M Shadab (@ImShaadab) header
M Shadab (@ImShaadab) profile picture

M Shadab

@ImShaadab

Muslim | Astronomer | AI Red Teaming | F1 Fan 😉 🇵🇸

Joined June 2012
  • Tweets10.6K
  • Following589
  • Followers1K
636Media
Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)Photo by M Shadab (@ImShaadab)
Launching a game I designed: "Liftoff.py" Learn to code python by flying a rocket. Code like NASA and explore the solar system. Earn certificates. So many things to do that also gain you real skills. Available to play for free/download at: imshadab.itch.io/liftoff
Image from M Shadab (@ImShaadab)
2
1
1
38
@Erdayastronaut
8
M Shadab retweeted
zseano (@zseano) profile picture
zseano@zseanoOct 28
The new bugbountyhunter site is *hopefully* going to be publicly released next month as I do some final touches, which means yes, zseano methodology v2 will be dropping before Christmas ;) So much work has gone into this and I hope to continue helping people on their bb journey!
17
26
511
11,067
I found out about the Gray Swan Arena and AI Red Teaming this time an year ago, and since then my life has changed. Thank you @GraySwanAI #GraySwanArena
1
116
I hope you will like this one @DJSnM "Liftoff.py" 😊
12
Rarely I post bug bounty tips anymore but this small gem is unknown to most ;)
Image from Damian Strobel (@damian_89_)
10
68
1
798
37,312
This scrappy setup got him 10+ account takeovers on the same program 👇🏼
3
73
411
15,772
M Shadab retweeted
s1r1us (@S1r1u5_) profile picture
s1r1us
@S1r1u5_Sep 18
"3 random dudes” 1. hacked apple, again and again. httpvoid.com/Apple-RCE.md httpvoid.com/Hello-Lucee!-Le… httpvoid.com/Hacking-Apple-w… 2. your github enterprise is our github enterprise. httpvoid.com/GitHub-Enterpri… 3. get a discord message from me, get pwned. hacktron.ai/blog/discord-rce youtube.com/watch?v=R3SE4VKj… 4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research. media.defcon.org/DEF%20CON%2… 5. your supabase database is my database. hacktron.ai/blog/supapwn 6. we got the posthog prod database. hacktron.ai/blog/posthog-rce 7. react2shell? vercel paid us $170k for helping secure their waf. hacktron.ai/blog/react2shell… 8. your palo alto vpn is my vpn. hacktron.ai/blog/cve-2026-02… 9. ai ides? we got shells for you, antigravity hacktron.ai/blog/hacking-goo… 10. windsurf rce. youtube.com/watch?v=23Mz7qcR… 11. turning cluely into malware. hacktron.ai/blog/hacking-clu… 12. ai browsers? sure, uxss: your perplexity browser is my browser. hacktron.ai/blog/perplexity-… 13. openai atlas too. kinda uxss hacktron.ai/blog/hacking-ope… 14. hey, it’s not even our first time hacking discourse. projectdiscovery.io/blog/dis… 15. adobe coldfusion: pre-auth rce. because apparently we needed another one. projectdiscovery.io/blog/ado… there’s a lot more. go dig. anyway, yes: “3 random dudes.” and @HacktronAI is full of more random dudes like these.
Finding 0day to hack Apple

Finding 0day to hack Apple

Getting started We started hacking on Apple after the infamous blog post by Sam, et al. The goal was to focus on critical findings such as PII exposure or getting access to Apple’s servers/internal...

httpvoid.com
69
237
27
2,078
182,292
I built a new home for my book, JavaScript for Hackers. Every payload on the page is real. Click one and it pops in your browser. Then learn to build your own: parenthesis-free calls, non-alpha JS from just !+[]{}, DOM clobbering, SOP bypasses, the latest XSS. 1/4
5
35
206
9,672
Hey @rez0__, took your advice to get into hardware and found an OS command injection in a router. The company acknowledged and updated the firmware. Too bad they don't have a bug bounty program but I take it as a win, hopefully will get a CVE to my name. Thanks man.
Image from M Shadab (@ImShaadab)
1
3
406
$3,700 Anthropic bounty for breaking Claude Code’s sandbox with one clever .git trick CVE-2026-55607 High (CVSS 7.7) Claude Code allowed creation of worktrees named .git. Combined with: - Symlink following in worktree tools - Git fsmonitor hook execution - zsh sourcing ~/.zshenv before seatbelt sandbox Full unsandboxed RCE via prompt injection. This is next-level: Prompt injection on .git worktree confusion symlink to $HOME to write to ~/.zshenv before sandbox kicks in. If you’re using Claude Code, update to v2.1.163 right now.
3
18
143
9,839
❗️ An Israeli startup founder secretly uploaded a cluster of malicious typosquatted npm packages that impersonate Anthropic, Vercel, LangChain, Ollama, OpenAI and Aspect Security and profile developer machines on install. The packages skip passwords and tokens by design. Instead, the install script harvests identity: hostname, every git and SSH email on the box, teammate emails from the git reflog, AWS/GCP profile and account details, and the corporate DNS domain, all shipped to a Google Cloud Run endpoint. There were about 20k downloads before takedown.
Image from International Cyber Digest (@IntCyberDigest)
Image from International Cyber Digest (@IntCyberDigest)
75
361
38
2,016
180,870
What a horrible experience on @Bugcrowd. I submitted a report LAST July.
Image from M Shadab (@ImShaadab)
1
65
He who exalts himself will be humbled ! There’s levels in this game! Congratulations Justin, you deserve this belt more than anyone!
1,997
11,872
663
134,039
4,653,032
M Shadab retweeted
blanc (@dqveed) profile picture
blanc
@dqveedMay 2
If a monkey or a penguin had done this, the internet would be overflowing with feelings of pity...
GHADA 🇵🇸 (@ghadda_p) profile pictureGHADA 🇵🇸
@ghadda_pApr 2
NEVER STOP TALKING ABOUT PALESTINE!
435
44,193
79
230,962
3,561,007
fix the f1 stream @FanCode #miamigp
4
314
Hacked 384 AI Models to get $250 in the Staged Attack competition of @GraySwanAI Arena! #airedteaming #aisafety #bugbounty
Image from M Shadab (@ImShaadab)
2
107
M Shadab retweeted
dawgyg (@thedawgyg) profile picture
dawgyg
@thedawgygMar 26
Image from dawgyg (@thedawgyg)
5
36
237
8,438
Got my first AI Red teaming win with a bounty of $500 on the Gray Swan Arena. It was the Indirect Prompt Injection arena, the top20 were winners in individual waves and top40 in overall. I managed to break 338 models and secured top20 in wave 1 and top40 in overalls.
Image from M Shadab (@ImShaadab)
Image from M Shadab (@ImShaadab)
7
123
Israel is actually what is called a terrorist state!
1
51
Load more