Sushant Vitthal Kamble

C|EH | OSCP | Bug Hunter | AppSec | Network PenTest

[MAX @MAXdeg0]

THIS IS F**CKING DANGEROUS

7 AI cybersecurity tools every builder should know before shipping their next product.

→ PentestGPT — autonomous pentesting

→ BurpGPT — AI-powered Burp Suite analysis

→ Security Copilot — blue-team investigation

→ Snyk DeepCode AI — code scanning + autofix

→ HexStrike AI — 150+ security tools + AI agents

→ Garak — LLM vulnerability testing

→ Lakera Guard — prompt injection + jailbreak protection

The interesting part?

AI is now showing up across the entire security stack.

-Offensive security.
-Defensive security.
-Code security.
-LLM red teaming.
-Runtime protection.

Some are fully open source and self hostable, while others are commercial platforms.

If you’re building AI systems, cybersecurity is becoming impossible to ignore.

BOOKMARK this before someone take it down

LINKS BELOW

[Coffin @lostsec_]

People seriously underestimate how dangerous leaked Google API keys are. With just a little know-how, you can use them to access Gemini without spending money.
This clip is just a small demo. I’ve covered a wide range of dorks and methods in my member only video.
https://t.co/l8dYOvxQ8A

[7h3h4ckv157 @7h3h4ckv157]

iOS/macOS penetration testing cheatsheet

https://t.co/cVdQo5xpPJ

[Security Harvester @secharvesterx]

CVE PoC Search
https://t.co/W5LMcqmIC1

[Patrik Grobshäuser @ITSecurityguard]

Our Security Research team at @SLCyberSec published a high-fidelity detection mechanism for the Next.js/RSC RCE (CVE-2025-55182 & CVE-2025-66478) -
https://t.co/D7JQz2CeDN.

There are a lot (!) of PoCs on GitHub that are adding noise to the problem

👇

[Coffin @lostsec_]

i made a simple CORS PoC, just replace the target and test it against a sensitive endpoint, since public ones usually don’t qualify for a valid report..
https://t.co/h7m8dSDsXr

[Yunus Emre Öztaş @ynsmroztas]

I've developed a professional and technical tool for Next.js (CVE-2025-55182) 🥳

I'm offering this tool, which allows you to perform both bulk and individual scans, as well as testing on live subdomains.

github;

https://t.co/6OXSyNHz2T

#DevTools #python #bugbountytip #bugbountytips #InfoSec #recon #nextjs #React2Shell

[xss0r @xss0r]

#xss0r just crawled 10,995 URLs and filtered it down to 644 unique

Scan finished in 2m47s . Results saved to .txt file

#xss0r #BugBounty #Recon #SecurityTools #crawler

[James Kettle @albinowax]

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

[Web Security Academy @WebSecAcademy]

How to manually check for CL.TE Request Smuggling Vulnerabilities:

1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked

0

G

5️⃣ Send request twice.

If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!

Try this out for yourself in our CL.TE lab: https://t.co/NvIsGL9cL1

[Intigriti @intigriti]

Exploiting Log4Shell in 2025 (complete guide) 😎

🧵👇

[Mehdi @silentgh00st]

🚨 MapperPlus 🚨 will be a JS beast for the #bugbounty #Security community
It includes :
1. In depth JS analysis engine
2. Pre-fetching
3. Headless browser integration to fetch dynamically loaded JS files
4. URL Blacklist
5. JS Monitoring (Change, Delete, New ...)
And More...

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

📚 ParamScan

ParamScan is a chrome extension for finding reflected parameters in a webpage.

Checkout on GitHub
https://t.co/9vv3o8Eteq

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[Tae’lur Alexis @TaelurAlexis]

Here’s my new blog post about finding and exploiting access control vulnerabilities on @portswigger :-)! Hope you enjoy https://t.co/aFOJbua8LO

[xss0r @xss0r]

🚨 Attention Bug Bounty Hunters and #xss0r Users!
The @ProwlSec channel has just published the ultimate video showcasing the power of the xss0rRecon Tool and xss0r! 🎥
https://t.co/HhJYobYMKL

Watch how this tool filtered #35516 URLs down to just #29 potential XSS vulnerabilities with unparalleled accuracy. 👀
🔥 This is a must-watch for anyone serious about web security and XSS hunting!

#BugBounty #xss0rRecon #WebSecurity #XSS #xss0rRecon #ibrahimxss

https://t.co/HhJYobYMKL

[VAIDIK PANDYA @h4x0r_fr34k]

OTP bypasses?
Here are 10 blogs for testing OTP bypasses for bug bounty

1. https://t.co/I1jt63eL6J

2. https://t.co/BOJyry8Fw9

3. https://t.co/oof8BJ4Qnf

4. https://t.co/TfKebfcQ3a

5. https://t.co/h3AQfHDA7A

6. https://t.co/eeCNgubnni

7. https://t.co/O2AGoQl67s

8. https://t.co/pJtcApgoXN

9. https://t.co/BI70Jalc2h

10. https://t.co/IyMoRhSjnT

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚀 Hunt Down Sneaky Open Redirects

gau https://t.co/bUWyUO46NU | gf redirect | qsreplace “$LHOST” | xargs -I % -P 25 sh -c ‘curl -Is “%” 2>&1 | grep -q “Location: $LHOST” && echo “VULN! %”’

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[nol @nol_tech]

Wrote a POC and vulnerability analysis for CVE-2024-9264

Grafana authenticated ""RCE""
https://t.co/Q23VOGATkQ