GREG_OR_'Y'='Y DRAPERI @[email protected]

Breaking into places where I have not been invited. Train hard, hack smoothly...but most of all, samy is my hero
My opinions are my own.

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@kultekin Great vulnerability and nice catch! Just to be sure I understood correctly. In the try it section crypt uses Alice's salt and not Bob's salt?

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@rez0__ @xssdoctor A lot of interesting insights. I am curious. Have you done the math between the cost and the earning through bug bounty found if sustainable? :)

[International Cyber Digest @IntCyberDigest]

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories.

The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft.

Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word."

Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case.

Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@_bagipro @threadreaderapp "unroll"

[Beaujeant @Beaujeant]

I just released ProtoPoke.

It’s a TCP/UDP/SOCKS5 proxy for protocol analysis: intercept and modify traffic live, replay sessions, fuzz with pluggable mutators, and control it all with an AI assistant via MCP.

https://t.co/QToXKSSkds

[Damian Strobel @damian_89_]

Better bug bounty recon starts with better DNS data.

Search domains, enumerate subdomains, and watch for newly observed assets as they appear.

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@Void_Sec I agree with your article but I think it focuses only on security research. One aspect of LLM is the possibility to automate part of pentests which is quite interesting.

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

https://t.co/4uAFmHlUHu @pentest_swissky

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@lastweekinfosec Thanks a lot! Best security newsletter.

[vx-underground @vxunderground]

Former BlackHat board member Vincenzo Iozzo, and co-author of iOS Hacker's Handbook, had a relationship with Jeffrey Epstein.

It appears Epstein attended DEFCON and/or BlackHat in 2013 and 2015, possibly 2016.

[Swissky @pentest_swissky]

If you’re doing security testing and not bookmarking this, you’re missing out 👀
PayloadsAllTheThings has a clean web version 👇
https://t.co/9S5AkbdmYU
#bugbounty #infosec

[8kSec @8kSec]

🎄 XMAS GIVEAWAY ALERT! 🎅✨
🎉🔥 To celebrate the holiday season, we’re giving away TWO 12-month FREE vouchers for any of our premium courses:
▪️ Practical Mobile Application Exploitation
▪️ Offensive Mobile Reversing and Exploitation
▪️ Offensive iOS Internals
▪️ Offensive Android Internals
▪️ Practical AI Security: Attacks, Defenses, and Applications

How to participate:
➊ Like 👍 this post
➋ Comment which course you’d like to win and tag one friend. If you win, both of you get FREE access!
➌ Repost 🔁
➍ Follow @8kSec so we can DM you if you win

🎁 Two random winners will be selected and announced on December 24, 2025, on our socials. Both the winner and their tagged friend will receive FREE access to the selected course.

🔗 Learn more about our courses: https://t.co/lWUydt1GpC

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@8kSec Practical AI Security: Attacks, Defenses, and Applications @pentest_swissky

[Paul Sec.jpeg .exe @PaulWebSec]

🚨 Calling all speakers, hackers, and storytellers.
Our old account got banned, but we are back and stronger.

Got a talk brewing for 2025 or 2026?
Submit your CFP on https://t.co/Uj0KYQUpBq and get discovered.
The community is waiting. 🔥

#cfp #infosec #security #hacking

[GREG_OR_'Y'='Y DRAPERI @[email protected] @DrapGreg]

@simps0n Thanks for all the work you do. Hope to see your weekly insights back soon.

[尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ @simps0n]

AppSec Ezine - 612th https://t.co/Py6Bx83mr1 #AppSec #Security

[Ministère de l'Intérieur @Interieur_Gouv]

#NoublionsJamais ⚫️ | Le vendredi #13Novembre 2015, la France est frappée en plein cœur : une série d'attentats est perpétrée à Paris et dans sa périphérie.

Aux abords du Stade de France à Saint-Denis, sur des terrasses de café et de restaurants des 10e et 11e arrondissements, dans la salle de spectacle du Bataclan... ces attaques terroristes provoquent la mort de 130 personnes et font 413 blessés.

Alors que des otages sont retenus et que le chaos règne dans la capitale, les forces de sécurité et de secours se mobilisent pour lutter contre les terroristes et prendre en charge les victimes.

10 ans après, nous leur rendons hommage à travers ces photographies avant-après réalisées par @A_Lecomte à partir des archives du ministère de l'Intérieur et d’un cliché de @BenFilarski.

2015-2025 : n’oublions jamais ! 🙏

© Histoire de rue ; Ministère de l’Intérieur / DICOM / F.Pellier, J.Rocha

[尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ @simps0n]

AppSec Ezine - 611th https://t.co/YG9tTwhwSQ #AppSec #Security

[尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ @simps0n]

AppSec Ezine - 610th 🎃 https://t.co/KyYRdIf6kh #AppSec #Security

[尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ @simps0n]

AppSec Ezine - 607th https://t.co/ZSARjgznty #AppSec #Security