Caido Ambassador, Hunting and Instagram

public
4 min read
Caido Ambassador, Hunting and Instagram

Table of contents

New week still in Tokyo, my last one here before coming back to France. I'm quite happy to go back to France, find my routine, friends, and stuff. But this month in Asia was gorgeous.

I also got some very good news, and I'm happy today to share with you that I'm a Caido Ambassador.

Caido Ambassador

As I've been using this tool since the beginning, I've always loved using it, and the simplicity of it, that I shared my experience here on my blog.

And I asked them if I could join as an Ambassador to promote the project. I got accepted, and I'm now part of the team and very happy about it.

With this role, I will continue to share stuff about Caido and help people use it. And I will be present at hacking conferences to share it, mostly in Europe and France.

I'm very happy to be able to help his project grow. It's very great to have different projects and stuff to work on. This way can choose day by day what I really want to work on.

Hunting

It's the last two months of 2025, and I still need to work a bit to achieve my yearly goal. And also because I love spending my money on travel and useless stuff, so I also need to cover my back as usual.

I'm mostly hunting on HackerOne, and it's going pretty well. I came back on a private program of an app I'm using every day. I found it way better to hunt on the app you're really using.

As I'm already a client, I pay for the app, and I know most of the features. I know the business model, where it's important to look at and what can be impactful. On the other hand, when looking at a totally random app, at first, you will just try to find every possible bug, even if you don't know if it's impactful for this app in particular.

So, I found a couple of bugs on this target, but I know that they are pretty long to answer and it will take a minimum of a month or two to be paid, but well, that's the game unfortunately.

Instagram

This morning, I woke up and got an email from Instagram telling me that my private account was suspended. I didn't understand why, and what I did to achieve that, except for posting random Japan stories.

So I was unable to log in and check my account. I contacted them, tried to recover it, and a few hours later, I finally got back to my account. I still don't know why they suspended my account.

I checked on the internet, and a lot of people got this message as well, and sometimes, they are totally unable to get back to their accounts, which is crazy.

And it made me think about something important. We are totally blind about everything and closed to them. And as our accounts are on their server, we can be banned and lose everything. That's the case for Instagram, but it can be the same for YouTube, X, Discord, or anything else.

It's crazy how our lives and our data are not really our property in the end. So it reminds me to make backups of most of my stuff and start self-hosting some stuff I use. Sometimes it's way convenient to use apps, but having a backup can be more than useful in those cases.

Now that I have a nice NAS at home, I need to use it more and save stuff myself.

Articles

As a lot of you asked me to share some articles I read this past week, here they are :

  • Another very interesting research from zhero
Astro framework and standards weaponization
CVE-2025-64525
  • The report from Anthropic about an attack that used Claude Code
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing an a highly sophisticated AI-led cyberattack
  • A very well-written and interesting post about bug bounty in general from zhero, too
Bug bounty, feedback, strategy and alchemy
Honey attracts bees, and like many others who occasionally share moments of success, I often get asked recurring questions about bug bounty hunting: how I got started, what advice I’d give, what roadmap to follow, and so on. I figured it might be worthwhile to put some of my thoughts, experiences, and perspectives into writing for anyone curious about the subject.
  • An article about a client-side technique to leak data from iframes
AuxClickjacking
In this small and fun research, I will show how I developed a Clickjacking technique that leaks iframe contents by prompting the user to perform a click and drag + middle mouse button (wheel) click. I’m not sure if it’s already being exploited, but f…
Aituglo

Aituglo

Paris
The author of this blog, a bug bounty hunter and security researcher that shares his thoughts about the art of hacking.