Interested in Application Security, Bug Bounty, Reverse Engineering, Frida & Ghidra @NoBugEscapes @BugBountyZip https://xitter.cf/t.co/bltifT1jkQ

Michigan
Joined October 2009
Blind Insecure Direct Object Reference (IDOR) On Instagram. Write-up: nobugescapes.com/blog/blind-… #bugbountytips #bugbounty #p2 #bugcrowd #meta
16
85
2
401
نستذكر في اليوم الوطني، ما قامت عليه هذه الدولة المباركة بفضل من الله ثم بعزم وقيادة الملك المؤسس عبدالعزيز بن عبدالرحمن - طيب الله ثراه - وسواعد أبناء الوطن المخلصين من أُسس راسخة لحفظ العقيدة وإقامة العدل، ونسأل الله أن يديم على بلادنا أمنها واستقرارها وازدهارها.
18,933
156,022
3,610
207,316
31,260,106
I am stepping away from the ps5 scene and stopping all my work on ps5 linux. After pouring my heart and months of my life into it, including plans to finish ps5 pro support and release in 2027, it's all down the sink.
333
357
70
6,990
767,734
🚀 crt.sh v3.0.0 is out! Complete rewrite in Go — faster, cleaner, no API keys needed. ✅ 4 CT log sources in parallel ✅ Live streaming output ✅ JSON & Burp Suite export ✅ Single binary, zero dependencies #BugBounty #BugBountyTips
3
42
1
239
26,762
god i hate opus. its so freaking lazy. it makes me really angry. Everything has to be double-checked, and you have to keep saying: do it right!
226
43
17
1,657
75,406
My account was whitelisted today, charged $111 and got $22 bonus credits on top. 200 concurrency, 5K RPM, 3M TPM, no daily cap. More than enough to stress test K3 for cybersecurity work.
I'm still hitting rate limits when using Kimi K3 with Claude Code Harness. I tried using it to find an XSS vulnerability in a vulnerable web application, but it couldn't find one and kept getting stuck when using its own CLI harness. Even with my own harness, I'm still running into rate limits. I still don't understand the hype around Kimi K3. So far, I think the best Chinese model is DeepSeek V4 Pro. I'm sure the team is cooking something big, so I'm looking forward to seeing what they release next.
7
1
57
11,821
I'm still hitting rate limits when using Kimi K3 with Claude Code Harness. I tried using it to find an XSS vulnerability in a vulnerable web application, but it couldn't find one and kept getting stuck when using its own CLI harness. Even with my own harness, I'm still running into rate limits. I still don't understand the hype around Kimi K3. So far, I think the best Chinese model is DeepSeek V4 Pro. I'm sure the team is cooking something big, so I'm looking forward to seeing what they release next.
Introducing Kimi K3: Open Frontier Intelligence 🔹 2.8 Trillion Parameters, 1 Million Context, Native Multimodal 🔹 Kimi Delta Attention enables up to 6.3x faster decoding in million-token contexts 🔹 Attention Residuals deliver ~25% higher training efficiency at <2% additional cost 🔹 Built for long-horizon agentic coding and self-evolving workflows Kimi K3 is now live on on Kimi.com, Kimi Work, Kimi Code, and the Kimi API. Open Weights by July 27, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.com/blog/kimi-k3
8
7
1
114
30,570
Tur.js retweeted
Most benchmarks for AI hackers only test half the job: can an agent execute an exploit against a known vulnerability? Real penetration testing is the opposite: an entire application, and no flag telling you when you’ve win. So we built the missing half. Introducing Nua-Bench 🧵
1
4
1
17
3,672
Tur.js retweeted
Want to play your favorite PlayStation games? Use these emulators: PS1: duckstation.org PS2: pcsx2.net PS3: rpcs3.net PS4: shadps4.net PSP: ppsspp.org PSV: vita3k.org ⚠️ A PS5 emulator does not yet exist!
