BugCod3

29 October 2026 17:15

Your X links are snitching on you.

https://x.com/BugCod3/status/2115837807537299777

BugCod3

27 October 2026 16:41

🛠 open-sesame

An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWASP WSTG, validates findings, and writes…

git clone https://github.com/hassan-algo/open-sesame

⭐️ 96 · 🧬 HTML

🔗 GitHub
#Recon #WebSecurity #ActiveDirectory #Pentest

🤝 @RootAccessClub × @BugCod3

BugCod3

27 October 2026 10:15

🔑 Clavis — JWT Attack Multitool

Stop juggling half a dozen scripts to test one token. Clavis runs the full JWT attack chain from a single binary — zero dependencies, works on Linux, macOS & Windows.

⚔️ What it does
• decode & audit — instantly flags weak configs
• crack weak HMAC secrets with a wordlist
• alg:none signature bypass
• RS256 → HS256 algorithm confusion
• kid header injection — path traversal / SQLi
• jwk & jku header injection — self-signed keys
• forge any token on the fly
• scan — extract JWTs from HAR files, logs & JS

⚡ Install
go install github.com/MRvirusIR/clavis/cmd/clavis@latest
(or grab a prebuilt binary from Releases)

🔗 Links
GitHub → https://github.com/MRvirusIR/clavis
Write-up → https://bugcod3.com/p/jwt-attack-playbook-weak-secret-to-account-takeover

Free & open source. Built for bug bounty. 🐛

#bugbounty #JWT #appsec #pentest #infosec #BugCod3

BugCod3

24 October 2026 22:37

🚨 One click. Full account takeover.

A forgotten subdomain. A lazy OAuth check. On their own? Two boring "low" bugs.

Chained together? I took over any account with a single link — and got paid 4 figures. ⏱️ 3 hours from recon to PoC.

I broke down the FULL kill-chain — every command, every request, every bypass:

🔭 Finding the dangling DNS record
🪣 Claiming the dead subdomain
🔗 Breaking the redirect_uri allowlist
💣 Stealing the OAuth code → session

👇 Read the full write-up (free, no signup):
🔗 bugcod3.com/blog

The lesson that levels up your hunting: severity lives in the CHAIN, not the bug.

#BugBounty #AccountTakeover #OAuth #Recon #CyberSecurity

BugCod3

21 October 2026 21:42

🚨 PHP2Shell is live on SubZer0

Two critical PHP core flaws, CVSS 9.2:
CVE-2026-109618 + CVE-2026-109619
One unauthenticated request can lead to remote code execution.

✅ Fixed in: PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

📂 On the site: 30+ public PoCs (updated every 15 min), scanners, Nuclei templates and official advisories

🔗 https://iliya-bashrc.github.io/SubZer0/

⚠️ Run PoCs only in a test lab

#PHP2Shell #PHP #RCE

@RootAccessClub × @BugCod3

BugCod3

21 October 2026 19:00

🤫 What they'd never say to your face… lands here, anonymously.

Create your personal WhisperTopic link, drop it in your bio or story, and let anyone message you without revealing who they are 👀

✨ Why WhisperTopic?
🗂 A private topic for every sender, no more messy chats
🎯 Message anyone anonymously
👀 Seen receipts, know when your message is read
✏️ Edits & ❤️ reactions, everything stays in sync
🛡 Profanity filter & one-tap block
🎭 Identity revealed only with consent
🎲 Ready-made story prompts

🔒 Your identity is never revealed.

👇 Get your free link now:
🤖 @WhisperTopicBot
/channel/WhisperTopicBot

⚡️ Powered by @BugCod3

BugCod3

20 October 2026 20:44

📢 Service Update

Dear users,

Our bots were offline for a while and temporarily unavailable. We're happy to announce that all bots are now back online and ready to use! ✅

Thank you for your patience and continued support. ❤️

T.me/BugCod3BOT
T.me/BugCod3UPBOT

BugCod3

20 October 2026 01:43

🩸 REVELAR v2.0 — Unmask the real origin IP behind any CDN. 👁️

Cloudflare. Fastly. Akamai. They only hide the front door.
Every origin still leaves a trace — Revelar locks onto it.

