Sporadic Bug Hunter. Aspiring Security Researcher. Cats. Techno 🎧. Tweets only relate to things I find Interesting.

India
Joined November 2017
Abss retweeted
Transformer Visualized: How GPT decides "Paris" with live GPT-2 running in browser Created with @OpenAI GPT 5.5 and @AnthropicAI Opus 4.7
2
4
10
1,693
RCE in Warp Terminal! I believe the attack surface is broadening with every new tool you use. Every OAuth app you authorise with elevated scopes.. we'd see more breaches via targeting tools/SaaS.. the attack surface is everyone and everything now - hacktron.ai/blog/the-attack-…
1
14
1
48
15,019
Abss retweeted
Found a cool bug at Meta. From misconfigured Grafana instance to R/W access on 507 private Meta repositories. Wrote up the full chain here: sectricity.com/blog/misconfi… $157k bounty awarded by @metabugbounty
23
131
11
815
72,263
This incredibly gentle 2-year-old cat is fully vetted (neutered, vaxxed, litter-trained) and promises to purr your ears out. 🐈🐾 📍 South Delhi 📨 [email protected] Even if you can't give him a home today, a RT could change his life! 🙏
5
318
1
617
15,021
Excited to disclose my research allowing RCE in Kubernetes It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout. Unfortunately, this will NOT be patched.
46
370
41
2,560
418,552
Replying to @ryotkak
@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯 @claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.  All fixed in v1.0.93 by switching from blocklists to allowlists. Blog link 👇 flatt.tech/research/posts/pw…
13
65
3,520
With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards. This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings. Read here - hacktron.ai/blog/jdbc-audit-…
13
82
5
336
53,229
2 AM in a Tokyo hotel room: @assetnote x Depi find a Dependency Confusion vuln that lands RCE on Netflix ! 🚀 Shout-out to @infosec_au for the "keep digging" spark & Netflix security for stellar triage. Full write-up in thread 🧵
14
49
1
288
28,942
MCP (Model Context Protocol) is blowing up!! I was intrigued to dig deep, to build and understand. It's like enabling your AI to have more assistants & @AnthropicAI says this is 'USB-C for AI'. I'll break it down by asking `Why?` below ⏬
3
8
1
58
5,493
happy to release my new article entitled: Next.js and cache poisoning: a quest for the black hole zhero-web-sec.github.io/rese… good reading;
38
179
3
768
84,556
Excited to release my latest research today. Exploiting CORS can be a tricky in modern web apps, but there are still critical cases out there if you know what to look for. If you want to learn more about CORS exploitation, the research is available at outpost24.com/blog/exploitin…
2
60
173
15,580
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code from 1996
37
648
36
1,901
240,024
Stepping out of my cocoon and launching! 🎉 Here's explainer video for StockResearchGPT 📈 @InvestiVerse Instantly get answers from the annual reports of Indian companies. No more endless reading or tedious keyword searches. Get the context you need, fast!! #buildinpublic
12
13
5
102
15,270
Time to Shiipppp 🚀
4
3
3
21
2,117
Check out our new blog post! We hacked into Apple Travel Portal (yes, again!) using a 0-day Remote Code Execution exploit. Part 1 is live now, stay tuned for the follow-up on another RCE worth a total bounty of $40k! blog.projectdiscovery.io/hel…
4
110
5
351
44,599
Giveaway Alert! 🎁 Here’s your chance to attend our members-only live event on 18th July. One lucky winner will get our Pro Annual subscription priced at $399 for FREE. To enter: 1️⃣ Follow us on Twitter. 2️⃣ Tag a fellow AppSec Enthusiast in the comments. 3️⃣ Retweet this post for an even better chance to win! Join the excitement, enhance your skills, and be a part the @AppSecEngineer community. Enter now for a shot at this incredible opportunity! Good luck! Please note: The winner will be announced on 17th July. #Giveaway #Cybersecurity #AppSec #training
82
87
2
80
30,803