@pritesec

Senior Penetration Tester | Security Analyst

 Ahmadabad City, India
Joined October 2017
  • Tweets3K
  • Following3.4K
  • Followers1.5K
16Media
I just published my writeup about How an incident gave us $$$ bounty. If you have any query feel free to DM me. medium.com/@vpawar1147/how-a…
3
11
45
Pritesh Mistry retweeted
Dhiyaneshwaran@DhiyaneshDKOct 7
🚨 CVE-2026-21589 - Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read Nuclei Template : github.com/projectdiscovery/… Reference: labs.watchtowr.com/you-wont-… #bugbounty #hackwithautomation #atlassian
2
52
1
215
24,522
Pritesh Mistry retweeted
𝐗.
@be_evolved1Oct 6
men after losing everything
26
1,007
38
6,214
149,833
Pritesh Mistry retweeted
Pritesh Mistry@pritesecOct 6
Replying to @Meta
@Meta @instagram My Instagram account (Username: prites.sh) has been suspended unexpectedly. I have not violated Instagram’s Community Guidelines or Terms of Use. Please review my account and restore it if the suspension was made in error.
24
3
3
17
684
Pritesh Mistry retweeted
Dera Ojobo@deraojoboOct 4
obsession over talent
2
552
9
4,634
54,398
Pritesh Mistry retweeted
Kevin Pietersen🦏
@KP24Oct 4
Better to be a wolf that everyone hates, than a donkey who everyone rides.
123
1,328
73
11,790
224,381
Pritesh Mistry retweeted
Romil Patel@Romilpatel1988Sep 25
Replying to @bsidesahmedabad
"><img src=x onerror=alert('@bsidesahmedabad ')> I want to bring my friend to learn AI Security, prompt injection, and how we can defend AI systems. BSides is the perfect place to learn from researchers, share ideas, and discover what’s next in cybersecurity. @pritesec
2
6
229
Pritesh Mistry retweeted
HackingHub
@hackinghub_ioSep 21
Web cache deception tricks 🪄 GET /api/me → returns PII Run these to trick the CDN into caching a sensitive endpoint: 🟥 GET /api/me;.css 🟥 GET /api/me/foo.css 🟥 GET /static/..%2fapi/me 🟥 GET /api/me%00.css 🟥 GET /profile%2f%2e%2e%2fstatic Your ideal scenario: the origin ignores the trailing junk (; param, extra path segment, encoded traversal) and returns private data anyway, but the CDN only sees the .css suffix and caches it as static. NOTE: Also try other delimiters, file extensions, and static directories.
1
45
255
9,816
Pritesh Mistry retweeted
s1r1us
@S1r1u5_Sep 18
On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
353
1,389
548
11,827
2,819,671
Pritesh Mistry retweeted
MG193_7@MGAldys4Sep 11
Guys, I built a super fast Android decompiler called ASC. It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel. And this week my Agent use ASC found 2 RCE in Honor and Xiaomi! This tool now accepted by BlackHat EU Arsenal github.com/MG1937 #BHEU
26
168
12
1,135
178,291
Pritesh Mistry retweeted
DaviMatsuyama
@davi1337_Sep 8
I wrote a write-up about a v8 challenge. In that write-up I explain about the v8's sandbox. I expect that you enjoy reading that write-up!!!! davi1337.gitbook.io/public/h…

HITCON 2024 | Davi1337

Today I decided to take a day to tackle a V8 challenge and (try to) write a good write-up about it. After all, as many say, we learn more when we teach :D

davi1337.gitbook.io
24
90
5,440
Pritesh Mistry retweeted
Sameer Mistry@sameermistry251Sep 7
Replying to @ViCustomerCare
@ViCustomerCare My Vi number has been deactivated without any prior SMS, email, or WhatsApp notification. I have already completed the recharge, yet none of my services are working. Why was I not informed before deactivation? Please clarify the reason and kindly resolve urgently
3
1
2
89
Pritesh Mistry retweeted
Coffin
@lostsec_Aug 2
Starting September 2026, standard Google API keys (AIza...) will no longer be accepted for Gemini API access. ai.google.dev/gemini-api/doc…
7
7
183
10,652
Pritesh Mistry retweeted
cTino@tinopreterJul 31
$1,500 for leaking AI System Prompt. I show you how your Burp suite configuration is preventing you from catching these bugs. A specific 3rd party domain, when not configured right would expose your system prompt and configuration flags. medium.com/@tinopreter/1-500…
9
29
1
317
12,496
Pritesh Mistry retweeted
clem 🤗
@ClementDelangueJul 28
The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next. huggingface.co/blog/agent-in…
282
1,189
302
5,609
1,702,883
Pritesh Mistry retweeted
Coffin
@lostsec_Jul 28
You can also use Shodan's Certificate Transparency (CT) API to enumerate a target's subdomains directly from the crt.sh database. ctl.shodan.io/api/v1/domain/… /api/v1/domain/{domain} ~returns the certificates that match a domain /api/v1/domain/{domain}/hostnames ~returns all hostnames associated with a domain
14
167
1,093
38,464
Pritesh Mistry retweeted
Chaofan Shou
@shouccccJul 22
Kimi K3 exploited the latest Redis server with a 0day it discovered. All it took was 27min with 32 agents. github.com/berabuddies/redis…
106
452
103
5,116
1,475,822
Pritesh Mistry retweeted
sagitz
@sagitz_Jul 22
$100,000 in bounty 🤯 Thanks @GitHubSecurity
289
316
106
10,922
840,413
Pritesh Mistry retweeted
Brute
@BRuteLogicJul 21
OAuth Authorization Bypass Testbed 403.brutelogic.net/authz/oau…
Brute
@BRuteLogicJun 11
Broken Token: OAuth New ebook, 2nd of the series. Master every way to break OAuth flow: PKCE downgrade DCR injection Token lifecycle abuse Grant flow weaponization + 13 original named techniques brutelogic.net/ebooks/broken… The most complete offensive OAuth resource available.
Broken Token: OAuth by Rodolfo Assis

ALT Broken Token: OAuth by Rodolfo Assis

1
72
414
29,162
Pritesh Mistry retweeted
7h3h4ckv157
@7h3h4ckv157Jul 21
Local AI for Penetration Testing & Research Author: Eddie Zhang Resource: projectblack.io/blog/local-a…
4
76
387
19,598
Pritesh Mistry retweeted
7h3h4ckv157
@7h3h4ckv157Jul 19
S3Scanner A tool to find open S3 buckets in AWS or other cloud providers: •AWS •DigitalOcean •DreamHost •GCP •Linode •Scaleway •Custom Resource: github.com/sa7mon/s3scanner
44
225
8,612
Load more