luq (@luq0xd) header
luq (@luq0xd) profile picture

luq

@luq0xd

hunting bugs as a pentester and bug bounty hunter

 Brazil
luq0x.github.io/
Joined March 2020
  • Tweets947
  • Following301
  • Followers2.4K
127Media
Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)Photo by luq (@luq0xd)
A melhor plataforma brasileira de Bug Bounty! Valeu, BugPay :) (R$10,000.00 BRL = $1.800 USD)
Image from luq (@luq0xd)
3
79
1,382
Manual Bug Hunters/Researchers be like
hexkaster (@hexkkaster) profile picturehexkaster@hexkkasterNov 6
tem que fazer bug bounty do jeitinho que eu faço porque se não não é o Bug Bounty De Verdade Hacking Verdadeiro
30
889
BR: @snillxsec Gringo: @MAbdullah78619 my bros know what are doing
dk4trin (@dk4trin) profile picturedk4trin
@dk4trinNov 5
qual hunter BR vc acha subestimado? marca aí já vou começar com esse: @snillxsec HAHAHAH
1
1
3
679
Resolvi dar uma olhada no Artex, a "IA que hackeia sozinha" e um rumor sobre ela ter um backdor, ARTEX (campeão do desafio "Agent+" da Baidu) está sendo distribuída por um fork com 1.325 estrelas que puxa uma imagem Docker com backdoor. Quem subiu, entregou shell. 🧵
4
29
1
163
20,767
Minecraft website in November 2011
Minecraft website in November 2011

ALT Minecraft website in November 2011

219
1,841
514
23,633
1,435,512
Goat!
dk4trin (@dk4trin) profile picturedk4trin
@dk4trinNov 2
Sou o Wesley aka dk4trin, fundador da @katrinasecteam - já fui top 67 na Intigriti Global Rank - mais de 1000 vulnerabilidades reportadas em bug bounty - levei 1 ano e 1 mês para meu primeiro bounty (2021) aqui eu posto achados, bounties, tips, reflexões relacionadas a bug bounty ou offsec dúvidas, dicas ou se quer saber o que um atacante acharia no seu sistema antes dele achar, me chama na DM ;) 👉 katrinasec.com
KATRINASEC | Offensive Security

KATRINASEC | Offensive Security

Empresa focada em Offensive Security

katrinasec.com
1
3
681
luq retweeted
dk4trin (@dk4trin) profile picture
dk4trin
@dk4trinNov 2
Sou o Wesley aka dk4trin, fundador da @katrinasecteam - já fui top 67 na Intigriti Global Rank - mais de 1000 vulnerabilidades reportadas em bug bounty - levei 1 ano e 1 mês para meu primeiro bounty (2021) aqui eu posto achados, bounties, tips, reflexões relacionadas a bug bounty ou offsec dúvidas, dicas ou se quer saber o que um atacante acharia no seu sistema antes dele achar, me chama na DM ;) 👉 katrinasec.com
KATRINASEC | Offensive Security

KATRINASEC | Offensive Security

Empresa focada em Offensive Security

katrinasec.com
1
10
3
82
5,094
I wrote a blog post about a (potentially) new XS-Leak that uses cross-origin scroll-into-view behavior to recover text from an iframe!
2
36
215
11,293
youtu.be/SqAGWRpccm0?is=qHRJ…
Cris MJ, Kali Uchis, JHAYCO - SI NO ES CONTIGO REMIX

Cris MJ, Kali Uchis, JHAYCO - SI NO ES CONTIGO REMIX

Cris MJ, Kali Uchis, JHAYCO - SI NO ES CONTIGO REMIXListen here/Es...

youtube.com
312
luq retweeted
bx0 (@maldbx0) profile picture
bx0@maldbx0Oct 28
i just released executioner this is an agentic pentest environment that allows you to power your hacking skills with AI and automation workflows free, opensource and 100% local try it now at executioner.sh
11
58
4
482
21,410
Just scored a reward @intigriti app.intigriti.com/profile/lu… #HackWithIntigriti
luq0x - Intigriti

luq0x - Intigriti

Intigriti offers bug bounty and agile penetration testing solutions powered by Europe's #1 leading network of ethical hackers.

app.intigriti.com
8
3
120
3,244
-----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----
58
1,407
47
17,025
226,666
How could a 1-Click ATO via PostMessage be marked as a duplicate of a P4? 😭 Duplicate of: Cross-Origin OAuth Flow Hijack via Named Window Reuse and Missing COOP (2025)
Image from luq (@luq0xd)
7
1
58
2,273
@RelentlessT7 help me pls, you were the one who triaged this submission 😭😭😭
450
hackbot's fav message :)
Image from luq (@luq0xd)
2
60
1,963
Computador ligue máquina de averiguar resenha e averigue possível resenha.
Kirill Firsov (@k_firsov) profile pictureKirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
3
2
86
5,039
And bug hunters, leave a comment on reports when you’re gonna stop hacking on them. Do so assertively but not disrespectfully. Heres an example of one I recently sent. If we never give them feedback, how can they know to do better?
Image from Joseph Thacker (@rez0__)
zseano (@zseano) profile picturezseano@zseanoOct 20
pay attention bug bounty program owners. if your top hackers are walking away and not submitting anything anymore, then you have failed somewhere. (although let's be honest.. these days *most* programs don't actually care if people stop submitting. they're like "okay w/e")
Image from zseano (@zseano)
22
12
5
300
28,283
Load more