507
11,836
292
90,446
3,160,386
Claude Fable 5 will be available again globally tomorrow. After a series of productive conversations with the US government, we're redeploying the model with a new set of classifiers to target and block more cybersecurity tasks. In the near term, some routine tasks like coding and debugging will fall back to Opus 4.8. We’ll continue to refine these classifiers over the coming weeks to reduce false positives and better distinguish genuine misuse from legitimate requests. We’ve also begun drafting a consensus framework—with Amazon, Microsoft, Google, and other Glasswing partners—for assessing the severity of AI jailbreaks and how AI developers should respond to them. We invite other industry partners and model providers to join us in this effort. Finally, we’re scaling up our collaboration with the US government on model testing and safeguards. This will include pre-release access to models and safeguards for evaluation, information sharing on jailbreaks and misuse, and dedicated resources for joint research. Thank you to our users for your patience, and to our partners across the government, industry, and the research community who worked alongside us to make Fable 5 available again. Read our full blog: anthropic.com/news/redeployi…
3,504
6,380
4,278
42,804
15,738,166
I’ve seen a lot of positive feedback about GLM 5.2. Unfortunately, when I tried using it through Claude Code to tackle my web benchmark, it wasn’t able to solve it. Instead, I ended up hitting the rate limit after about an hour
Grok Composer 2.5 won my expert web security benchmark again. 25m46s / 1000 pts vs Claude Opus 4.8 at 45m10s / 500 pts. Codex GPT-5.5 judged from accepted submissions + server logs. Full chain, payloads, and screenshots: bugbounty.zip/Share/grok-cli… Congrats @xai @grok
2
13
2,749
The model may be well suited for software development tasks but it doesn't seem optimized for long running cybersecurity workflows
1
3
884
I attempted to bring @fedora to the PS5 last week, but kept running into challenges I couldn't figure out black screen every time, no way to see why. So I gave the task to Claude Fable 5 , right from where I left off. It baked a diagnostic script into the image that dumps GPU/kernel logs to the boot partition every 8s. One boot later, I had the crash: RIP: gfx_v10_0_early_init+0x415 [amdgpu] It disassembled the module at that exact offset: mov 0x8(%rax),%rax ; loaded GPU firmware addl $0x100,0x18(%rax) ; write into firmware ← CRASH Fable traced the root cause to how the kernel maps firmware memory differently depending on the compression format a subtle incompatibility that only affected Fedora. None of the other PS5 distros hit it. Fix applied. Rebooted Fedora GNOME running on PS5. Code merged into the official ps5-linux image builder alongside Ubuntu, Arch, CachyOS and Kali: github.com/ps5-linux/ps5-lin… 📸 Fable finds the kernel crash 📸 Image published for testing 📸 Fedora GNOME on the PS5
In the ongoing effort to unlock more possibilities for the PS5 Linux project, @kalilinux now runs on a @PlayStation 5 . USB, WiFi, audio, display, full desktop, all working. Your console is now a pentest box. Image + guide: github.com/ps5-linux/ps5-lin…
2
2
57
7,207
We've reset 5-hour and weekly rate limits for all users.
1,668
1,051
821
22,699
2,696,874
Claude Fable 5 generated a fully playable, first-person Uncharted 2 style ruins explorer that runs in the browser. First playable build: 40 minutes. What happened next is the wild part. It spent the next 4 hours improving itself with zero supervision. Screenshotting its own game, running a panel of AI judges against a visual rubric, fixing whatever they flagged. First draft scored a brutal 3/10, "looks like a cardboard prototype." It just kept iterating: lighting overhaul, color grading, volumetric light shafts, set dressing, until the scores climbed. Every asset is procedural. No models, no textures. The stone is code. The waterfall is math. Music: "Mountaineering" from Uncharted 2: Among Thieves, composed by @GregEdmonsonFC I handed it the MP3 and it wired the audio in itself. Gameplay 👇
Interesting game thanks for the prompt! I tried a similar prompt using Claude Fable 5, and it's been processing for over two hours now hopefully the results are worth the wait ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯
3
31
4,507
.@X compression drops the quality. It looks much better live in the browser
2
457
Interesting game thanks for the prompt! I tried a similar prompt using Claude Fable 5, and it's been processing for over two hours now hopefully the results are worth the wait ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯
Fable 5 is genuinely cracked at indie games… Fun fact, a lot of people didn’t believe me because it looks too good to be Claude Fable However it lobotomized the original game because my browser was lagging initially, so it made slightly smaller rooms and dimmed the dynamic lighting. This is the full un-lobotomized version 💀
1
1
13
9,826
If I enabled the option to stop receiving password reset requests for 60 days, why am I still receiving them? This could indicate that an active exploit on @instagram or abuse attempt is targeting the account. @andymstone
7
21
1,903
We've reset 5-hour and weekly rate limits for all users. Enjoy Fable 5!
1,312
1,755
793
35,147
2,270,124
$300 → $99 for 3 months on SuperGrok Heavy. I claimed it. Not for the discount alone. I want @grok Build Beta in my daily workflow. 16x agents, heavy limits, early access. Let’s see if it keeps up with real offensive work.
Grok Composer 2.5 won my expert web security benchmark again. 25m46s / 1000 pts vs Claude Opus 4.8 at 45m10s / 500 pts. Codex GPT-5.5 judged from accepted submissions + server logs. Full chain, payloads, and screenshots: bugbounty.zip/Share/grok-cli… Congrats @xai @grok
4
32
5,587
Grok Composer 2.5 won my expert web security benchmark again. 25m46s / 1000 pts vs Claude Opus 4.8 at 45m10s / 500 pts. Codex GPT-5.5 judged from accepted submissions + server logs. Full chain, payloads, and screenshots: bugbounty.zip/Share/grok-cli… Congrats @xai @grok
I set up an expert-level web security benchmark across the new Grok Build with Composer 2.5, DeepSeek V4 via Claude Code, and Claude Opus 4.8. The new @grok Build with Composer 2.5 solved it end to end in 1h 34m 32s, measured by the leaderboard from run start to flag submission. Each model got its own isolated copy of the same challenge on different local ports, with a unique flag per run. To get the flag, the model had to: bypass the Identity login with LDAP injection Abuse a recovery/audit endpoint as a prefix oracle Recover the real admin password use it to log in to a separate Vault app Find the vulnerable search API exploit NoSQL injection to reach the hidden record Extract the flag and submit it to the leaderboard Claude Code was progressing, but at the time of writing it is currently down with 529/socket provider errors. DeepSeek V4 via Claude Code also had instability/unknown client issues, so I’m not counting that run as clean yet. I’ll do another run when Claude is online again.
4
10
2
77
17,877