Forbidden403

HTTP/2 403 Forbidden

[Forbidden403 @40rbidd3n]

🔥

[zhero; @zhero___]

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js

https://t.co/0JWjH6yzC2

[payloadartist @payloadartist]

Do you watch Netflix in your free time?

Try hackflix for security conference talks

https://t.co/SVbkWApdoe

#cybersecurity #bugbounty

[Forbidden403 @40rbidd3n]

DFRobot ♥️

[DFRobot @dfrobotcn]

Nice build from @40rbidd3n — a full open-source hydroponic stack. ESP32 firmware, async MQTT/TLS, InfluxDB telemetry, React dashboard, even RSA-2048 signed OTA.

Real-time pH, EC, water level, temp and humidity. Pair it with our Gravity pH and TDS probes and you've got a lab-grade rig in a grow tent.

https://t.co/DXsM7r1uiV

#SmartFarming #ESP32

[Forbidden403 @40rbidd3n]

I just vibe-coded a hydroponic farming system for the future when AI replaces all IT jobs💀

HydroOne: a production-grade hydroponic system

- ESP32 firmware (C++)
- MQTT real-time
- Fastify backend + InfluxDB
- RSA-signed OTA updates
- React dashboard

https://t.co/kytp7sRbdk

[James Kettle @albinowax]

I've just submitted my latest research to Black Hat USA! This one has been cooking since last June, can't wait to share it with the world... in fact I'm quite excited just to see the community reaction to the title reveal.

[Jenish Sojitra @_jensec]

✨ Launching https://t.co/muyolpXluI - free, community, no signup

Stop blindly installing OpenClaw skills like Maniac.

My friend mass-installed OpenClaw skills for a client project last month. Two days later his AWS bill exploded. A skill that looked totally legit was quietly stealing his credentials the whole time.

Together we built Clawned

Paste any skill → scanned against 60+ threat patterns in under 2 seconds.

6,500+ skills scanned so far. 1 in 5 flagged something.

Stop trusting https://t.co/hVK0WIHzvr files blindly.

[Forbidden403 @40rbidd3n]

@theXSSrat Glad you found it interesting XD

[Forbidden403 @40rbidd3n]

Just published my write-up for @Intigriti challenge 0226 by @d3dn0v4

Stored XSS & CSP bypass. A nice example of how client-side rendering + JSONP can break strict CSP

Read it here: https://t.co/61U2Zd2XQF

#bugbounty #infosec #xss #ctf

[zhero; @zhero___]

second research on Astro, a shorter paper than usual, which led to CVE-2025-64764 (w/ @inzo____):

Unlocking Reflected XSS in the Astro framework

https://t.co/7G90FyCEj2

all applications using the Server Island feature are vulnerable

[zhero; @zhero___]

release of our new paper (w/ @inzo____) which resulted in CVE-2025-64525:

Astro framework and standards weaponization

from path-based middleware protection bypass to potential SSRF & XSS + full bypass of CVE-2025-61925 on @astrodotbuild

https://t.co/xTO55gNFu4

[Forbidden403 @40rbidd3n]

@jaymiee__ @chux13786509 Thanks a lot. appreciate it 🫡

[Forbidden403 @40rbidd3n]

Just published my write-up for the Intigriti's October challenge by @chux13786509 🕵️‍♂️

→ https://t.co/YTESN2cECv

#bugbounty #infosec #CTF #writeup #bugbountytips

[Forbidden403 @40rbidd3n]

@chux13786509 Really glad you liked it, was such a fun challenge🔥

[Jenish Sojitra @_jensec]

Is most Pentest companies are scam?

Just saw a $30k Pentest report with 8 informative findings and only valid findings were missing cookie flags, rate limit on apply account and origin check.

[Forbidden403 @40rbidd3n]

Just got a bounty from @Apple for reporting a security vulnerability
Grateful to be recognized through the Apple Security Bounty program
#BugBounty #Apple

[Forbidden403 @40rbidd3n]

@daoud_youssef جربتها فكرة جميلة ان تعمل فقط border كنوع من alert غير مزعج لكن مرات تطلع false positive حتى على توتير بسبب head method ولانه في 403 responses لايكون x-frame-options لذا اضفت هذا condition
if (client.status!==403 && upper.includes("X-FRAME-OPTIONS")!==true)
يجب التحقق حتى من csp

[Forbidden403 @40rbidd3n]

@pranshux0x @bxmbn @Bugcrowd I agree