https://teapawt.net/t.co/EyHi6O0p7e
Michigan
Joined May 2008
- Tweets4K
- Following132
- Followers420
- Likes238
SteveSchofield retweeted
My friend @lsanger just launched DeepDiveBible.org. It’s a free Bible study library with group tools built in: 10 translations side by side, the Hebrew and Greek a tap away, 31 classic commentaries, 220 maps. Check it out! deepdivebible.org
SteveSchofield retweeted
#otd in 1971 Bell Labs released the first Unix Programmer's Manual.
Download the free PDF here (third edition): shorturl.at/8NP0j
(v/@CoolSWEng)
SteveSchofield retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
SteveSchofield retweeted
Necesito que se manifiesten todos los que han visto alguna vez Starsky & Hutch (1975-1979)
SteveSchofield retweeted
Video of my @UnpromptedAU & Bsides Canberra talks out now
I built an autonomous N-Day exploit pipeline for the Windows kernel w/ mix of deterministic and AI-led stages. Results were comparable to what Anthropic achieved with Mythos using a much less powerful model.
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
SteveSchofield retweeted
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
SteveSchofield retweeted
一键反编译 Android 应用并逆向提取全套 HTTP API 的 AI 技能扩展：Android Reverse Engineering Skill 📱🔓
告别繁琐的静态分析，让 Claude 帮你秒级分析 APK/XAPK、恢复混淆类名并提取完整 API 接口与鉴权逻辑
👥 【适用人群】
适合需要快速逆向分析 Android 应用、提取第三方服务 API 接口、分析应用安全漏洞或重构代码逻辑的移动端开发者与安全研究人员
🎯 【核心 3 大杀手级功能与架构亮点】
1️⃣ 快速指纹识别与智能反编译：秒级检测 Flutter/RN 框架与混淆层，内置 jadx 及 Fernflower 引擎双向比对
2️⃣ Kotlin 混淆恢复与 API 提取：利用 Kotlin 元数据还原被 R8 混淆的 ViewModel/Repository 类名，自动提取 Retrofit/Ktor 接口与 HMAC 签名逻辑
3️⃣ 端到端调用流链路追踪：从 Manifest 页面交互层追踪至 ViewModel 并下钻到底层 HTTP 网络请求，透视完整架构
💡 架构亮点：采用跨平台 Shell 与 PowerShell 脚本封装底层 JADX 工具链，作为 Claude Code 插件无缝嵌入 AI 驱动的命令行逆向工作流
⚡️【极速安装与挂载指令】 在 Claude Code 中直接执行命令即可添加该 Skill：
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
⭐ Star 数：约 8.2k
🔗 开源仓库： github.com/SimoneAvogadro/an…
#Android #ReverseEngineering #ClaudeCode #JADX #APK #API #开源项目 #开发者工具 #安全工具
SteveSchofield retweeted
Bug Bounty Methodology with OpenCode CLI – Step by Step
1. Install OpenCode
curl -fsSL raw.githubusercontent.com/an… | bash
2. Clone the Bug Bounty Skills
git clone github.com/awarexone/Agentic…
cd Agentic-Bug-Hunter
./install_tools.sh
./install.sh --opencode
3. Start OpenCode and Check Skills
Run opencode then type:
do you have bug bounty skills?
4. Core Workflow
• Scope (never go out of bounds)
• Recon
• Hunt
• Validate
• Report
5. Run Recon
recon target.com/
(It handles subdomains, live hosts, crawling, and nuclei)
6. Hunt for Bugs
It covers IDOR, Auth Bypass, XSS, SSRF, Business Logic, SQLi, File Upload, GraphQL, and more.
7. Autopilot Mode (Optional)
autopilot target.com/ --normal
8. Generate Reports
After validating a finding,
type report to get a clean, professional report with CVSS, PoC, and impact.
Repo: github.com/awarexone/Agentic…
SteveSchofield retweeted
AI in Web3 Security: Build Your First Bug-Hunting Agent
Blog: 0xasen.xyz/build-your-first-…
Author: @asen_sec
SteveSchofield retweeted
I built an AI agent that hunts bugs while I sleep. It maps a target, tests the bug classes I care about, kills its own false positives, writes the PoC and pings me at midnight.
Step by step build in the article.
#bugbounty #hacking #cybersecurity
SteveSchofield retweeted
Stuck in bug hunting?
🐞 I wrote 15 simple tips that helped me go from “finding nothing” to understanding how real bugs are found. Recon, IDOR, logic bugs, report writing and more.
Read here 👇
medium.com/meetcyber/15-bug-…
#BugBounty #CyberSecurity #InfoSec
SteveSchofield retweeted
A krbtgt reset done twice, every admin password changed, and the attacker is a Domain Admin again an hour later.
AdminSDHolder is how. SDProp copies its access list onto every protected account and group every 60 minutes.
One entry written there by an attacker who held the domain gets put back on Domain Admins after every cleanup.
Nothing in that entry is a credential, so no password reset touches it.