⚙️ 18+ OSINT sources · live CDN fingerprinting · DNS/SPF/ASN pivot
favicon mmh3 · TLS cert hunting · smart origin scoring (0–100)

One command. Full arsenal.
$ revelar -d target.com -active -deep

🐺 Free & open-source.
⭐ github.com/MRvirusIR/Revelar
📡 @BugCod3 🤝 @RootAccessClub

✖️ Twitter

#bugbounty #recon #osint #infosec #cybersecurity #Revelar

BugCod3

21 August 2026 21:21

New Web Based Subdomain Discovery Service 🔍

crt.name is a new web based service for discovering subdomains through Certificate Transparency (CT) logs 🌐

It searches publicly available certificate records to identify subdomains associated with a target domain 🔵

Useful for ❓
• Subdomain Enumeration
• Reconnaissance
• Asset Discovery
• Bug Bounty Recon

crt.name 🔗

💎 @RootAccessClub
💎 @BugCod3

BugCod3

16 August 2026 15:25

Don't forget to 🔹
Like 👍
Share ➡️
Support 🧡

BugCod3

13 July 2026 02:03

📣 Advertise on @BugCod3

Looking to promote your project, service, Telegram channel, GitHub repository, VPS, hosting, cybersecurity tool, or any tech-related business?

👩‍🚀 Reach a targeted audience interested in Cybersecurity, Bug Bounty, Programming, Linux, Open Source, and Technology.

Advertising Rates
⏰️ 6 Hours — $3
⏰️ 12 Hours — $5
⏰️ 24 Hours — $8
📌 Pinned Post (24 Hours) — +$3

✅ Fast placement
✅ Targeted tech audience
✅ Worldwide reach

💬 Book your ad now:
@YourAnonBugCode

━━━━━━━━━━━━━━━━━━━━

📣 تبلیغات در کانال @BugCod3

اگر قصد تبلیغ پروژه، سرویس، کانال تلگرام، مخزن GitHub، VPS، هاستینگ، ابزارهای امنیت سایبری یا هر کسب‌وکار مرتبط با فناوری را دارید، می‌توانید تبلیغ خود را در کانال ما منتشر کنید.

👩‍🚀 دسترسی به جامعه‌ای هدفمند از علاقه‌مندان به امنیت سایبری، باگ بانتی، برنامه‌نویسی، لینوکس، متن‌باز و تکنولوژی.

تعرفه تبلیغات
⏰️ ۶ ساعت — ۳ دلار
⏰️ ۱۲ ساعت — ۵ دلار
⏰️ ۲۴ ساعت — ۸ دلار
📌 پست سنجاق‌شده (۲۴ ساعت) — ۳ دلار (به هزینه تبلیغ اضافه می‌شود)

✅ انتشار سریع
✅ مخاطبان تخصصی
✅ دسترسی بین‌المللی

💬 برای رزرو تبلیغ پیام دهید:
@YourAnonBugCode

BugCod3

05 July 2026 13:38

Full Bug Bounty Hunting & Red Teamers Methodology 2️⃣0️⃣2️⃣6️⃣

Created by Cybernote, aspiring Red Team Operator and Bug Bounty Hunter. This repository documents my methodology, notes and workflow for web application security testing⚡️

GitHub 🐱

#bug_bounty #bugbounty #RedTeam

🛫@BugCod3
🛫@RootAccessClub

BugCod3

29 June 2026 00:37

our team needs a sponsor and is accepting sponsorship. Contact us to collaborate.

T.me/BugCod3BOT

BugCod3

27 June 2026 15:54

New RootAccessClub post 🤔

BugCod3

23 June 2026 10:30

Certified Penetration Tester (CPENT) Collection 👑

Download ⬇️

#free #CPENT #learning

⚡️ @RootAccessClub
⚡️ @BugCod3

BugCod3

28 October 2026 10:08

What do you think would be the right response?🤔

To submit your answer, visit the link below: https://bugcod3.com/quiz

BugCod3

27 October 2026 11:55

🚨 PHP2Shell — when the bug is in PHP itself

Not a plugin. Not a framework. The interpreter behind most of the web got hit with pre-auth RCE — and AI helped find it (WSJ & NYT covered it).

🧠 The two bugs
• CVE-2026-109618 — RCE via out-of-memory corruption
• CVE-2026-109619 — use-after-free via stale request state (session.upload_progress)
• CVSS 9.2 · no auth · fires before your app code even runs
• Highest risk on Apache mod_php — also FPM, php-cgi, FrankenPHP, LiteSpeed

🎯 The twist nobody mentions
Mass scanning was instant (millions of hits within a day). But a reliable, universal exploit is HARD — memory_limit, same-worker races, and ASLR all get in the way. We break down exactly why.

