infosec bro | {insert your certification here}

Joined April 2015
So, on August I've found clickjacking on google worth 7,500$ , This is the write up : apapedulimu.click/clickjacki… Thanks to all of the community who teach me a lot for finding a bug. Specially for indonesia bug hunter community. 🙏
28
154
6
398
Mochammad Nosa Shandy retweeted
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
233
25
682
144,942
Mochammad Nosa Shandy retweeted
New Google VRP writeup "Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking" for a bounty of $13,337 by Mohamed Benchikh: weirdmachine64.github.io/res…
9
45
1,368
Mochammad Nosa Shandy retweeted
Pwn2Own Ireland 2026でMaster of Pwnの称号を頂きました。$361,000の賞金と42.5 Master of Pwn pointsをゲットです。チーム全員で獲得した、日本人初の世界トップハッカーの称号です😎 #Pwn2Own #P2OIreland
35
106
12
990
31,621
Awesome! Every year pwn samsung!
1 bug wonder! With an Confused Deputy (CWE-441) bug Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs PwN'ed the Samsung Galaxy S26 #Pwn2Own
4
254
Mochammad Nosa Shandy retweeted
Google awarded $113,337 USD for a Linux vulnerability discovered by Indonesian security researcher Muhammad Alifa Ramdhan (@n0psledbyte), who works as a Principal Vulnerability Researcher at @starlabs_sg. 🤯 Ramdhan discovered a Linux Local Privilege Escalation (LPE) vulnerability involving a race condition in AF_ALG, the same subsystem later exploited in the famous Copy Fail vulnerability in 2026. He found the issue in 2025 without AI assistance and it was assigned CVE-2025-39964. His coworker, Bing-Jhong Billy Jheng, was also credited for completing the exploit chain, which enabled both privilege escalation to root and escape from a Docker container. They submitted the exploit to Google kernelCTF and received its highest reward. 💰 Ramdhan is from Tangerang, Indonesia. He graduated from Diponegoro University (@undip) in 2023 and later moved to Singapore to work full time as a vulnerability researcher. 🇮🇩 🇸🇬 idnsec.com/research/linux-lo…
1
31
1
159
8,640
Mochammad Nosa Shandy retweeted
A single malicious image led to demonstrated access to an internal OpenAI repository 👇 This is the exploit chain that took our researchers from a vulnerable libheif dependency in the OpenAI Community forum to internal repo access. Full technical breakdown: hacktron.ai/blog/hacking-ope…
4
30
2
237
10,554
Mochammad Nosa Shandy retweeted
This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob. We have published the full details of the exploit chain, as well as how we discovered it, on our blog here: hacktron.ai/blog/hacking-ope…
10
63
4
706
102,250
Mochammad Nosa Shandy retweeted
📢📢📢 Attention bug hunters! Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage? If yes, check out his blog post 👇 bughunters.google.com/blog/b…
8
84
4
551
47,266
Mochammad Nosa Shandy retweeted
“2027 is in 4 months” me who lost track of time since 2019:
21
1,049
22
7,442
96,706
Mochammad Nosa Shandy retweeted
Check out my last blog: The life of a Bug Hunter. buganizer.cc/life-of-a-bug-h…
7
16
107
7,227
Mochammad Nosa Shandy retweeted
Exploiting QSEE Vulnerabilities in Google's Wifi Pro (slide deck) raelize.com/upload/research/… Credits @tieknimmers and @pulsoid #infosec
1
26
224
14,111
Mochammad Nosa Shandy retweeted
When trying to bypass a lock screen in a mobile app, insecure exported components aren’t always the only way in. Have you tried looking for race conditions? Video: youtube.com/watch?v=F4INY-B6… Blog post: byteblind.com/blog/passcode-… #BugBountyTips #AndroidHacking
1
10
1,114
Mochammad Nosa Shandy retweeted
When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠 From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎 In our latest article, we've teamed up with Orwa Atyat (@GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation. Read the article now! 👇 intigriti.com/researchers/bl…
2
64
1
330
36,333
Mochammad Nosa Shandy retweeted
🛑 DON'T immediately submit your low-impact bugs. Here’s @zseano with some pro tips on what you should do with them: 👇
4
19
196
10,886
me and claude code lately
2
2
2,494
Mochammad Nosa Shandy retweeted
We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠 In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎 🧵 👇
2
20
83
8,977
Mochammad Nosa Shandy retweeted
Claude Code Full Sandbox Escape (CVE-2026-55607) writeup: github.com/Metnew/write-ups/… prompt injection -> code execution on the host. works even in read-only permissions mode + full sandbox (it could be my Pwn2Own bug, but p2o was weird this year lol)
26
193
13
1,070
102,405
Mochammad Nosa Shandy retweeted
🔒How to recover the PIN before first unlock? We found a new path and talked at #POC2025 and #QPSS26 . 📒Here is the detailed blog: darknavy.org/blog/the_biomet…
3
35
2
248
27,399