Bug Bytes #199 – Hacking LLMs, Bug Chains and Hackers Chat in LA
By travisintigriti
May 10, 2023
Last updated on August 8, 2026
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the weeks from May 1st to May 7th
Intigriti News
The intigriti YouTube channel has officially passed the 15k milestone!
Top 5 Web Extensions for bug bounty hunting (for Chrome & Firefox)!
From my notebook
Dependabot Confusion: Gaining Access to Private GitHub Repositories using Dependabot
A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, DOM-based XSS, CORS, CSRF…
HackAPrompt is a prompt hacking competition aimed at enhancing AI safety and education by challenging participants to outsmart large language models (e.g. ChatGPT, GPT-3). – Prompt injection explained
Other Amazing Things
Asset Discovery Using Shodan + Giveaway! // Bug Bounty Recon
Here are 3 FREE web hacking resources to learn web hacking! (shorts)
Dangerous Codes: SQLi (shorts)
Facebook’s TOP1 bounty hunter about how to not be replaced by AI (shorts)
How long does Facebook’s TOP1 hunter stay on one target (shorts)
What Facebook’s TOP1 bounty hunter does differently (shorts)
Stored, Blind, Reflected and DOM – Everything Cross–Site Scripting
Portswigger Web Academy – Server-Side Template Injection (SSTI)
How I am learning Web3! (Smart Contracts, Security, Bug Bounty)
Hacking an organization with one of the most stealthy and dangerous web attacks
EP119 RSA 2023 – What We Saw, What We Learned, and What We’re Excited About
NO. 380 — LLM-Mind-Reading, Automated War, Rusty Sudo, Eliezer Bitterness Theory
SN 921: OSB OMG and Other News! – Age verification, Google Authenticator E2EE, VirusTotal AI, cURL
208 – A Timing Side-Channel for Kernel Exploitation and VR in the wake of Rust
Episode 374 – The event we called left-pad, Episode 77 remaster part 1
To bug bounty hunters, where do you store your recon data and your test data in general
I really really really hate call out posts against specific triagers.
Flipperzero, very useful when you dont have your hotel room key with you!
Achieve Maximum Protection With Minimal Effort: Beginning Your Zero Trust Journey
Understanding Server Side Request Forgery (SSRF): Owasp API6 | 2023
Red Teaming: Exfiltrating Data & Command Network Nodes (Like a Ghost!)
The Art of Reconnaissance for Bug Bounty: Finding Vulnerabilities like a Pro
Ruby Code Vulnerability Analysis: ConfirmSnsSubscription RCE
The Art of Bug Bounty Reporting: Mastering Effective Communication and Persuasion
“Ooo aaa uuuthh” or 2 me, OAuth ! Tips on conquering OAuth2!
GO Code Review #1 : Hard-coded credentials are security-sensitive
TryHackMe’s WebOSINT Simple Writeup— Conducting Basic Open-source Intelligence Research
GPT-4 – How does it work, and how do I build apps with it? – CS50 Tech Talk
Unauthorized access to the admin panel via leaked credentials on the WayBackMachine
Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera
How do I Bypass Payment when a Subscription ends so I don’t have to pay for my subscription
Leaking Account Credentials with Excel: Hunting Vulns in Office365
How I found +100 Reflected Cross Site Scripting & SQL Injection
Mass Assignment leads to the victim’s account being inaccessible forever
How I Discovered and Reported a PII Disclosure Vulnerability
How I got €50 from tag . It literally bypassed everything.(UNEXPECTED BYPASS)
How a simple Directory Listing leads to PII Data Leakage, Remote Code Execution and many more
Three Argo CD API exploits, distributed identity for modern API security
PimpMyBurp #8 – Perform Advanced Fuzzing With Turbo Intruder
10 handy practical #hacking tools I’ve developed over the years @hakluke
Did you know you can recover scrubbed metadata from a PDF that wasn’t scrubbed properly?
My new favorite SQLi finding methodology returning some great results…
You may also like
July 31, 2026
Intigriti Bug Bytes #238 - July 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Intigriti turns 10! RCE in GitHub.com and GitHub Enterprise Server Burp Suite going agentic with Burp AT Hacking Gemini Enterprise for $15,000 3,708 live credentials found by scanning GitHub Archive And so much mo
June 26, 2026
Intigriti Bug Bytes #237 - June 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: A 10-year-old pre-auth RCE in phpBB Earning $500K hacking Google with AI Reading any Salesforce Marketing Cloud account's emails New DOMPurify sanitizer bypass Mapping abandoned S3 buckets to redo SolarWinds at scal
May 30, 2026
Intigriti Bug Bytes #236 - May 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Earning $148K via RCE in Google Cloud How public Google API keys became Gemini credentials Our first official Burp Suite extension Two new bypasses for Chrome's Sanitizer API One-click account takeover from a sani