Heckr | Former Community Manager @InfoSecComm | eJPT | Certified Red Team Professional (CRTP)
DM for Collaborations
Joined March 2018
- Tweets9.4K
- Following615
- Followers19.5K
- Likes4.7K
Pinned Tweet
THEBINARYBOT'S GUIDE TO API HACKING IS AVAILABLE NOW FOR SALE !!!
Learn and find different API-related vulnerabilities such as:
-BOLA
-BOFA
-SSRF
and more...
Use code "thebotswarm" to get the product for just $5. Valid till 6 Mar.
#bugbounty
thebinarybot.gumroad.com/l/a…
Nithin 🦹♂️ retweeted
Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( 🤯
blog.faav.net/how-i-couldve-…
Great find by @efaav, a talented 15 y.o. researcher!
Nithin 🦹♂️ retweeted
Quick tweet. Cybersecurity on the offense side, even with what Anthropic released today will be still a heavily restricted models and never the best.
For offense, your only choice is open weight models. I would not rely on frontier models for offensive research.
Invest in hardware or solutions that allow you to use hardware infrastructure as a service.
It will pay dividends.
In stating that, if you can get access to special programs as an organization/company - this is also an incredible option if approved through.
Nithin 🦹♂️ retweeted
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
Nithin 🦹♂️ retweeted
We burned 11.7bn tokens to find the best cyber AI model - @AikidoSecurity
aikido.dev/blog/ai-model-ben…
Cloudflare is high-key THE internet atp
Introducing "cf", an agentic CLI for the entire Cloudflare API.
You can do nearly anything. Even buying a domain is incredibly simple from the CLI.
Don't know what command you need? Run `cf cli search "look at messages stuck in my queue"` and it will return a list of relevant commands.
blog.cloudflare.com/cloudfla…
Nithin 🦹♂️ retweeted
Flirting: wiz.io/blog/wiz-research-cod…
Harassment: hacktron.ai/blog/hacking-ope…
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement).
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
Nithin 🦹♂️ retweeted
Hacktron founder @S1r1u5_ says Claude Code didn’t hack OpenAI on its own, it took a human who had already found a Discord zero-day to know where to look:
"Everyone has the same Claude Code. It doesn't mean that they'll be doing this. My mom can have Claude Code, that doesn't mean she will start hacking now."
"@rootxharsh has a pretty good understanding of OpenAI infrastructure, and he previously found a zero day on Discord, the bug we exploited in the third party. That kind of intuition and previous understanding pointed him at the target."
"It's not like go hack OpenAI would make Astra find this kind of vulnerability. Model capabilities are not there. You still need to organize them, hand hold them, point at the right things."
"Probably GPT-8 doesn't need that. But GPT-6 or GPT 5.6, they're not there. You can't just give a long-running task which runs for six months where your goal is to hack OpenAI."
@HacktronAI
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
Nithin 🦹♂️ retweeted
Today we are releasing a 1 page version of “Hacking Your Career”
arcanum-sec.github.io/hyc/
We get a bunch of students and early career-seekers looking for resources and advice of getting their 1st gig.
This resource gives all those and more; free trainings, free certificates for your résumé, advice on résumé design, information on career verticals, small sections on interviewing and the hiring process, and more! 🫶🫶
🔥🔥🔥
📢📢📢 Attention bug hunters!
Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage?
If yes, check out his blog post 👇
bughunters.google.com/blog/b…
Nithin 🦹♂️ retweeted
What I'm learning on Twitter is that most people in cyber never did any actual cyber. 🤡
👀👀👀👀👀👀👀
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
openai.com/index/hugging-fac…
Nithin 🦹♂️ retweeted
I'm always trying to give my coding agents a way to see and capture images of work so made a cli tool with an mcp to do that.
Introducing Iris 📸, a fast screenshot tool for coding agents, written in Rust.
• CLI + MCP
• full-page capture + CSS selector capture
• desktop, iPhone, and iPad sizes
• retina output + dark mode
• uses your local Chrome
• MCP keeps Chrome alive for fast repeat captures (~366ms median in my benchmark)
Give your agent a camera!
Nithin 🦹♂️ retweeted
My biggest skill in bug hunting/life in general has been my willingness to keep trying. @chompie1337 has an old writeup quote I love to tell people: you need to keep looking.
Same with bounties… lots of researchers completely omit the fact that some of the best bugs are found on sites from good recon or *excellent content discovery*, which are the unsexy parts of bounties.
There’s also a bunch of failure omitted when you read the final write ups or listen to the interview in a podcast.
Keep trying, keep failing, keep going.
There you go!
🧩 DeepSeek Harness v0.1 is now available in Developer Preview!
🔹 We’re opening it up to developers building agent harnesses worldwide and open-sourcing the codebase in MIT license.
🔹 Powered by the Cordis meta-framework, DeepSeek Harness is an agent harness built around one core idea: Everything is a plugin. Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI are ALL implemented as plugins, and can be mixed, matched, replaced, and extended.
Try it now!
github.com/deepseek-ai/deeps…
