@MantisSTS

Husband and Father of 2 | Hacks things | InfoSec Stuff | Twitch: https://xitter.cf/t.co/ugfxJm4z7U | YT: https://xitter.cf/t.co/mJsgSxa0qO

 United Kingdom
ios.pentestglobal.com
Joined July 2011
  • Tweets7.9K
  • Following2.1K
  • Followers2.4K
465Media
So I started a YouTube channel and started an iOS hacking series. Check it out! youtube.com/playlist?list=PL… I know I sound like a mong on it but hey, just trying to share some knowledge. I want go get out a new video every couple of days! #bugbountytips #bugbounty

iOS Pentesting

youtube.com
11
111
2
337
I’ve been fortunate enough to work with Shaun for many years and have seen first-hand the depth of his knowledge and experience. I’d highly recommend checking out his book! thepracticalredteammanager.c… #RedTeaming #CyberSecurity #OffensiveSecurity #Leadership #InformationSecurity

The Practical Red Team Manager

The Practical Red Team Manager is a real-world guide to leading offensive security teams, managing Red Team engagements, controlling risk and delivering safe, legal and effective security testing.

thepracticalredteammanager.com
2
548
github.com/MantisSTS/iOS-Dum…

GitHub - MantisSTS/iOS-DumpKit: Modern Frida-based iOS app dump and IPA decryption toolkit for...

Modern Frida-based iOS app dump and IPA decryption toolkit for authorised security testing on jailbroken devices. Supports USB/TCP Frida, SSH/SFTP transfer, rootless jailbreak layouts, Mach-O crypt...

github.com
93
you may think your app's service listening on localhost cannot be accessed by random websites. however, have you considered:
23
21
7
598
113,755
CVE PoC Search watchstack.io/intel/poc-sear…
7
142
2
692
49,002
4 days! Absolute piss take 😂
1
38
1,643
InfoSec: "Running random Docker containers is a massive security risk." The risk: Spawning a native window to play ASCII DOOM at 60fps.
1
2
13
1,965
Mantis retweeted
Intigriti
@intigritiMar 9
Day 9 of #BugQuest! 🤠 Yesterday, we listed an overview of the primary ways to discover endpoints. Today, we're diving deep into one of the easiest and most overlooked methods: common configuration files. Files like robots.txt and sitemap.xml were designed to help search engines, but they often leak valuable information about application structure, including endpoints not referenced anywhere else on the target. Swipe through to see a few examples of config files to check and what they can reveal! #BugBounty #HackWithIntigriti #BugQuest
3
4
40
3,364
Next.js, cache, and chains: The Stale Elixir A nice work by @zhero___ This zero day brought web cache poisoning to the spotlight. His extensive research showed how source code analysis helped him craft a technique that resulted to CVE-2024-46982. Blog link 👇 zhero-web-sec.github.io/rese…

Next.js, cache, and chains: the stale elixir

CVE-2024-46982

zhero-web-sec.github.io
11
86
4,637
burp-ai-agent v0.4 github.com/six2dez/burp-ai-a…
10
69
3,593
I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏 clawd.it/posts/10-replaced-b… #bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

Replaced by a Goldfish

AI isn't replacing pentesters. It's replacing the people who think pentesting is a checklist. A deep dive into the hype, the money, and why Daniel Miessler's $70 trillion take doesn't hold up.

patrik.re
43
205
21
945
117,631
Mantis retweeted
Intigriti
@intigritiMar 6
Replying to @intigriti @hakluke @xnl_h4ck3r
4️⃣ JSAnalyzer JSAnalyzer by @_jensec automatically extracts API endpoints, secrets, URLs, and sensitive files from JS responses, with smart noise filtering to reduce false positives! 🤠 🔗 github.com/jenish-sojitra/JS…
1
28
142
5,884
reconftw v4.1 github.com/six2dez/reconftw
2
8
60
3,574
Mantis retweeted
m0n1@m0n1x90Mar 6
Built WinGraph, my new project - a BloodHound-style dependency visualizer for every binary in Windows System32 directory. 4,000+ DLLs, EXEs. Every import. Every export. One interactive graph. Check it out now : wingraph.m0n1x90.dev/
4
93
1
435
21,894
Reverse engineering Zomato's Android app: Bypassing SSL pinning to find plain-JSON MQTT credentials medium.com/@jatin-dot-py/i-r…
5
62
2
441
39,490
Mantis retweeted
Thierry@0x7hierriFeb 28
🔥This is a continuously updated pentesting wiki by @Six2dez1 offering tools, techniques, cheat sheets, and guides covering recon, enumeration, web, cloud, mobile, Windows/Kerberos, and Burp Suite. Link: github.com/six2dez/pentest-b…

GitHub - six2dez/pentest-book

Contribute to six2dez/pentest-book development by creating an account on GitHub.

github.com
1
34
4
234
13,132
Using AI to Do Simple Reverse Engineering blog.huli.tw/2026/03/01/en/r…

Using AI to Do Simple Reverse Engineering

Recently, I encountered a situation where I got a Golang HTTP server binary and needed to disassemble it for further research to find clues for the next steps. However, I am quite unfamiliar with reve

blog.huli.tw
19
93
7,647
Tired of hitting 403 errors during your security testing?  NoMore403 by @devploit automates bypass techniques to get past those pesky restrictions.  Try it at 👇 github.com/devploit/nomore40…

GitHub - devploit/nomore403: 🚫 Advanced tool for security researchers to bypass 403/40X restrict...

🚫 Advanced tool for security researchers to bypass 403/40X restrictions through smart techniques and adaptive request manipulation. Fast. Precise. Effective. - devploit/nomore403

github.com
3
45
243
10,718
Anyone here big on the @msftsecurity programs? I have a few questions about a bug that I've found
231
github.com/Caddyshack2175/po…

GitHub - Caddyshack2175/postoffice: Post Office is a CLI tool for generating and analyzing Postman...

Post Office is a CLI tool for generating and analyzing Postman collections. - Caddyshack2175/postoffice

github.com
110
Which 'lesser-known' tool in your arsenal gives you a competitive edge? 👇🤖
2
1
12
1,820
Load more