Pinned Tweet
Six months ago we discovered an Authentication Bypass Vulnerabiity in the @auth0 platform. After working with them, today, we can disclose the full details. Read our blog post here: medium.com/@cintainfinita/kn…
👾Moebius retweeted
Quitar un parámetro. Modificar un header. Reenviar el pedido HTTP. Comparar respuestas. Y volver a empezar. 🔁
En Bug Bounty y Pentesting, esas pequeñas pruebas repetitivas consumen tiempo. En mi nueva nota cuento cómo estoy incorporando @PortSwigger Burp AT a mi workflow para delegar parte de ese trabajo.
Como @Burp_Suite Ambassador, me interesa compartir cómo podemos aprovechar estas herramientas en nuestra forma de investigar.
📝 Cómo uso Burp AT para automatizar tareas de testing manual 👉 lnkd.in/dwkmKuja
#BurpSuite #BugBounty #Pentesting
👾Moebius retweeted
La IA disparó una enorme cantidad de reportes y está alterando el ecosistema del bug bounty.
@AndresRiancho, de Vercel, y @soyel_mago, fundador de la BB Village, cuentan cómo es estar de los dos lados del mostrador (y un RCE en Linux 🐧)
En clarín 🗞️
clarin.com/informacion-gener…
Jev is "Internet" moment for AI: up to 193x faster and 444x cheaper in tests with Claude Fable 5.1 and GPT-6 Astra
Whar is Jev, how to use and unlock its real 100х advantage in my 10-page research:
step 1 → meet Jev: LLM writes, agents act, Jev chooses the next move - split intelligence from execution
step 2 → turn every agent fork into three primitives: Choice selects one route, Score measures a defined scale, Noul returns the probability of yes
step 3 → build before getting access: use TypeSafe’s official adapter with OpenAI, Anthropic or xAI, then swap in Jev without rebuilding the graph
step 4 → setup first Jev: one state, three parallel decisions, risk-based thresholds and a real queue your agents can execute
step 5 → batch decisions instead of serializing them: 13 questions in one call ran 10x faster and 12.2x cheaper than 13 sequential calls
step 6 → place Jev at every bounded fork: choose the agent, model, tool, browser action or human escalation, then read fresh state
step 7 → benchmark the entire loop: Browser Use hit Google Flights in 7.1s, Every ran 777 checks in under 0.7s, Mobile Jev completed 9 actions in 21s
step 8 → rank wide, read narrow: Jev cut wrong Hermes skill loads from 16.8% to 7.3% and pushed legal Top-10 retrieval from 38% to 62%
step 9 → steal a system, not a prompt: Chief of Staff, model router, inbox firewall, research feed, browser controller and safety gate all use State → Questions → Action → Verify
step 10 → keep Jev out of math, writing and irreversible execution: code computes, LLMs create, Jev decides, fresh state proves the result
the result: one slow, expensive agent becomes an always-on decision machine that routes, scores and escalates in milliseconds
Copy the complete 10-page Jev blueprint - then read full 10-step roadmap below ↓
👾Moebius retweeted
Tenemos tremenda previa para la @ekoparty de este año 👀
Se viene el @metabugbounty Live Hacking Event 🔥
📅 5 de octubre
📍 Buenos Aires
📝 Pre-Inscripción:
docs.google.com/forms/d/e/1F…
👾Moebius retweeted
🎩 Hackers, magia y Las Vegas 💻🎰
Nuevo VLOG desde Vegas: Black Hat USA 2026, BSides Las Vegas y Magic Live.
Hacking, Bug Bounty, magia y mi paso por Black Hat junto a los amigos de @PortSwigger.
▶️ youtu.be/tBeZmMyyNG4
👾Moebius retweeted
First #BlackHat ✅
First talk in English ✅
Thanks @PortSwigger team ❤️
👾Moebius retweeted
“Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.”
Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥
Technical analysis: gist.github.com/H0j3n/a5ef26…
POC: github.com/aniqfakhrul/CVE-2…
👾Moebius retweeted
The @OWASP_AISVS 1.0 is now released and live!
github.com/OWASP/AISVS/blob/…
cc @ottosulin @ricokomenda Russ Memisyazici and Raza Sharif
👾Moebius retweeted
Bug Bounty Village @ @ekoparty 2026 is now looking for sponsors!
With the support of our sponsors, we're able to keep growing the Village year after year, bringing talks, challenges, networking opportunities, swag, prizes, and unforgettable experiences to the bug bounty community.
If your company wants to connect with hundreds of security researchers, bug bounty hunters, and offensive security professionals from across LATAM and beyond, we'd love to talk.
📩 [email protected]
#BugBounty #CyberSecurity #InfoSec #Ekoparty #BugBountyVillage #HackerCommunity
Come on! We need to unlock the transparent case!!!! Go go go !!!! Show your love to @herrmann1001 and team!
👾Moebius retweeted
Nos fuimos unos días a vivir la primer edición de @ekoparty Miami junto a @BugBountyArg y documenté todo en un VLOG. Espero que les guste :)
youtu.be/ZRFrmwk_0MU
👾Moebius retweeted
Just successfully exploited my first web race condition using the techniques described by @albino_wax in Smashing the State Machine. With a bit of AI, I identified a race in an authorization check where shared state between concurrent requests could be overwritten by a higher-privileged user. By triggering the race condition during authorization validation, I was able to bypass access controls and retrieve data belonging to users from other organizations.
A great reminder that sometimes the bug isn't in the authorization logic itself, but in when that logic executes. Thanks @albinowax for the excellent research and methodology.
I'm thrilled to announce "Smashing the State Machine: the True Potential of Web Race Conditions" will premiere at @BlackHatEvents' #BHUSA this August! Looking forward to sharing some exploits that blew my mind!
blackhat.com/us-23/briefings…































