Pwnr @pwnx0

Pentester | BBH | CPTS, eWPTX, eCPPT, eMAPT, CAPen, CAPenX 404 - Not Found Joined May 2020

Tweets

370
Followers

457
Following

2K
Likes

5K

JS0N Haddix @Jhaddix

2 days ago

Big shout to our friends and sponsors @TheSecOpsGroup (New Giveaway!) ⬇️ At DEF CON 2025, they handed out THOUSANDS of FREE Exams! The SecOps Group have also just dropped a massive 80% discount code on two of their best selling eXpert category exams: 🧩Certified AppSec…

8 22 50 3K 2

Download Image

Altered Security @AlteredSecurity

2 days ago

GIVEAWAY!! 🔥 We’re giving away 1 seat of @AlteredSecurity Certified Evasion Techniques Professional (CETP) – Evasion Lab. 🚀 👉 How to participate: 1️⃣ Like 👍 this post 2️⃣ Repost🔁 3️⃣ Comment 💬 what makes it useful to you 4️⃣ Follow @nikhil_mitt & @AlteredSecurity A random…

188 218 308 15K 27

Download Image

The SecOps Group @TheSecOpsGroup

2 days ago

🚨 𝗘𝘅𝗰𝗶𝘁𝗶𝗻𝗴 𝗡𝗲𝘄𝘀! 🚨 We are thrilled to announce an 80% discount on the 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗲𝗫𝗽𝗲𝗿𝘁 (𝗖-𝗔𝗗𝗣𝗲𝗻𝗫) exam, the 𝗺𝗼𝘀𝘁 𝗮𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗔𝗗 𝗽𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗲𝘅𝗮𝗺 yet! 🎉 𝘞𝘢𝘯𝘵…

18 27 46 2K 7

Download Image

Rana Khalil 🇵🇸 @rana__khalil

3 days ago

🎉 New Course Alert + Giveaway! 🎉 I'm excited to announce a brand-new course on Rana Khalil's Academy - OAuth 2.0 Vulnerabilities. This course includes: 📚 A technical deep dive into OAuth 2.0 and OpenID Connect: what they are, how they work, the common pitfalls in…

171 231 614 33K 220

Download Image

Laluka@OffenSkill @TheLaluka

3 years ago

For all non-french speakers out there, I finally found the time to write the article associated to "1001 ways to PWN prod!" ^.^ thinkloveshare.com/hacking/1001_w… For all those that welcomed this talk so well - cc @clintgibler @absoluteappsec @yeswehack @intigriti @chybeta @ManoMano_Tech

6 95 259 0 90

Download Image

عبدالله الرشيدي @3bdullaM9

2 weeks ago

مقاله لطيفه 👌: شخص حصل على المركز الاول في CTF Bug Bounty Village في ديفكون وكتب مقالة عن التحديات : shubhamchaskar.com/defcon-bbv-ctf/

0 8 71 3K 53

Joseph Thacker @rez0__

2 weeks ago

What’s the shortest possible domain that can be used for XSS/SSRF payloads when hacking/bug hunting? I think it’s something like: ⒉ﬆ And it’s available to register actually 😳 read more in my latest blog post. Link below.

5 14 125 11K 88

Download Image

zere @j_zere

3 weeks ago

Just published my first blog post "Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover" You can read the full write-up here: zere.es/posts/cache-de…

26 118 492 30K 367

Pwnr @pwnx0

3 weeks ago

Fuck isreal and fuck everyone who supports it.

0 0 1 151 0

André Baptista @0xacb

4 weeks ago

Just released a new recollapse version thanks to @ryancbarnett and @4ng3lhacker after their talk in @BlackHatEvents today. What’s new? 💥Mode 6: Fuzz case folding/upper/lower 💥 Mode 7: Fuzz byte truncations 💥 Recollapse is now available to use as a python library and…

5 75 376 16K 264

Download Video

PortSwigger @PortSwigger

a month ago

🚨New Black Hat research released: Over $200k in bounties earned in just two weeks. Join the movement to kill HTTP/1.1 today ⬇️ 🔍PortSwigger’s James Kettle (@albinowax) introduces two new classes of HTTP desync attacks capable of compromising credentials on tens of millions of…

6 34 166 17K 59

Download Image

Paweł Hałdrzyński @phaldrzynski

a month ago

Nice trick showing that the very same zip can be seen differently by two different programs. I've examined how this quirk could help us in zip path traversal attacks: blog.isec.pl/disguises-zip-…

Gynvael Coldwind @gynvael

2 months ago

Nice trick showing that the very same zip can be seen differently by two different programs. I've examined how this quirk could help us in zip path traversal attacks: blog.isec.pl/disguises-zip-…

1 24 104 23K 76

Download Image

0 25 85 11K 67

Soroush Dalili @irsdl

2 years ago

#ASPNET web form tip when bypassing certain WAF rules using #COOKIELESS: ✔️WAF blocks `/admin/main.aspx` ✔️WAF uses canonicalization & not case sensitive Possible bypasses: 🍪/admin/(S(X))/main.aspx 🍪/admin/Foobar/(S(X))/../(S(X))/main.aspx 🍪/(S(X))/admin/(S(X))/main.aspx

5 32 121 10K 55

H’s mom @aiishadahir

a month ago

Calm your heart, it’s just the dunya

7 4K 14K 351K 722

Download Image

d3d aka dead (dead, мёртв, 死了) @deadvolvo

a month ago

blog.malicious.group/the-quiet-side… This is a living document at the moment, but here it is for now. 😅As mentioned in the paper, if you are a researcher and have questions after reading, just reach out to me and I will answer everything I can.

9 67 240 19K 197

Mateo Hanžek @h4nsmach1ne

a month ago

Sharing a mini technique, useful to increase chances of scoring a successful CSRF attack in JSON endpoints, such as GraphQL or REST APIs. Enjoy! h4nsmach1ne.blogspot.com/2025/07/csrf-i…

3 12 70 4K 64

Mustafa Can İPEKÇİ @mcipekci

2 months ago

During a recent pentest, the target had an SQL injection vulnerability but was behind a WAF. Standard payloads using LIKE, =, IN, etc., were blocked, preventing exploitation. As the target used PostgreSQL, I bypassed this using the ~ operator, unique to PostgreSQL. The…

2 32 164 10K 93

/r/netsec @_r_netsec

2 months ago

FortiWeb Pre-Auth RCE (CVE-2025-25257) pwner.gg/blog/2025-07-1…

1 19 69 6K 30

Douglas Day @ArchAngelDDay

5 months ago

There's ALWAYS a bug. Always. The app that everyone & their mom uses? The one that's owned by Megacorp X/Y/Z/whatever? Littered with bugs. The app being developed by engineers making $500k+/yr? Crawling with bugs. The app that's been through 30 pentests? Bugs. Go find them.

13 58 400 18K 87

xploiterr @_xploiterr

2 months ago

Input field is vulnerable to CSTI however ' and " are converted to HTML entities so simple payload were not working. Found a Payload: {{x=valueOf.name.constructor.fromCharCode;constructor.constructor(x(97,108,101,114,116,40,49,41))()}} #bugbountytips