🛡 What to do
• Patch: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 — the only real fix
• Affected from PHP 5.4.0 onward → on CISA KEV, exploited in the wild

📖 Full write-up — source-level breakdown + what it means for bug hunters:
bugcod3.com/p/php2shell-preauth-rce-cve-2026-109618-109619

BugCod3

25 October 2026 01:41

SubZer0Robot is live ⚡

SubZer0 now lives inside Telegram 🤠

🚨 Early warnings — new exploitation waves, posted the moment they're detected

🔴 Fresh CISA KEV entries — actively exploited CVEs, automatically

📱 Mini App — the full CVE tracker, PoCs and dossiers right inside Telegram

🔄 Live layer refreshed every ~15 min · Ed25519-signed data

🤖 mini app

🔔 Alerts land

🌐 Web

by @BugCod3 & @RootAccessClub

BugCod3

22 October 2026 23:45

🚀 bugcod3.com is LIVE

From Shadows To Shells — the BugCod3 channel now has a home 🏴‍☠️

🧰 Arsenal — 176+ hacking tools, searchable, with live GitHub stars
📰 Feed — every post from this channel, filterable by tag
🧪 Lab — reverse shells, JWT debugger, XSS payloads, encoders, hash ID… 100% in-browser
🧠 Daily Quiz — earn points, keep your 🔥 streak, climb the leaderboard
✍️ Write-ups — deep-dive bug bounty articles
🔐 2FA + GitHub/Google login · 📲 installable on your phone

🎲 Hit "Surprise me" in the Arsenal
👀 Psst… type "hack" on the site

👉 https://bugcod3.com

Learn • Hunt • Dominate ⚡️
#BugBounty #Tools #CyberSecurity

BugCod3

21 October 2026 19:04

🚀 Give it a try, share it with your friends 👥
and tell us what you think, we'd love to hear from you! 💜

BugCod3

21 October 2026 09:13

🚀 BugCod3 IP CDN Scanner v2.0 is out!

Find clean, low-latency CDN IPs, fast ⚡️

▫️ Async engine, 15+ CDNs detected
▫️ Real TLS/SNI test + Cloudflare PoP
▫️ Latency, jitter & loss with a 0–100 score
▫️ Live dashboard + interactive HTML report
▫️ Auto-updated CDN ranges & resume support

🛠 pip install git+https://github.com/MRvirusIR/BugCod3-IP-CDN-Scanner

🎯 bugcod3 ranges cloudflare | bugcod3 scan -i - --sample 2 -p cf-tls --sni your.domain.com

📦 github.com/MRvirusIR/BugCod3-IP-CDN-Scanner
⭐️ Star it if you like it!

⚠️ Authorized use only.
#BugCod3 #CDN #Cloudflare #CleanIP #OpenSource

📡 @BugCod3 | @RootAccessClub

BugCod3

20 October 2026 18:10

🚀 Big Update: Dork-Scraper v2.0.0 is out!
I rewrote Dork-Scraper from scratch. It's no longer a simple script. It's now a full recon tool for bug bounty and pentesting 🔥

🧠 What's new?
🔎 4 search engines: Google · Bing · DuckDuckGo · Yahoo
⚡️ Lightweight HTTP by default, so no browser needed (Selenium is optional)
📂 Batch mode: run dozens of d
0rks from a file + ready-made d0rk lists
🧹 Built-in cleaning: dedupe, strip tracking params, domain & parameter filters
💾 Export to TXT / JSON / CSV
🥷 Rotating User-Agents, random delays, proxy support & CAPTCHA detection
✅ Unit tests + CI + full docs

🧪 Example:
dork-scraper -D d0rks/sqli.txt --params-only --unique pattern -f json -o targets.json

📥 Download & docs:
🔗 github.com/MRvirusIR/Dork-Scraper

⚠️ For legal, authorized testing only.

