I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
Abss retweeted
Transformer Visualized: How GPT decides "Paris" with live GPT-2 running in browser
Created with @OpenAI GPT 5.5 and @AnthropicAI Opus 4.7
Abss retweeted
RCE in Warp Terminal! I believe the attack surface is broadening with every new tool you use. Every OAuth app you authorise with elevated scopes.. we'd see more breaches via targeting tools/SaaS.. the attack surface is everyone and everything now - hacktron.ai/blog/the-attack-…
Found a cool bug at Meta.
From misconfigured Grafana instance to R/W access on 507 private Meta repositories.
Wrote up the full chain here:
sectricity.com/blog/misconfi…
$157k bounty awarded by @metabugbounty
A write-up about an interesting SSRF chain I found earlier this year
eib.hashnode.dev/crafting-a-…
Abss retweeted
This incredibly gentle 2-year-old cat is fully vetted (neutered, vaxxed, litter-trained) and promises to purr your ears out. 🐈🐾
📍 South Delhi
📨 [email protected]
Even if you can't give him a home today, a RT could change his life! 🙏

ALT An orange tabby cat standing on a textured ledge, looking intently out through a wire mesh fence. The cat is wearing a cute white bandana patterned with pink and teal starfish. A purple wall is visible on the left side of the frame.

ALT A close-up of a sweet orange tabby cat resting its front paws on a ledge while lying down. The cat is looking out to the right through a wire mesh balcony or fence, wearing the same white bandana with pink and teal starfish. The background features a purple wall to the left and softly blurred greenery outside.
Abss retweeted
Excited to disclose my research allowing RCE in Kubernetes
It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.
Unfortunately, this will NOT be patched.
Abss retweeted
Replying to @ryotkak
@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯
@claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.
All fixed in v1.0.93 by switching from blocklists to allowlists.
Blog link 👇
flatt.tech/research/posts/pw…
Abss retweeted
With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards.
This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings.
Read here - hacktron.ai/blog/jdbc-audit-…
Abss retweeted
Just published my first blog post "Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover"
You can read the full write-up here:
zere.es/posts/cache-deceptio…
Abss retweeted
2 AM in a Tokyo hotel room: @assetnote x Depi find a Dependency Confusion vuln that lands RCE on Netflix !
🚀 Shout-out to @infosec_au for the "keep digging" spark & Netflix security for stellar triage. Full write-up in thread 🧵
Abss retweeted
MCP (Model Context Protocol) is blowing up!! I was intrigued to dig deep, to build and understand.
It's like enabling your AI to have more assistants & @AnthropicAI says this is 'USB-C for AI'.
I'll break it down by asking `Why?` below ⏬
Abss retweeted
happy to release my new article entitled:
Next.js and cache poisoning: a quest for the black hole
zhero-web-sec.github.io/rese…
good reading;
Abss retweeted
1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
gist.github.com/hackermondev…
Abss retweeted
Excited to release my latest research today. Exploiting CORS can be a tricky in modern web apps, but there are still critical cases out there if you know what to look for. If you want to learn more about CORS exploitation, the research is available at outpost24.com/blog/exploitin…
Abss retweeted
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu…
Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996
Abss retweeted
Stepping out of my cocoon and launching! 🎉
Here's explainer video for StockResearchGPT 📈
@InvestiVerse
Instantly get answers from the annual reports of Indian companies.
No more endless reading or tedious keyword searches. Get the context you need, fast!!
#buildinpublic
Abss retweeted
Check out our new blog post! We hacked into Apple Travel Portal (yes, again!) using a 0-day Remote Code Execution exploit. Part 1 is live now, stay tuned for the follow-up on another RCE worth a total bounty of $40k!
blog.projectdiscovery.io/hel…
Abss retweeted
Giveaway Alert! 🎁
Here’s your chance to attend our members-only live event on 18th July.
One lucky winner will get our Pro Annual subscription priced at $399 for FREE.
To enter:
1️⃣ Follow us on Twitter.
2️⃣ Tag a fellow AppSec Enthusiast in the comments.
3️⃣ Retweet this post for an even better chance to win!
Join the excitement, enhance your skills, and be a part
the @AppSecEngineer community.
Enter now for a shot at this incredible opportunity!
Good luck!
Please note: The winner will be announced on 17th July.
#Giveaway #Cybersecurity #AppSec #training

























