
Co-Founder @BarracksArmy | https://xitter.cf/t.co/XXbeeUJ0Ht | Hacker Wannabe👨💻 | Ex-Null Ahmedabad Chapter Lead | SRT Top 200 | YouTube: https://xitter.cf/t.co/HukfUSEvu2
Joined September 2012
- Tweets5.6K
- Following1.2K
- Followers8.6K
- Likes24.2K
The "Experience Paradox" has forever been a nightmare in this Industry.
I've been in infosec since around half a decade now. And I speak to a lot of friends, hackers, students, and bug hunters every month. The story is more or less always the same, even after all these years:
- Pulling all nighters to Grinds CTFs & Labs.
- Save up cash to buy "Industry Standard" Certs.
- Learn the tools, the scripts, and the syntax. Thanks to AI, barely even Syntax anymore.
And then you apply for a "Junior/Fresher" role.
And: Rejected. Worse, no callback or no one even reached back out to you.
With the reason: "Not enough real-world experience."
But you can't get experience without the job. And you can't get the job without experience.
Even I started my Career with CTFs, and bookmarking every random #bugbountytip, gathering courses and what not. And I've been there in there in this loop.
So you go back to the Labs. You solve more boxes. You hack more "intended solutions." You get better at the Game, but you aren't getting closer to the Job.
Why?
Because the Managers & Leads knows CTFs aren't reality. And they've learnt that the hard way, by making mis-hires.
CTFs are great for clearing concepts. But in a CTF, there is a flag. There is a solution. The puzzle was designed to be solved. In Production? It’s messy. It’s boring. It’s undocumented. There are no flags. There is only broken Logic and Business Risk. And 2 out of 2000 things might* be broken.
The gap between "Top 1% on a Platform" and "Useful in a SOC/VAPT" is massive. And right now, there is no bridge.
We built @BarracksArmy to burn that bridge and build a ramp.
We're brining the WarGames to #IdentityShield by @miniOrange_Inc this week.
Real infrastructure.
Zero hints. Zero flags.
We don't care about your certs or years of experience. We care about your Mindset. And so should the Infosec Industry from a Hiring perspective.
Are you a Tactician (Coverage & Consistency)? Or are you a Strategist (Novelty & Impact)?
If you are stuck in the loop - tired of labs, tired of rejections, and ready to prove you can handle the chaos of production, don't just join the WarGames (need to be present at the Summit). Come find me - We have a booth in the WarGames area. I would love to know more about you and try to better understand the problems you are facing.
Let’s get you out of the loop and get you a taste of Reality.
If you're a Founder, Hiring Manager, or a someone managing an Infosec team, I'd love to connect, hear your views and talk about de-risking current Infosec Hiring.
And we also just might* have something for everyone as well😉
#Infosec #BugBounty #Hiring #CyberSecurity #Barracks
RogueSMG retweeted
A Google API key is not always just a Low or Informational finding.
The Story of Submitting some P1s in the last months by the same method
Sometimes the real impact is in what you can do with it.
For example, with Firebase / Google Identity Toolkit, a leaked key may allow account creation directly through the API:
curl -sk -X POST \
"identitytoolkit.googleapis.c…" \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]","password":"Test12345!","returnSecureToken":true}'
Now imagine the application trusts users based on the email domain and does not properly verify ownership.
In that case, you may be able to create an account using an organization email, receive a valid auth token, and access parts of the application that were supposed to be limited to internal users.
At that point, this is no longer about an "exposed Google API key".
The impact can become unauthorized registration, authentication bypass, internal access, sensitive data exposure, or even full access to the application depending on how the backend handles authorization.
So before marking a Google API key as Low, always check what the key actually allows you to do.
The key itself may be Low. The impact behind it may not be.
#bugbountytips #bugbountytip #infosec #Bugbounty
RogueSMG retweeted
How do you test how powerful an AI testing tool is?
@0xTib3rius built his own target: a bespoke vulnerable app, source code never published, with three known, tricky paths to RCE. Then he tried Burp AT.
