Pinned Tweet
Hello all security enthusiasts!
During a recent security assessment for a private client, I came across a potential cross-site scripting (XSS) vulnerability that I wanted to share with you.
1/n
#security #cybersecurity #penetrationtesting #informationsecurity #bughunting #xss
Shebiiiii retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
Shebiiiii retweeted
🔥 Want to learn AI Red Teaming for FREE?
AI Red Team Academy offers 60+ hours of learning across 8 modules, with hands-on Docker labs.
Explore prompt injection, RAG attacks, AI supply chains, multi-agent exploitation and more.
🔗 0x4d31.github.io/airt/
Shebiiiii retweeted
Bug Bounty Tip:
Don't overlook JSON parameters like column.
A simple customerName::int error led to a confirmed SQL Injection. 👀
#BugBounty #SQLi
Shebiiiii retweeted
Yesterday, I spent six hours teaching the fundamentals of harness engineering at @unpromptedconf with @GrahamHelton3. We only planned for a single 12-person workshop, but ended up teaching two separate sessions of 20+ people each.
Shebiiiii retweeted
In this article, I break down how I built OSA, the architecture behind it, the tools I use, and the lessons I’ve learned along the way.
Shebiiiii retweeted
I detected SSRF in an external request in an Android app using the Intent.getSelector() (SEL) bypass. I did this with my custom AndroScope tool, which I've been developing for 3 years. If you're curious about what AndroScope is, visit: ynsmroztas.github.io/androsc…
I haven't made it publicly available yet, but I will be sharing it in a limited way soon 🌹🥳🥳
#BugBounty #InfoSec #android #AppSec #bugbountytip #bugbountytips #infosec #recon
Shebiiiii retweeted
A few bypasses that keep working for me in hunts. There are huge lists out there, but these are my go-to checks:
1 - Edge vs. router path drift
/api;/v1/..., /admin/./, /API/..., or a trailing / on a 403. The proxy and the backend parse paths differently.
2- Fake static extensions
/api/users/123.photo or file.docx.pdf. WAFs and bot managers like DataDome often treat these as static media and wave them through.
3 - GraphQL comment prefix
#x\nmutation { ... } gets past gateways that regex-block anonymous mutations.
4 - Pre-MFA surface swap
Log in with the password, stop at the 2FA screen, then send that session to /graphql or /connect/token (grant_type=password). Not every endpoint checks that MFA finished.
5 - Case-varied JSON keys
suppliername write-blocked by RBAC? Send Suppliername. The authz check and the deserializer don't always agree.
6 - Null/empty OTP race
Request an OTP, then immediately verify with code: "" before the async DB write lands.
What's on your list? 👇
Shebiiiii retweeted
How to use LLMs for vulnerability research by @ZephrFish (Andy Gill)
MCP: blog.zsec.uk/bullyingllms/
Harness: blog.zsec.uk/harnessing-harn…
#infosec #llm
Shebiiiii retweeted
Made over $25K hacking marketplace app permission issues across various bug bounty programs.
Here's my latest writeup on how a malicious app might take over a GitHub repository: jeetbhdr.github.io/github-gr…
#bugbounty
Shebiiiii retweeted
NO WAY
I've spent 1.4B tokens with Opus 5.5 to reverse engineer the best agent memory framework and I published it on GitHub FOR FREE
check it out
github.com/vectorize-io/hind…
Shebiiiii retweeted
I published one of the techniques that I've been using against OAuth providers, honetly, it's led me to discover many flaws, and recently I used it to find a 1-click ATO on one of the most widely visited websites,I hope you find it useful :-)
blog.voorivex.team/story-of-…
🤖 Made with AI
Shebiiiii retweeted
this site mentioned 100+ bug bounty platforms
gokensai.com/blog/bugbountys…
Shebiiiii retweeted
🍎🐛 I got Claude making this, maybe it's useful for others as well.
Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.
apple-cve.com/
Shebiiiii retweeted
Found the best resource to learn Harness Engineering. 😭
walkinglabs.github.io/learn-…
Shebiiiii retweeted
I just published From DNS Record to Subdomain Takeover: A Dangling Tilda Configuration
medium.com/@alnaeem961/from-…
Shebiiiii retweeted
Just dropped a write-up on using Muse Code for Security Research with the folks at @metabugbounty and my good friend @phwd_ and @1_am_nek0 !
Particularly happy with the binary research section using @full_duplex's lldb-mcp with @clearbluejar's pyghidra-mcp 🔥🔥
bugbounty.meta.com/en-gb/lea…
Shebiiiii retweeted
Added more training to the AI-CTF (it won't be fast but you can run this on a halfway decent laptop) - github.com/mubix/ai-ctf
It teaches prompt injection and other paths prompt injection can take. All the answers are in the repo so it isn't about getting the flags but learning.
