Arthur

That Security Guy

[Arthur @ArthurHewitt]

@Anian_Z Great idea, thanks @Anian_Z !

[Arthur @ArthurHewitt]

What do you do when you find a vulnerability in a banking app and when you report it to them they say it's out of scope? I can't publish it without consent due to their terms and conditions. This vuln could be exploited to harm customers and they don't seem to care 🤷

[Arthur @ArthurHewitt]

@om_patel5 Hilarious! This reminds me of https://t.co/hAjIx3jpKZ

[Arthur @ArthurHewitt]

@Dinosn Very nice! Has it been reviewed for malicious code/prompt injections? 🤔

[Arthur @ArthurHewitt]

@Jhaddix Don't let the haters get you down Jason, your work is appreciated!

[Arthur @ArthurHewitt]

@EvanKlein338226 That is good advice. I'll be sharing my findings after I spend more time researching.

[Arthur @ArthurHewitt]

I've recently been enjoying experimenting with AI Agents for penetration testing and bug bounty work. Feel free to read my blog post about it: https://t.co/3PXjsALnXF

[Arthur @ArthurHewitt]

@EvanKlein338226 Hi Evan, I was planning on creating a skill to handle auth flows

[Arthur @ArthurHewitt]

Have you ever looked under a rock and regretted it? 😲

Here's a story about one time I did exactly that

https://t.co/NfNwDSyfbw

[Arthur @ArthurHewitt]

LastPass phishing email has "unsubscribe" in Japanese at the bottom. Should have tested your own phishing template 🤦

[Arthur @ArthurHewitt]

Good guy Jason sharing some very useful info!

[JS0N Haddix @Jhaddix]

🔍 My ultimate workflow for simple and easy JavaScript Analysis

⚡️ Comprehensive JavaScript analysis in offensive security, appsec testing, and red teaming wins.

Often you can find juicy hidden endpoints, parameters, & domains buried JS!

A thread 🧵 1/x
👇

[Arthur @ArthurHewitt]

@UK_Daniel_Card I guess that's considered social engineering... 🤦‍♂️

[Arthur @ArthurHewitt]

@oconnellwhittet So true... Luckily we've got some new legos and books 🎉😀

[Arthur @ArthurHewitt]

Pro Tip, DuckDuckGo has a handy Javascript Beautifier that's definitely helping me do some static code analysis.

[Arthur @ArthurHewitt]

I just received my first bounty! Two like this. I started as a triager years ago and enjoyed bug bounty so much I became a hunter :) #BugBounty

[Arthur @ArthurHewitt]

I wholeheartedly agree. The more I've learned how to hack, the more people I can protect.

[Alberto Daniel Hill 🇺🇾🏴‍🏴‍☠️ @ADanielHill]

Hackers are the unsung heroes that keep the Internet free, safe, and fun. When people think of hackers they usually think of cyber criminals. Nothing could be further from the truth: hackers' number one goal is to make the world a better place for all users.
#cybersecuritytips

[Arthur @ArthurHewitt]

@0xGradius Build relationships with everyone, ask questions, read internal docs, learn the workflows others use to get things done, find those gaps where you can help most. You're a friendly guy, I know you'll do great 👍

[Arthur @ArthurHewitt]

@IanColdwater If we as security professionals become the "department of no", those we are trying to protect will work around us. Instead we need to build relationships with them to understand their needs and help them do things as secure as possible

[Arthur @ArthurHewitt]

I just completed the @tryhackme Throwback room! I learned a lot while going through this and definitely recommend checking it out: https://t.co/qaBY9hgASp

[Arthur @ArthurHewitt]

@sogonsec @zeropointsecltd I can personally recommend the AD course from @SecurityTube with @nikhil_mitt https://t.co/55vRGkOhp4

I'm just finishing the CRTP course and it goes very deep into attacking and defending AD