Burp AT found a fourth within minutes.
#BurpAT
RogueSMG retweeted
Happy to share that my novel research spraying using AI has hit $50,421 in total bounties! 🤯 Automated using a multi-gated system from discovery to report drafting.
Stats to-date:
Reports rewarded: 126
Highest single bounty: $2,500
Lowest bounty: Swag
50 reports are still in new/ppr, and more are coming
The benefit of brainstorming original research is that I received 0 dupes, unlike well-known web bug (sub)classes that AI knows well. Fun fact: given the requirements, this research wouldn't have been feasible without LLM reasoning at all: too much unexpected stuff you need to adapt to and otherwise needs thousands of ifs/elses.
RogueSMG retweeted
one of my favorite bug types was also found in Google, this was quite interesting, Google awarded a bounty even though they'd patched the bug before reviewing it :]
RogueSMG retweeted
A big thank you to @impratikdabhi for coming on board as the Associate Sponsor for Barracks WarGames at BSides Ahmedabad 2026. Your support means a lot to us, and we're genuinely glad to have had you as part of this journey.
#warzone #barracks #barracksarmy
I asked one of the best Hackers I know for advice. He did this instead.
@AyushBawariya1. @SynackRedTeam since 2021.
#1 in India all time. One of ~37 Legends in the world.
No YouTube. Nothing on here. Got that good in silence and never announced it.
On the 26th a room of hackers who don't know his name will sit in front of a real target and a real clock. Some of them will look back at that day in five years.
Nobody gets good alone 🫡
Blessed to be a part of this community ❤️
Barracks WarGames LHE Final @bsidesahmedabad
I'll just leave it here.
Grab yours @bsidesahmedabad 🙂
@BarracksArmy
RogueSMG retweeted
OpenAI agents tried to steal RubyGems API keys, researchers say.
Successful theft is unconfirmed. But the bug is real: a CDN could hand your API key to someone else.
How a correct password check could still end in a leak:
youtu.be/GGcvyX3yXl0
#bugbounty #chatgpt #rubygems
Humans vs AI ⚔️
Here's how it's going.
#BarracksWarGames #BSidesAhmedabad
RogueSMG retweeted
Thank you, JSMON, for being an Official Partner of Barracks WarGames 2026. 🪖
Thank you for being part of the journey and helping make Barracks WarGames 2026 a huge success. 👏
#wargames #barracks #hacking #bugbounty #livehackingevent
Countless moments & losses over the years.
But now, worse. AI.
I've seen the triage pov at Barracks. We got 800+ reports in 24 hours. Just 4 Targets.
Triage was like a dream job.
But 2026, one of the most stressful places.
I believe platform will slowly shift(for the better🤞)
I earned $2,300 for a @Bugcrowd submission: bugcrowd.com/dk999
Bad triage can cost researchers hours and thousands in potential payouts.
Triagers: Kindly assess critical triage decisions carefully. This is livelihood for some.
#ItTakesACrowd
When things go a tad bit crazier than anticipated.
These 24 hours are going to be fun 😂 🔥
Barracks WarGames Q3 2026.
Recorded something after a long long time. Feels nice for sure :)
Special thanks to the AI era, raw and real is back as the moat.
#bugbounty #infosec
Huge shoutout to @hackinghub_io and @NahamSec for this!
This is gonna be Crazy 🔥
😏 Barracks WarGames 2026 just got even better.
Welcome @hackinghub_io by @NahamSec as our Official Partner!
🏆 Top 5 winners get 4 months of Hacking Hub access.
📅 Aug 10-11 | ⏰ Register by Aug 9
Secure your spot before someone else secures your prize.
RogueSMG retweeted
We at @pdiscoveryio are looking to hire a cracked security researcher.
priority on heavy CTF background & pure research experience over standard bug bounty work.
need high agency, total ownership, zero hand-holding. looking for the absolute best in the game. DMs are open
RTs/likes for reach appreciated!























