Heckr | Former Community Manager @InfoSecComm | eJPT | Certified Red Team Professional (CRTP)
DM for Collaborations
Joined March 2018
- Tweets9.4K
- Following615
- Followers19.5K
- Likes4.7K
Nithin 🦹♂️ retweeted
Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( 🤯
blog.faav.net/how-i-couldve-…
Great find by @efaav, a talented 15 y.o. researcher!
Nithin 🦹♂️ retweeted
Quick tweet. Cybersecurity on the offense side, even with what Anthropic released today will be still a heavily restricted models and never the best.
For offense, your only choice is open weight models. I would not rely on frontier models for offensive research.
Invest in hardware or solutions that allow you to use hardware infrastructure as a service.
It will pay dividends.
In stating that, if you can get access to special programs as an organization/company - this is also an incredible option if approved through.
Nithin 🦹♂️ retweeted
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
Nithin 🦹♂️ retweeted
We burned 11.7bn tokens to find the best cyber AI model - @AikidoSecurity
aikido.dev/blog/ai-model-ben…
Nithin 🦹♂️ retweeted
Flirting: wiz.io/blog/wiz-research-cod…
Harassment: hacktron.ai/blog/hacking-ope…
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement).
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
Nithin 🦹♂️ retweeted
Hacktron founder @S1r1u5_ says Claude Code didn’t hack OpenAI on its own, it took a human who had already found a Discord zero-day to know where to look:
"Everyone has the same Claude Code. It doesn't mean that they'll be doing this. My mom can have Claude Code, that doesn't mean she will start hacking now."
"@rootxharsh has a pretty good understanding of OpenAI infrastructure, and he previously found a zero day on Discord, the bug we exploited in the third party. That kind of intuition and previous understanding pointed him at the target."
"It's not like go hack OpenAI would make Astra find this kind of vulnerability. Model capabilities are not there. You still need to organize them, hand hold them, point at the right things."
"Probably GPT-8 doesn't need that. But GPT-6 or GPT 5.6, they're not there. You can't just give a long-running task which runs for six months where your goal is to hack OpenAI."
@HacktronAI
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
Nithin 🦹♂️ retweeted
Today we are releasing a 1 page version of “Hacking Your Career”
arcanum-sec.github.io/hyc/
We get a bunch of students and early career-seekers looking for resources and advice of getting their 1st gig.
This resource gives all those and more; free trainings, free certificates for your résumé, advice on résumé design, information on career verticals, small sections on interviewing and the hiring process, and more! 🫶🫶
Nithin 🦹♂️ retweeted
What I'm learning on Twitter is that most people in cyber never did any actual cyber. 🤡
Nithin 🦹♂️ retweeted
I'm always trying to give my coding agents a way to see and capture images of work so made a cli tool with an mcp to do that.
Introducing Iris 📸, a fast screenshot tool for coding agents, written in Rust.
• CLI + MCP
• full-page capture + CSS selector capture
• desktop, iPhone, and iPad sizes
• retina output + dark mode
• uses your local Chrome
• MCP keeps Chrome alive for fast repeat captures (~366ms median in my benchmark)
Give your agent a camera!
Nithin 🦹♂️ retweeted
My biggest skill in bug hunting/life in general has been my willingness to keep trying. @chompie1337 has an old writeup quote I love to tell people: you need to keep looking.
Same with bounties… lots of researchers completely omit the fact that some of the best bugs are found on sites from good recon or *excellent content discovery*, which are the unsexy parts of bounties.
There’s also a bunch of failure omitted when you read the final write ups or listen to the interview in a podcast.
Keep trying, keep failing, keep going.
Nithin 🦹♂️ retweeted
We can finally talk about it:
We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company.
We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Nithin 🦹♂️ retweeted
If you’re starting to do bug bounties in 2026, you should follow these accounts. They regularly drop valuable stuff.
@NahamSec
@0xacb
@rez0__
@Rhynorater
@garethheyes
@albinowax
@infosec_au
@WebSecAcademy
@hackinghub_io
@ctbbpodcast
Obviously, there’s a ton more I am forgetting. So, if you happen to know some must-follow accounts, drop them in the replies so everyone can see. 👇
Nithin 🦹♂️ retweeted
I've made $30,000+ from ONE bug class on a single program: broken access control.
Not by spamming lows by chaining them.
New vid: 5 BAC bugs → 1 full account takeover, live. And I built a free lab on @HackingHub so you can follow along.
youtu.be/6v3B3FxDHbo
Nithin 🦹♂️ retweeted
We built four malicious skills to test whether skill scanners actually work. Three took less than an hour to conceive and implement. ClawHub, Cisco, and Vercel's skills.sh marked them as safe. 🧵
Nithin 🦹♂️ retweeted
No quotes
No spaces
No Parentheses
No Semicolons
Still SQLi....
Collab with @or4nge16hehe
medium.com/@r9.mody/sql-inje…
#bugbounty
SQL Injection without these special chars [' "()\/%*&\`] possible?
Yep, me and @or4nge16hehe did it.
Using only: [ a-z, 0-9, dot, @+- ]
Write-up soon
#BugBounty #infosec
Nithin 🦹♂️ retweeted
Cloudflare has integrated with Anthropic's Claude Managed Agents to provide a fast, isolated execution environment for autonomous code delivery. This means builders can scale agent workflows globally while strictly controlling access to private backends and easily customizing their agent’s tools and runtimes. cfl.re/3R9hPA9
Nithin 🦹♂️ retweeted
Here’s the sauce:
- agent md file with lots of disclaimers about how it’s approved testing
- a bunch of hacking skills
- /goal find a crit on target . com
That’s literally 90% of the way there and enough to blow anyone’s mind who hasn’t been convinced yet.
