Product Manager @ Google. I post about bug bounties, infosec, and everything in between. This is a personal account. Formerly: @Hacker0x01
Joined September 2012
- Tweets 1,499
- Following 755
- Followers 12,634
- Likes 4,189
115 Photos and videos
Pinned Tweet
4 Sep 2020
Just fully disclosed ~30 reports encompassing over two years of hacking on New Relic - hackerone.com/jon_bottarini - most of the reports are PrivEsc/IDOR but there are some business logic bugs in here as well. No recon here! Just getting really familiar with the application itself :)
19
166
596
Hacking Google with A.I. for $500,000
brutecat.com/r/hacking-googl…
59
501
2,465
325,502
Jon Bottarini retweeted
6 Dec 2025
Vercel's (@vercel) bug bounty program is now live on HackerOne—up to $50k for finding WAF bypasses 👀
hackerone.com/vercel_platfor…
5 Dec 2025
DM’d you. You have a working repro for bypassing Cloudflare but not Vercel. Would love to correct the record or see the evidence.
5
17
252
48,465
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
138
903
3,186
475,304
Jon Bottarini retweeted
3 Sep 2025
Facebook Messenger Remote code execution Worth a $111,750
Video Poc Here: youtube.com/watch?v=wvywPUdT…
Report:
vulnano.com/2025/09/remote-c…
@Google @intigriti
2
80
488
28,157
Jon Bottarini retweeted
6 Aug 2025
The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com/
19
241
749
86,378
New writeup:
Early last month, @samwcyo, @sshell_, and I found a Django ORM injection in an online shooter game that let us steal cryptocurrency from the game's wallet.
Read the blog post here:
blog.p1.gs/writeup/2025/07/0…
36
77
267
19,967
Leaking the phone number of any Google user
brutecat.com/articles/leakin…
124
180
976
81,632
2 Apr 2025
Entire confession is absolutely wild. Talk about an insider threat risk...
2 Apr 2025
Deel CEO and company founder @Bouazizalex personally orchestrated his company’s alleged spy scheme, the spy said in a full confession
Alex allegedly recruited the spy, received the stolen info, and arranged payment via a person known only by their pseudonym: “The Watchman”
2
1,061
Disclosing YouTube Creator emails via Content ID for $20,000
brutecat.com/articles/youtub…
11
66
383
23,808
Leaking the email of any YouTube user for $10,000
brutecat.com/articles/leakin…
20
142
875
63,733
New blog post with @infosec_au:
We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely.
The issue was reported and patched.
Full post here: samcurry.net/hacking-subaru
47
312
1,027
118,252
Jon Bottarini retweeted
11 Oct 2024
1 Bug, $50K in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
gist.github.com/hackermondev…
74
336
1,326
2,022,546
Jon Bottarini retweeted
11 Oct 2024
Hey this was my bug! Thanks to Doppa for digging in and writing such a detailed post PoC!
10 Oct 2024
Analyst CVE-2024-8698 on KeyCloak - huydoppa.hashnode.dev/analys…
2
16
4,493
Jon Bottarini retweeted
26 Sep 2024
Attacking UNIX Systems via CUPS, Part I
evilsocket.net/2024/09/26/At…
175
1,119
3,612
1,059,725
Seems like it's in CUPS. GL;HF
github.com/OpenPrinting/cups…
Alright yall who's ready for Eternalblue: Linux Edition, dropping October 6?
10
34
448
263,541
New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate.
Full disclosure:
samcurry.net/hacking-kia
86
973
3,545
344,286
11 Sep 2024
Nation state behavior but you only have $20 - Taking over the mobi TLD WHOIS server: labs.watchtowr.com/we-spent-…
9
52
4,003
Jon Bottarini retweeted
29 Aug 2024
In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found.
Here is our writeup:
ian.sh/tsa
51
624
2,201
188,598
30 Jul 2024
Absolutely massive $500k bounty just awarded by @coinbase to @CertiKSkyfall - wow!
16
31
515
41,706
7 Jul 2024
This... Just creates a WordPress user with the name "admin"... There is no vulnerability here. This could only be an issue if the site is configured to set every new user role as an Administrator but that would be exceedingly rare and it wouldn't matter what your username is.
2
1
33
7,010