
@LocalHost31337i
iAccount based inIndonesia!
About this account
- Account based in
- Indonesia
- Connected via
- Indonesia App Store
! X says this location may be affected by a proxy or VPN.
Account-level information from X, not a live location or the device used for a specific post.
infosec bro | {insert your certification here}
Joined April 2015
- Tweets6.8K
- Following1.7K
- Followers2K
- Likes13K
Pinned Tweet
So, on August I've found clickjacking on google worth 7,500$ , This is the write up : apapedulimu.click/clickjacki… Thanks to all of the community who teach me a lot for finding a bug. Specially for indonesia bug hunter community. 🙏
Mochammad Nosa Shandy retweeted
New Google VRP writeup "Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking" for a bounty of $13,337 by Mohamed Benchikh:
weirdmachine64.github.io/res…
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
Mochammad Nosa Shandy retweeted
Pwn2Own Ireland 2026でMaster of Pwnの称号を頂きました。$361,000の賞金と42.5 Master of Pwn pointsをゲットです。チーム全員で獲得した、日本人初の世界トップハッカーの称号です😎
#Pwn2Own #P2OIreland
How I got RCE and full cloud takeover on Meta at their in-person event in Taiwan
zonduu.me/posts/meta-graphra…
Mochammad Nosa Shandy retweeted
Google awarded $113,337 USD for a Linux vulnerability discovered by Indonesian security researcher Muhammad Alifa Ramdhan (@n0psledbyte), who works as a Principal Vulnerability Researcher at @starlabs_sg. 🤯
Ramdhan discovered a Linux Local Privilege Escalation (LPE) vulnerability involving a race condition in AF_ALG, the same subsystem later exploited in the famous Copy Fail vulnerability in 2026. He found the issue in 2025 without AI assistance and it was assigned CVE-2025-39964.
His coworker, Bing-Jhong Billy Jheng, was also credited for completing the exploit chain, which enabled both privilege escalation to root and escape from a Docker container. They submitted the exploit to Google kernelCTF and received its highest reward. 💰
Ramdhan is from Tangerang, Indonesia. He graduated from Diponegoro University (@undip) in 2023 and later moved to Singapore to work full time as a vulnerability researcher. 🇮🇩 🇸🇬
idnsec.com/research/linux-lo…
Mochammad Nosa Shandy retweeted
A single malicious image led to demonstrated access to an internal OpenAI repository 👇
This is the exploit chain that took our researchers from a vulnerable libheif dependency in the OpenAI Community forum to internal repo access.
Full technical breakdown: hacktron.ai/blog/hacking-ope…
This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob.
We have published the full details of the exploit chain, as well as how we discovered it, on our blog here:
hacktron.ai/blog/hacking-ope…
Mochammad Nosa Shandy retweeted
📢📢📢 Attention bug hunters!
Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage?
If yes, check out his blog post 👇
bughunters.google.com/blog/b…
Mochammad Nosa Shandy retweeted
Check out my last blog: The life of a Bug Hunter.
buganizer.cc/life-of-a-bug-h…
Exploiting QSEE Vulnerabilities in Google's Wifi Pro (slide deck)
raelize.com/upload/research/…
Credits @tieknimmers and @pulsoid
#infosec
Mochammad Nosa Shandy retweeted
When trying to bypass a lock screen in a mobile app, insecure exported components aren’t always the only way in.
Have you tried looking for race conditions?
Video: youtube.com/watch?v=F4INY-B6…
Blog post: byteblind.com/blog/passcode-…
#BugBountyTips #AndroidHacking
Mochammad Nosa Shandy retweeted
When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠
From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎
In our latest article, we've teamed up with Orwa Atyat (@GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation.
Read the article now! 👇
intigriti.com/researchers/bl…
Mochammad Nosa Shandy retweeted
We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠
In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎
🧵 👇
Mochammad Nosa Shandy retweeted
Claude Code Full Sandbox Escape (CVE-2026-55607)
writeup: github.com/Metnew/write-ups/…
prompt injection -> code execution on the host.
works even in read-only permissions mode + full sandbox
(it could be my Pwn2Own bug, but p2o was weird this year lol)



























