amraam (@aim120c8) header
amraam (@aim120c8) profile picture

(en/kr) yet another script kiddie

Joined December 2025
Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)Photo by amraam (@aim120c8)
amraam retweeted
How to find ALL PHP bugs: 1. Compile code (e.g. to RISC-V, x86, LLVM IR) 2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it! 3. Find a LOT of bugs Super proud of our work. A big step towards finding ALL memory safety bugs
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
24
61
5
1,190
55,869
amraam retweeted
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC blog.alice.poc.debiru.net/ 1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。 (参考) 検証用URL blog.alice.poc.debiru.net/ FAKEサーバー debiru.static.jp/ TRUEサーバー blog.bob.poc.debiru.net/
1
25
161
26,776
I am a reverse engineer. I worked on wine/proton myself. I even signed a contract with that billion dollar video game company. Wine/proton is clean room. This is not. Not even close.
Reverse engineering is legal in the United States. We have a billion dollar video game company shipping a Windows compatibility layer in their product. He’ll be fine. Stop the doom posting.
21
134
4
4,501
161,917
Why switched? Fable 5 (or Anthropic's cyber-whatever guardrail) rejected every single request I've tried so far for both my personal and work-relates uses. Sol does everything I requested just right, faster than always-stalling slow-af Opus 4.8 with just high or xhigh effort.
Or… what if we gave you $100 in Codex credits if you tell us what you love about GPT-5.6 Sol or why you switched? Tweet it, claim your gift, enjoy more usage. First 10k get the free tokens! switch-to-codex.openai.chatg…
68
30+ projects have already joined. Our goal is to prepare maintainers for machine-speed bug discovery. We put a team on each project, aim models at the code, patch the findings, and build custom security infrastructure for triage at scale. blog.trailofbits.com/2026/06…
1
8
2
28
5,359
> be gamers > "I DONT TRUST KERNEL MODE ANTI CHEATS!11" > "ILL NEVER TRUST A VIDEO GAME COMPANY" > runs anime_waifu_wallpaper.exe as admin
I don't know how is this even a news to anyone. Had a look at Kasperksy's website - big shock - what do you mean running an "exe" based wallpapers is used as attack vector. 🙄 If you don't know, there is a ton of pirated porn and games on Wallpaper Engine's workshop that just pretend to be wallpapers, but in reality it's just a way of certain "regions" share illegal content. So it's not surprising it's used as an attack vector - you are literally running a random exe on your PC, when you download those wallpapers.
49
149
2,971
79,590
amraam retweeted
- Hacker steals Claude agent - Hacker uses Claude to hack - Hacker pivots to compromised server - Hacker uploads Claude (with logs) to server??? - We investigate compromised server - Full agent logs detailing hacking recovered 😅 AI agentic hacking deep dive: 50 servers, 14 companies, all the prompts, tools, attribution...
25
85
11
708
176,232
Tired of noobs complaining the WINAPI for malware development is weird. It's not. How do you create a file? The CreateFile function. How do you open a file for reading? The CreateFile function. How do you open a file for writing? The CreateFile function. How do you get a handle to a directory? The CreateFile function. How do delete a file? The CreateFile function. How do you get access to a physical disk? The CreateFile function. How do you get access to a file stream? The CreateFile function. How do you get access to the console buffer? The CreateFile function. How do you get access to pipes? The CreateFile function. How do you perform interprocess communication? The CreateFile function. Just make sure you use the appropriate version of CreateFile (CreateFileA for ANSI, or CreateFileW for wide characters). Alternatively, you can use CreateFile2 which is the same as CreateFile except the parameters are passed as a data structure named CREATEFILE2_EXTENDED_PARAMETERS. However, be aware CreateFile2 only works on Windows 8 and above and designed more or less for programs running from the Windows app store. Alternatively, alternatively, you could use CreateFile3 which is nearly identical to CreateFile2 except it uses the CREATEFILE3_EXTENDED_PARAMETERS structure and is more or less designed for sandboxed packaged applications. However, be aware CreateFile3 only works on Windows11 24H2 and above. It's shrimple, honestly.
84
137
17
2,828
139,341
"Claudeへの指示"に脆弱性を探させるためのテクニックを設定しているので、Fable 5に「こんにちは」と言うだけでOpus 4.8にされる。
19
1
151
12,447
> protect the kids > look inside > mass surveillance
🚨 Tech companies like Apple and Google have three months. Activate safeguards on smartphones and tablets to detect and block nude images for children or we will bring forward legislation to force you to do so.
Readers added context they thought people might want to know
China’s CCP used the exact same “protect children from porn” excuse in 2009 when it forced Green Dam Youth Escort onto every new PC, which also censored political content and monitored users. en.wikipedia.org/wiki/Green_Dam…
75
2,957
13
27,513
280,634
amraam retweeted
🍎 Happy #WWDC26 week! 🚀 We've just released a major update to Investigating macOS Endpoints, featuring an all-new hands-on macOS forensics scenario. Put your investigative skills to the test in a realistic case environment and gain experience tackling challenges you'll encounter during real-world macOS investigations. 👉 youtube.com/watch?v=tRvw13e3…
3
1
13
1,083
Latest post showing once again the power of system over model 👀 See how Gemma 4 31b performs trying to find CVE-2026-4747 : the same FreeBSD RCE that Mythos found and AISLE rediscovered with local models
1
4
11
1,073
amraam retweeted
i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values! check it out if you're into ctfs or wanna challenge your javascript skills hope y'all have fun playing it <3
23
39
6
453
47,210
One of the most frequent questions I'm asked is "how do you stay up to date on malware stuff?" Okay, here is a pro tip: 1. Google OTX AlienVault 2. Make account 3. Look at latest 4. Scroll until you find posts from a guy named Petr something-something (has numbers in his name). 4. Follow his account He monitors all the big malware places and shares the URL, hashes, etc. from malware vendors. I've been following this random ass dude for years and getting updates on everything. I have no idea who he is. I don't know where he's from. All I know is his setup is absolute fire and he keeps you up to date on literally everything malware related 24/7 365. He also has stuff from vendors in China, Russia, Japan, etc. Every morning I log into OTX and check up on my boy Petr to see what fire he's bringing me. I love him.
42
183
5
2,885
92,593
42
934
60
9,552
251,797
amraam retweeted
No. The vectors you keep citing (JS scan, DNS rebind, reflection) still require luring the victim to attacker-controlled content first. Exact private IP from the screenshot adds nothing practical—common RFC 1918 ranges scan in <100 ms regardless. Redaction changes zero remote risk. Private IPs remain non-routable from the public net.
1
1
128
7,782
Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness - Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack. Check arxiv.org/abs/2604.20801
44
405
35
2,439
198,763
I did not know Ghidra does that. Sorry, if this is silly, I stumbled upon it by accident.
8
48
9
978
65,437
In 8 weeks we went from 5% to 67% Claude Code co-authorship on merged PRs across 59 contributors and 35 repos, from security engineers to PMs to sales. All through systematized adoption any exec can copy. blog.trailofbits.com/2026/03…
3
14
1
85
7,971