Pentester | Perpetual Student
Joined July 2018
- Tweets1.5K
- Following632
- Followers248
- Likes8.8K
HotPlugin retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
HotPlugin retweeted
This is the first HIGH severity curl vulnerability in years. It is cool, but take note of the report format. This is the level of detail you should aim for when disclosing vulns hackerone.com/reports/403033…
HotPlugin retweeted
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
HotPlugin retweeted
Whoever created this, huge respect.
webhacklist.com/
HotPlugin retweeted
Frappe 16.18.3 / ERPNext 16.19.1 SSTI to OS RCE - TableBasse, Midfirewear & @TheLaluka
thinkloveshare.com/offenskil…
HotPlugin retweeted
Absolutely incredible research by @garethheyes
One email, two readers.
:before and :after inject text into the page. An AI browser reading the message does not see that text.
opacity:0.00000001 does the reverse. The victim cannot read the element, but the AI browser can.
Read CSS:the bomb inside your inbox by Gareth to learn more 👇
portswigger.net/research/css…
HotPlugin retweeted
Where is AI useful in offensive security today?
Our latest research covers analysis, tool development, vulnerability discovery and reporting, plus what still fails and how offsec teams can adopt AI in their workflows.
Read more from @ne0nd0g ⤵️ ghst.ly/4hqiS7Y
HotPlugin retweeted
Hello, Little People Living Inside My Computer,
I have made a YouTube account to discuss malware reverse engineering and development. It will primarily target noobs. It will be lighthearted, poorly produced, and spontaneous.
youtube.com/@MalwareForFun
HotPlugin retweeted
Automated tools are great, but chaining them with manual enumeration is how you get root. 🔍🛠️
If you are currently studying for your OSCP (ahem, now is the time to register for Hack Track) or just want to level up your Linux Privilege Escalation skills, check out our newest video walkthrough. We demonstrate exactly what to do after you get that initial www-data shell.
Key takeaways from this session:
🔊 Managing Noisy Tools: How to use the timeout command to run pspy efficiently without locking up your terminal.
⛰️ Leaving No Stone Unturned: Why reviewing processes reveals credentials (like a rogue MySQL dump) that standard checks might miss.
🛑 Exploiting Misconfigurations: How finding a writable app .py script with sudo execution rights allows for a simple OS module injection to spawn a root shell.
Stop guessing and start enumerating. Watch the full breakdown here: bit.ly/4xFQzZq
#Linux #PrivilegeEscalation #OffSec #RedTeam #OSCP #CyberSecurityTraining #TryHarder
HotPlugin retweeted
Local AI for Penetration Testing & Research - Eddie Zhang
projectblack.io/blog/local-a…
HotPlugin retweeted
"3 random dudes”
1. hacked apple, again and again.
httpvoid.com/Apple-RCE.md
httpvoid.com/Hello-Lucee!-Le…
httpvoid.com/Hacking-Apple-w…
2. your github enterprise is our github enterprise.
httpvoid.com/GitHub-Enterpri…
3. get a discord message from me, get pwned.
hacktron.ai/blog/discord-rce
youtube.com/watch?v=R3SE4VKj…
4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research.
media.defcon.org/DEF%20CON%2…
5. your supabase database is my database.
hacktron.ai/blog/supapwn
6. we got the posthog prod database.
hacktron.ai/blog/posthog-rce
7. react2shell? vercel paid us $170k for helping secure their waf.
hacktron.ai/blog/react2shell…
8. your palo alto vpn is my vpn.
hacktron.ai/blog/cve-2026-02…
9. ai ides? we got shells for you, antigravity
hacktron.ai/blog/hacking-goo…
10. windsurf rce.
youtube.com/watch?v=23Mz7qcR…
11. turning cluely into malware.
hacktron.ai/blog/hacking-clu…
12. ai browsers? sure, uxss: your perplexity browser is my browser.
hacktron.ai/blog/perplexity-…
13. openai atlas too. kinda uxss
hacktron.ai/blog/hacking-ope…
14. hey, it’s not even our first time hacking discourse.
projectdiscovery.io/blog/dis…
15. adobe coldfusion: pre-auth rce. because apparently we needed another one.
projectdiscovery.io/blog/ado…
there’s a lot more. go dig.
anyway, yes: “3 random dudes.”
and @HacktronAI is full of more random dudes like these.
HotPlugin retweeted
Here is a video covering the technical side in more detail:
How OpenAI got hacked with an image
youtu.be/gjHh9g7yo9Y
A bug-hunting independent security research team used Anthropic’s Claude software to gain access to an OpenAI employee’s ChatGPT account, giving them a way to read and suggest changes to the company’s private cache of software. on.wsj.com/4h8vaBP
HotPlugin retweeted
This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob.
We have published the full details of the exploit chain, as well as how we discovered it, on our blog here:
hacktron.ai/blog/hacking-ope…
HotPlugin retweeted
Today we are releasing a 1 page version of “Hacking Your Career”
arcanum-sec.github.io/hyc/
We get a bunch of students and early career-seekers looking for resources and advice of getting their 1st gig.
This resource gives all those and more; free trainings, free certificates for your résumé, advice on résumé design, information on career verticals, small sections on interviewing and the hiring process, and more! 🫶🫶
HotPlugin retweeted
📢📢📢 Attention bug hunters!
Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage?
If yes, check out his blog post 👇
bughunters.google.com/blog/b…
HotPlugin retweeted
17 jobs across 5 industries.
Failed 3 businesses (on my 4th).
Made $780k in the last 4 years.
Planning to make $ Ms soon.
For every success, the formula was the same:
- Show up every day.
- Do what you know you should do.
- Don't give up.
Simple right? But very difficult to do.
For every failure, the same reasons appeared:
- I showed up, but not every day.
- I did the work. Most of the days. Well at least, enough to not feel guilty.
- I convinced myself that the opportunity wasn't there, that the market isn't ready, that I was to late, etc..
Agency & Consistency.
That's all you need.
No secret sauce.
No AI hack.
Just grit.
HotPlugin retweeted
This technology is so fascinating, and even the ones building it fail to contain it rubyhack.ai/
HotPlugin retweeted
This could be a good argument why AI is great for defenders and white-hat hackers.
Anthropic and OpenAI have a crazy surveillance apparatus logging every single step of your work (major problem for freedom and privacy of course lol)
I think we don't see too many threat actors using AI right now, because this discourages criminals to use it (at least until the open models are good enough and infrastructure is built for them).
So if you conduct good-faith bug hunting. You have "nothing to hide" :P And if there ever was a question whether you acted maliciously or not, you can basically proof it through your Codex/Claude logs.
The privacy implications are insane. And it's good we have regulations like GDPR in the EU to demand deletion of records etc.
But I think for the very small (professional) group of people who enjoy hacking companies, and want to do it in a legal safe way, we could allow it under the surveillance of AI :P
anthropic.com/threat-intelli…
HotPlugin retweeted
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
HotPlugin retweeted
How your out-of-office auto-reply can lead to account takeover 👇
#BugBountyTips #HackWithIntigriti
