100xSecurity

100x smarter than an attacker

[100xSecurity @100xSecurity]

@ClaudeDevs This is some illness

[100xSecurity @100xSecurity]

How do you learn Malware Analysis?

[Mohit Khemchandani @mohitkchandani]

Ultimate regret of buying @VW Virtus 2025

Hi everyone,
I am posting here because I am completely exhausted dealing with my @VW Virtus issue and I honestly do not know what to do next.

[100xSecurity @100xSecurity]

@hetmehtaa Learn Cybersecurity from us

[100xSecurity @100xSecurity]

@curtismakes @hetmehtaa From where is it?

[100xSecurity @100xSecurity]

@curtismakes @hetmehtaa Lol

[100xSecurity @100xSecurity]

@hetmehtaa Damn

[100xSecurity @100xSecurity]

@hetmehtaa Thanks for sharing

[Het Mehta @hetmehtaa]

Breaking Down GreenPlasma and YellowKey Vulnerability for beginners

https://t.co/Yq6bfTXSwt

[Het Mehta @hetmehtaa]

Mini Shai-Hulud npm worm is back.

This time it hit 300+ packages, including AntV packages, echarts-for-react, timeago.js, size-sensor, and canvas-nest.js.

A compromised npm account published hundreds of malicious versions in just ~22 minutes.

The payload ran through a preinstall hook.

Meaning: you didn’t need to use the package.
Installing it was enough.

It hunted for GitHub tokens, npm tokens, AWS/GCP/Azure creds, DB strings, Stripe keys, Slack tokens, SSH keys, Docker auth, Kubernetes configs, Vault tokens, and more.

It also tried Docker escape if the host socket was exposed.

And the nastiest part?

It targeted CI/CD, GitHub workflows, and even AI coding tool hooks like Claude/Codex session startup.

Modern software supply chain security is basically:
“Do you trust this dependency?”

Wrong question.
The real question is:

“If this dependency turns evil for 20 minutes, how much of your company does it get access to?”

[Het Mehta @hetmehtaa]

XXE happens when an app accepts XML and its parser allows external entities. An attacker can abuse this to read local files, hit internal URLs, or leak data externally.

Here's a List of XXE Resources

Labs
1. PortSwigger XXE Academy - https://t.co/RUWYwOgTA5
2. TryHackMe XXE Injection - https://t.co/ePARDwpRaB
3. PentesterLab Play XML Entities - https://t.co/6MFfe3q73E
4. GoSecure XXE Workshop - https://t.co/JNMuxplEjt

Blogs & Guides
1. PortSwigger Official XXE Guide - https://t.co/RUWYwOgTA5
2. YesWeHack XXE Bug Bounty Guide - https://t.co/2Nq5KsSJBv
3. Codelivly XXE 101 - https://t.co/97iExuYa9T
4. HackerOne XXE Guide - https://t.co/hvL7W4uTwQ
5. OWASP XXE - https://t.co/ERodOrhQK4

Payloads
PayloadsAllTheThings XXE - https://t.co/itSzt6uw9x

Prevention
OWASP XXE Prevention Cheat Sheet - https://t.co/81w7xsk1Eb

[100xSecurity @100xSecurity]

How do you explain XXE Vulnerability to a beginner?

[100xSecurity @100xSecurity]

@hetmehtaa You’re Hacked

[100xSecurity @100xSecurity]

@hetmehtaa Yes It is an emergency

[Het Mehta @hetmehtaa]

https://t.co/vaA7H9pQZ1

[100xSecurity @100xSecurity]

@hetmehtaa Want a course for backup policy?

[100xSecurity @100xSecurity]

@hetmehtaa You should study RBAC now 🤣

[100xSecurity @100xSecurity]

@hetmehtaa Umm sure!
Contact us to start again

[Het Mehta @hetmehtaa]

security hot take:

most companies don’t have a vulnerability problem
they have an ownership problem

everyone knows the old admin panel exists
nobody owns it

everyone knows the staging server is public
nobody owns it

everyone knows the API key is shared
nobody owns it

attackers don’t exploit code first

they exploit the gap between “someone should fix that” and “who exactly?”

[100xSecurity @100xSecurity]

@hetmehtaa Client must be very happy 🤣