Divyanshu Kothari

[Divyanshu Kothari @11divk]

@suzan_mgr Yeah bro ik that but most of times these programs are scammy and don't pay well

[Divyanshu Kothari @11divk]

@eabubakr21 Which company?

[Divyanshu Kothari @11divk]

@zero_h4cks @Hacker0x01 Congratulations 🎉 your hackerone profile btw?

[Divyanshu Kothari @11divk]

@roohaa_n @Hacker0x01 @Bugcrowd In android do you find Core Android stuff or just find bugs in android APIs

[Xiaomi MiMo @XiaomiMiMo]

🚀 Better inference efficiency, lower costs, broader access.

MiMo-V2.5 Series API pricing is now permanently reduced — by up to 99% compared to previous pricing.
✨ Unified pricing across all context lengths.
MiMo Token Plans have also been upgraded:
• 5–8× more usable tokens at the same price
• Simpler and more transparent billing rules
🎁 As a thank-you to current users, all current Token Plan credits will be fully reset.
🎧 MiMo-V2.5-TTS remains free for a limited time.
⏰ Effective May 26 at 6:00 PM PDT.

These improvements are powered by continued inference optimization and serving efficiency upgrades across the MiMo stack.
🛠️ We’ll also publish a detailed technical blog on the inference optimizations later — stay tuned.

[Divyanshu Kothari @11divk]

@mishra_0x @msftsecresponse @intigriti Supply chain Rce ?

[Divyanshu Kothari @11divk]

@Damtap12 @defronixacademy @GodfatherOrwa Public or private?

[obscaries ❘ AppSec @obscaries]

🚨 If you're hunting GraphQL bugs, this repo is a goldmine

👉 “awesome-graphql-security” is a curated list of tools, techniques & real-world resources for both attackers and defenders

From recon → exploitation → learning paths… it’s all here

💣 Perfect for bug bounty hunters

🔗 https://t.co/9ThzitmPkz

👇 Start exploring before others do

[PentesterLab @PentesterLab]

𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟭𝟮, 𝟮𝟬𝟮𝟲
AI doing research, AI killing CTF

🤖 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗔𝗜 𝗳𝗼𝗿 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝟰 𝗔𝗽𝗽𝗿𝗼𝗮𝗰𝗵𝗲𝘀 & 𝗪𝗵𝗲𝗿𝗲 𝗜 𝗙𝗮𝗶𝗹𝗲𝗱
If you can only read one thing this week, make it this article: https://t.co/NEXjJq0DNR.

🛠️ 𝗛𝘆𝗼𝗸𝗲𝘁𝘀𝘂 – 𝗦𝗼𝗹𝘃𝗶𝗻𝗴 𝘁𝗵𝗲 𝗩𝗲𝗻𝗱𝗼𝗿 𝗗𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝘆 𝗣𝗿𝗼𝗯𝗹𝗲𝗺 𝗶𝗻 𝗥𝗘
Reversing Java and C# applications just became a lot easier thanks to the SearchLight Cyber team (ex: Assetnote): https://t.co/B1jvGSZ5Us.

🐧 𝗦𝗮𝘀𝗵𝗶𝗸𝗼
Sashiko is an agentic Linux kernel code review system that monitors public mailing lists to thoroughly evaluate proposed Linux kernel changes. https://t.co/cFTkYMFozI.

💀 𝗖𝗧𝗙 𝗶𝘀 𝗱𝗲𝗮𝗱*
A good rant on the impact of AI on CTF... https://t.co/Q18G1JvX2m.

[R. @Rzj77_]

Most talentless sport itw. A genetic lottery

[Profundis.io @profundisio]

Combining WHOIS and cert data is underrated for recon. Find a target's registrant org, then search for certs issued to that same org - suddenly you're finding staging servers and internal tools on completely different domains

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Here's *everything* you wanted to know about @rez0__'s AI workflow for hacking

HackerNotes TLDR for episode 166: https://t.co/NAgQXzzcVD

►⠀Claude Code skills should encode knowledge the model lacks and enforce deterministic workflows, not replace its creative reasoning
►⠀Build a fallback architecture in skills: primary tool → SDK/library → raw API, so the agent adapts when one layer fails
►⠀Structure your notes as a funnel: notes → leads → primitives → findings → reports to keep multi-session hacking organized
►⠀Run two parallel agents (one guided, one free-roaming) and cross-compare results to continuously improve your methodology

[Divyanshu Kothari @11divk]

@shydev69 I built something similar but running it locally for my own use

[Six2dez 🇵🇸 @Six2dez1]

It seems that my Burp AI plugin will never be in the BApp Store. The reasons are fair, but still 🥲

https://t.co/hmPn7oAUZd

[luna @lunarfq]

Rt for good luck 🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀 🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀 🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀 🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀 🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀🍀

[Behi @Behi_Sec]

Use this prompt for a thorough JS analysis:

You are an expert JavaScript reverse engineer and code analyst. I will provide you with
a JavaScript file. Perform a structured analysis with the following objectives:

## 1. High-Level Overview
- What is this code's purpose?
- Architecture pattern
- Key dependencies and frameworks used
- Execution flow: how does the code initialize and what is the main entry path?

## 2. Attack Surface & Endpoints
Extract and list ALL of the following in structured tables:

| Category | Examples to look for |
|-----------------------|---------------------------------------------------------|
| API routes/endpoints | paths, HTTP methods, route patterns |
| Parameters | query params, body fields, URL params, headers expected |
| Auth mechanisms | tokens, cookies, session logic, OAuth flows, API keys |
| WebSocket events | event names, channels, message schemas |
| External calls | fetch/axios URLs, third-party APIs, webhook targets |

## 3. Hidden & Interesting Artifacts
Look beneath the surface for:
- Hardcoded strings: URLs, IPs, hostnames, ports, internal service names
- Environment variables referenced (process.env.*)
- Database schemas, table/collection names, field names
- Role names, permission levels, feature flags
- Debug/admin/test routes or commented-out functionality
- Error messages that reveal internal structure
- Regex patterns (what are they validating/extracting?)
- File system paths (uploads, logs, configs, temp dirs)

## 4. Data Flow Map
Trace how user input moves through the code:
- Entry point (where does external data come in?)
- Transformations (parsing, validation, sanitization, or lack thereof)
- Storage (where does it end up: DB, file, cache, external service?)
- Output (what gets returned/rendered to the user?)

## Formatting Rules
- Use tables for structured data (endpoints, params, env vars)
- Use code snippets with line references for each finding
- Flag anything that seems intentionally obscured or unusual
- If the code is minified/obfuscated, note patterns and attempt to
identify the original framework or library

---

Here is the code:

<YOUR_CODE_HERE>

[Potato @potatosaysss]

you will celebrate something big very soon. claim it.