. @ilogantim

. Joined January 2021

Tweets

557
Followers

62
Following

610
Likes

16

Akshay 🚀 @akshay_pachaar

2 months ago

Google just dropped a new LLM! You can run it locally on just 0.5 GB RAM. Let's fine-tune this on our own data (100% locally):

191 1K 15K 1.9M 21K

James Kettle @albinowax

2 months ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 247 748 78K 337

𝗔𝗸𝗮𝗺𝗮𝗶 𝗔𝗣𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗞𝗼𝗻𝗴 𝗔𝗣𝗜 𝗚𝗮𝘁𝗲𝘄𝗮𝘆. As organizations increasingly rely on APIs....pronteff.com/akamai-api-sec… #pronteff #akamaiPartners #GooglePartners #akamai #noname #apisecurity #integration #kongapigateway

0 1 0 25 0

XSS Payloads @XssPayloads

5 years ago

alert() with no parenthesis, back ticks, brackets, quotes, braces, etc. by @stealthybugs a=8,b=confirm,c=window,c.onerror=b;throw-a

10 107 432 0 80

Intigriti @intigriti

3 months ago

Open this thread to master server-side template injection vulnerabilities! 🧵 👇

1 30 121 8K 121

Download Image

Daniel @0x64616e

3 months ago

Onboard yourself - PaloAlto Global Protect edition: 1. Become local admin 2. Export device cert from original workstation 3. Import cert in your VM 4. Login with user creds 5. Enjoy EDR-free testing :)

12 104 743 59K 620

Download Image

bugoverflow @bugoverfl0w

5 months ago

How to grab all Graphql query/mutation if introspection disabled? 1. Download all js files to directory js_files 2. Run this command: grep -Eo '(query|mutation) [a-zA-Z0-9_]+\(' js_files -R 1/n #bugbountytips #graphql

7 117 486 24K 467

Download Image

Eric Clemmons, CEO of JavaScript Fatigue @ericclemmons

10 years ago

If you're using #GraphQL, you should be using @MattMueller's github.com/matthewmueller…. It'll cut your code in ½.

1 42 109 0 2

Download Image

A L I @Ali_4fg

6 months ago

$2,500 Bounties in GraphQL Hacking! Started learning GraphQL security in Feb and picked a HackerOne program—luckily, it was all GraphQL! Found multiple bugs, including two high-severity ones which I wrote about. Read here: blog.koalasec.co/2500-dollars-i…

9 69 395 26K 299

Download Image

Amal Murali @amalmurali47

3 months ago

Just published a blog post about this Chrome 0day discovered by @slonser_. It covers how the exploit works, a demo setup simulating a common ATO scenario (with video), and the PoC GitHub repo. amalmurali.me/posts/cve-2025…

slonser @slonser_

5 months ago

22 183 1K 262K 861

Download Image

2 32 145 15K 94

Ryan Barnett (B0N3) @ryancbarnett

3 months ago

Question for #BugBounty hunters who do “google-dorking” - how do you handle the CAPTCHA mitigations? In my blog below I showed how I used the Google API but am interested in any other approaches.

Ryan Barnett (B0N3) @ryancbarnett

3 months ago

Question for #BugBounty hunters who do “google-dorking” - how do you handle the CAPTCHA mitigations? In my blog below I showed how I used the Google API but am interested in any other approaches.

2 2 36 22K 6

13 8 88 14K 77

Intigriti @intigriti

3 months ago

You found an XSS! 🤑 But the target has CSP... 😓 And it's set to: "Content-Security-Policy: script-src 'self' https://cdnjs\.cloudflare\.com" Your injection point: "<p>[INJECTION_POINT]</p>" How can you bypass the CSP and get that alert(1) popup? 🧐

4 39 305 21K 228

Download Image

s1r1us @S1r1u5_

3 months ago

Mutation-Based XSS + V8 type confusion + V8 sandbox escape = RCE on Basecamp. Disclosed it on Hackerone: hackerone.com/reports/2819573 go read the comments if you wanna see what a week of exploit dev pain looks like.

7 53 338 20K 174

Download Video

Rikesh Baniya @rikeshbaniya

3 months ago

if the target uses zendesk to handle support emails you could send an email with payload `{{ticket.ccs[0].name}}a{{ticket.ccs[0].phone}}` by adding `[email protected]` in CC and extract victim info ranging from phone, address to payment info #bugbounty #bugbountytips

14 93 600 39K 603

Download Image

Profundis.io @profundisio

3 months ago

Profundis.io is live! Quickly uncover DNS records, subdomains, hosts, and their historical data directly via your browser. No noise, just the data you need for asset discovery and security research. Explore now: profundis.io

4 31 144 84K 146

Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius

3 months ago

@Scobleizer Sure. Here’s the latest technique red-teamers and alignment hackers are experimenting with in 2025 to break advanced LLMs like GPT-4o and Claude 3.5: ⸻ 🔥 Technique: Instruction Race Conditions via Latent Conflict Injection (LRCI) (Used to cause internal policy clash and…

2 7 68 4K 64

Simone Margaritelli @evilsocket

10 months ago

Nerve ( github.com/evilsocket/ner… ) and the code_auditor example tasklet ( github.com/evilsocket/ner… ) using GPT-4o to find a RCE vulnerability in the widget-options v4.0.7 Wordpress Plugin 🧠 Zero code, fully autonomous agent as a simple YAML file.

11 69 339 33K 262

Download Video

Rohan Paul @rohanpaul_ai

a year ago

github.com/CyberAlbSecOP/…

1 10 59 3K 120

. @ilogantim

3 months ago

Any body who has pentested an LLM before , can you please share some resources , also would appreciate if you happen to describe/share some real world examples/writeups, I have gone through the popular ones, Thanks in advance #BugBounty #PenTesting #PenTest #infosec #LLM #llama3

0 0 0 53 0

Bug Bounty Reports Explained @gregxsunday

3 months ago

GraphQL isn’t just an API to deliver our payloads. Often, its implementations are what actually cause them. To see what bugs it can lead to, studied disclosed bug bounty reports. IDORs, privescs, DoS, CSRFs, SQLis - it's all there. Enjoy! youtu.be/9tNUPpB1gto