, give me a sign! God: Your defense will be in room 1337. me: Say no more. I shall become a Bug Hunter! Full-time Bug Hunter! God: 😳

120

Reposted by Mikhail Shcherbakov

Gareth Heyes @garethheyes.co.uk · 22/11/2024

In case you missed it...the DEF CON video of my talk 'Splitting the Email Atom' is finally here! 🚀 Watch me demonstrate how to turn an email address into RCE on Joomla, bypass Zero Trust defences, and exploit parser discrepancies for misrouted emails. Don’t miss it: youtu.be/JERBqoTllaE?...

youtu.be

DEF CON 32 - Splitting the email atom exploiting parsers to bypass access controls - Gareth Heyes

YouTube video by DEFCONConference

29329

Reposted by Mikhail Shcherbakov

renniepak @renniepak.nl · 14/11/2024

Hey BlueSky! I case you missed it: I've created cspbypass.com A site where you can search for known CSP bypass gadgets to gain XSS. It already contains a bunch of useful gadgets with contributions from your favourite hackers. If you have some CSP bypasses to share, feel free to contribute!

17124

Mikhail Shcherbakov @yu5k3.bsky.social · 21/11/2024

🎓 Major November Update: I successfully defended my Ph.D. thesis, "Code-Reuse Attacks in Managed Programming Languages and Runtimes"! 📖 Full text: github.com/yuske/PhD_Th... Check it out if you're interested in attacks based on Prototype Pollutions, Object Injection Vulnerabilities, and want to...

100