Heckr | Former Community Manager @InfoSecComm | eJPT | Certified Red Team Professional (CRTP)
DM for Collaborations
Joined March 2018
- Tweets9.4K
- Following620
- Followers19.6K
- Likes4.7K
THEBINARYBOT'S GUIDE TO API HACKING IS AVAILABLE NOW FOR SALE !!!
Learn and find different API-related vulnerabilities such as:
-BOLA
-BOFA
-SSRF
and more...
Use code "thebotswarm" to get the product for just $5. Valid till 6 Mar.
#bugbounty
thebinarybot.gumroad.com/l/a…
"DeepSeek API now supports web search and fetch, charged at $0.75 per 1000 successful requests"
BRUH 🙂
Nithin 🦹♂️ retweeted
Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( 🤯
blog.faav.net/how-i-couldve-…
Great find by @efaav, a talented 15 y.o. researcher!
Nithin 🦹♂️ retweeted
Quick tweet. Cybersecurity on the offense side, even with what Anthropic released today will be still a heavily restricted models and never the best.
For offense, your only choice is open weight models. I would not rely on frontier models for offensive research.
Invest in hardware or solutions that allow you to use hardware infrastructure as a service.
It will pay dividends.
In stating that, if you can get access to special programs as an organization/company - this is also an incredible option if approved through.
Nithin 🦹♂️ retweeted
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
Nithin 🦹♂️ retweeted
We burned 11.7bn tokens to find the best cyber AI model - @AikidoSecurity
aikido.dev/blog/ai-model-ben…
Cloudflare is high-key THE internet atp
Introducing "cf", an agentic CLI for the entire Cloudflare API.
You can do nearly anything. Even buying a domain is incredibly simple from the CLI.
Don't know what command you need? Run `cf cli search "look at messages stuck in my queue"` and it will return a list of relevant commands.
blog.cloudflare.com/cloudfla…
Nithin 🦹♂️ retweeted
Flirting: wiz.io/blog/wiz-research-cod…
Harassment: hacktron.ai/blog/hacking-ope…
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement).
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
Nithin 🦹♂️ retweeted
Hacktron founder @S1r1u5_ says Claude Code didn’t hack OpenAI on its own, it took a human who had already found a Discord zero-day to know where to look:
"Everyone has the same Claude Code. It doesn't mean that they'll be doing this. My mom can have Claude Code, that doesn't mean she will start hacking now."
"@rootxharsh has a pretty good understanding of OpenAI infrastructure, and he previously found a zero day on Discord, the bug we exploited in the third party. That kind of intuition and previous understanding pointed him at the target."
"It's not like go hack OpenAI would make Astra find this kind of vulnerability. Model capabilities are not there. You still need to organize them, hand hold them, point at the right things."
"Probably GPT-8 doesn't need that. But GPT-6 or GPT 5.6, they're not there. You can't just give a long-running task which runs for six months where your goal is to hack OpenAI."
@HacktronAI
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
Nithin 🦹♂️ retweeted
Today we are releasing a 1 page version of “Hacking Your Career”
arcanum-sec.github.io/hyc/
We get a bunch of students and early career-seekers looking for resources and advice of getting their 1st gig.
This resource gives all those and more; free trainings, free certificates for your résumé, advice on résumé design, information on career verticals, small sections on interviewing and the hiring process, and more! 🫶🫶
Pretty much like Anthropic's. Fortunately my application to the verification program was accepted early on but still there's model level guardrails for the likes of fable (cough mythos) but same workflow works fine in Opus
🔥🔥🔥
📢📢📢 Attention bug hunters!
Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage?
If yes, check out his blog post 👇
bughunters.google.com/blog/b…
Nithin 🦹♂️ retweeted
What I'm learning on Twitter is that most people in cyber never did any actual cyber. 🤡