👑 @BugCod3

#BugBounty #Recon #OSINT #Pentest #D0rking

BugCod3

19 October 2026 11:49

❄️ SubZer0 – Noise in. Priority out

Thousands of new CVEs every month
Only a few actually matter — SubZer0 shows you which ones to patch first

🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view
🔐 SHA-256 verified · auto-refreshed every 6h
⚡️ Free · no sign-up · no tracking

🌐 iliya-bashrc.github.io/SubZer0
💻 github.com/iliya-bashrc/SubZer0

💎 @RootAccessClub × @BugCod3

BugCod3

20 August 2026 16:06

New RootAccessClub Post 🔥

BugCod3

16 August 2026 15:21

𝐁𝐮𝐫𝐩𝐀𝐏𝐈𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲𝐒𝐮𝐢𝐭𝐞 ⭐️

Professional grade Burp Suite extension for comprehensive API reconnaissance, intelligent fuzzing, and AI powered security testing 🛡

Features 🪙

😵 Reconnaissance

⚡️ Advanced Fuzzing

🔎 Discovery Tools

🔥 Export & Integration

Installation 🖥

1️⃣🔥Burp ➡️ Extender ➡️ Extensions ➡️ Add ➡️ Python

2️⃣ Select🔥 BurpAPISecuritySuite.py
Extension loads and starts capturing automatically

Requirements ⁉️

Burp Suite (Professional or Community Edition) ✅

Jython Standalone JAR ✅

GitHub 🐱

💎@RootAccessClub
💎@BugCod3

BugCod3

11 July 2026 20:01

🚀 Premium Telegram Bot Sources & Security Packages Available | فروش سورس‌های حرفه‌ای و پکیج‌های امنیتی

A collection of premium Telegram bot sources and security-related packages is now available for sale, including:

• 🤖 Uploader Bot Source
• 💬 Messenger / Support Bot Source
• 🌐 DDoS Source
• 🍯 Honeypot Source
• 🛡 Shell Deface Bypass Package
• ⚙️ And many more source codes, tools, and projects

✉️ To get the full list or purchase, contact:
@YourAnonBugCode

━━━━━━━━━━━━━━━━━━━━

مجموعه‌ای از سورس‌های حرفه‌ای و پکیج‌های کاربردی برای فروش آماده است، از جمله:

• 🤖 سورس ربات آپلودر (Uploader)
• 💬 سورس ربات پیام‌رسان / پشتیبانی
• 🌐 سورس DDoS
• 🍯 سورس Honeypot
• 🛡 پکیج Bypass Shell Deface
• ⚙️ و ده‌ها سورس، ابزار و پروژه دیگر

✉️ برای دریافت لیست کامل یا خرید، به آیدی زیر پیام دهید:
@YourAnonBugCode

BugCod3

30 June 2026 21:33

📣 We're Looking for a Sales Partner!

We're looking for a reliable and motivated person to work with us on a commission-based partnership.

✅ Selling software subscriptions
✅ Selling VPS services
✅ Selling other digital services

Your income is commission-based, meaning the more you sell, the more you earn.

If you're interested or have sales experience, feel free to contact us via DM or the ID below.


📣 همکار فروش جذب می‌کنیم!

به دنبال فردی قابل اعتماد و فعال هستیم تا به‌صورت درصدی با ما همکاری کند.

🔹 فروش اشتراک برنامه‌ها
🔹 فروش VPS
🔹 فروش سایر سرویس‌های دیجیتال

درآمد کاملاً درصدی بوده و هرچه فروش بیشتری داشته باشید، درآمد بیشتری کسب می‌کنید.

اگر تجربه فروش دارید یا علاقه‌مند به همکاری هستید، از طریق دایرکت یا آیدی زیر پیام دهید.


🤖 T.me/BugCod3BOT

BugCod3

28 June 2026 15:44

🤖 Need a Custom Telegram Bot?

Looking for a Telegram bot with custom features?

I can build professional Telegram bots tailored to your needs, whether it's for:

- Management & Automation
- Shop Bots
- Payment Integration
- AI Features
- Security Tools
- Custom APIs
- And much more!

💬 Tell me your idea, and I'll turn it into a fully functional Telegram bot.

📩 Contact me to discuss your project and get a quote.

T.me/BugCod3BOT

BugCod3

26 June 2026 18:27

nRFBOX 📱

Open source ESP32 powered tool to scan, jam, spoof, and master BLE, Wi-Fi, and 2.4GHz networks 🤔

GitHub 💻

💎 @BugCod3
💎 @RootAccessClub

BugCod3

02 June 2026 23:33

EtchDroid 🤖

An application to write OS images to USB drives, on Android, no root required ⌨️

Github 🐱

#Iso #apk #android

📣 @RootAccessClub
📣 @BugCod3