Finding it means reading the directory before the logs. Compare AdminSDHolder’s access list with a copy taken before the incident.
Comparing it with the live template proves nothing, because an altered template agrees with everything below it.
That’s one lesson in SEC406 Defending Active Directory, which has just been updated.
Across 24 modules, each attack is followed to the evidence it leaves, the detection in Sentinel KQL, Splunk SPL, PowerShell and Sigma, the control that stops it, and the check that proves the control works.
The course ends with a Project: a whole domain compromise, worked from an evidence pack.
Module 0 is free; no account needed.
Link to the full course in the comments.
When did your team last compare AdminSDHolder against a known-good copy?
SteveSchofield retweeted
What AI model is best for hacking? I get the chance to geek out with @thewunderalbert & @edspencer and learn on the different hacking personalities models have.
SteveSchofield retweeted
One 6-hour run. One hackbot. 4 confirmed criticals. 17 confirmed highs.
@jhaddix breaks down how Arcanum built Armada - their in-house hackbot running on Claude Code - and every failure it took to get there.
Full talk is up. youtu.be/cRKToFkZMvk
SteveSchofield retweeted
Want to livestream an appsec tools tier list, what tools would you want ranked?
SteveSchofield retweeted
New Uncensored 27B cyber model that actually fits on for Red teamer locally.
- OrcaSAQ-2 Cyber 27B Uncensored GGUF
- Zero refusal for payloads generation
- Made for defensive red teaming, vulnerability research, security coding,
- and authorized testing without sending source, logs, or findings to someone else’s API.
- terminal workflows
- 94.4% Top-1 agreement and 262K context.
- DFlash2 speculative decoding
this is the smallest serious cyber model in this class.
SteveSchofield retweeted
AI Skills for Bug Bounty
Skills can make your model give better results. Best skills are built by studying real bug reports that people actually got paid for on HackerOne.
We covered some of them
hackers-arise.com/artificial…
SteveSchofield retweeted
50 legendary internet rabbit holes you can spend hours exploring👇
1. zoom.earth — Watch the world via live satellite imagery
2. flightradar24.com — See every plane currently in the sky
3. marinetraffic.com — Track all ships at sea in real time
4. windy.com — Live map of winds and storms
5. lightningmaps.org — Watch lightning strikes hitting Earth in real time
6. earthquake.usgs.gov — Live list of recent earthquakes
7. submarinecablemap.com — Ocean cables carrying the internet
8. globalforestwatch.org — Watch forests disappear from space
9. worldometers.info — The world's statistics, second by second
10. internetlivestats.com — Current number of tweets and searches being posted
11. thetruesize.com — Compare the true sizes of countries
12. oldmapsonline.org — Maps from centuries ago
13. davidrumsey.com — Archive of 150,000 historical maps
14. openstreetmap.org — World map drawn by volunteers
15. window-swap.com — Look out the window of a random person around the world
16. virtualvacation.us — Virtual walks through cities
17. mapcrunch.com — Teleport to a random spot on Earth
18. atlasobscura.com — Catalog of the world's strangest places
19. neal.fun — Interactive knowledge experiences
20. htwins.net/scale2 — Scale journey from atom to universe (Updated HTML5 link)
21. eyes.nasa.gov — Explore the solar system in 3D
22. stellarium-web.org — Real sky map in your browser
23. apod.nasa.gov — NASA's astronomy picture of the day
24. images.nasa.gov — NASA's entire visual archive, free
25. pudding.cool — Visual articles told through data
26. ourworldindata.org — The state of the world with real data
27. gapminder.org — What we mistakenly think we know about the world
28. informationisbeautiful.net — Visualizing complex data
29. data.worldbank.org — World Bank's open data
30. data.tuik.gov.tr — Turkey's official statistics database
31. archive.org — Archive of millions of books, films, and software
32. gutenberg.org — 70,000 free books whose copyrights have expired
33. openlibrary.org — Record of every book in the world
34. loc.gov — U.S. Library of Congress digital archive
35. europeana.eu — Europe's cultural heritage archive
36. dp.la — America's digital library collection
37. artsandculture.google.com — Tour museums from home
38. rijksmuseum.nl — Download artworks in high resolution
39. wikiart.org — Archive of 250,000 artworks
40. publicdomainreview.org — Forgotten visual treasures of history
41. openculture.com — Free archive of culture and education
42. metmuseum.org — Met Museum's open collection
43. musicmap.info — Family tree of music genres
44. radiooooo.com — Pick a country and decade to listen to that era
45. listen.hatnote.com — Turn Wikipedia edits into audio
46. wikipedia.org — Random knowledge well
47. timeanddate.com — Time, sunrises, and sky events
48. sciencedaily.com — Live stream of science news
49. arxiv.org — Free preprints of scientific papers
50. observablehq.com — Visualize data with live code
Save this. You’ll definitely need some of these later. 🔖
Follow @Amelia_With_Ai for more useful websites, AI tools & tech resources.