OffsecPedia_QF

InfoSec Lover

[Ruben Hassid @rubenhassid]

People think learning Claude takes days. It doesn't.

I wrote 17 free guides that teach it in hours:

Claude 101: https://t.co/HNa5MrCLVU
Claude Code: https://t.co/O2kJvFkgan
Claude Skills: https://t.co/jT4uB5Bdjw
Claude Design: https://t.co/q1zjMfeAyg
Claude for Excel: https://t.co/7g3CFNcKrs
How to Prompt: https://t.co/EE46WHU8vg
Claude + Linkedin: https://t.co/9d5stC6grm
Be good at Claude: https://t.co/SVGd967eMQ
Stop writing like AI: https://t.co/JWKUGNKgOS
Claude Certificates: https://t.co/9jKsXWOt66
Claude for your team: https://t.co/U1JsBVCzYH
Claude Connectors: https://t.co/TSAQqOpDeV
Set up Claude Cowork: https://t.co/diDhiKkfjs
Stop Prompting Claude: https://t.co/j1LATSJiat
Claude to sound like you: https://t.co/kDGBpSF7Wh
Stop hitting Claude limits: https://t.co/j5fEzSH5br
Stop using Claude at work: https://t.co/c6X55Thy6t

___

PS: I'm Ruben Hassid, and I want us to master AI before it masters us, with simple instructions.

Follow me never to miss my 2x daily posts.

You want to help someone in your network? ♻️ Repost this so they can find the best free resources.

[just_me @Just_wikicat]

Excited to share that my latest article is now live on @hackernoon ! 🚀

I built SentinelIQ, a graph-native SOC that reconstructs cyberattacks instead of generating disconnected alerts. It combines UEBA, real-time correlation, MITRE ATT&CK mapping, and decentralized compute on @nosana_ai .

Read it here:
https://t.co/rxBOTADAaG

#CyberSecurity #AI #SOC #Nosana #Hackathon

[Hasan Toor @hasantoxr]

Loop Engineering is the next step after prompt engineering.

Most people still use Claude Code, Codex, Cursor, or Grok like a chat box:

Prompt.
Wait.
Copy.
Fix.
Prompt again.

This repo shows the next step:

You stop prompting the agent.

You design the loop that prompts the agent for you.

Inside:

→ Daily triage loops
→ PR babysitter loops
→ CI sweeper loops
→ Dependency sweeper loops
→ Changelog drafter loops
→ Post-merge cleanup loops
→ Issue triage loops

It also gives you CLIs to:

• Scaffold a loop
• Estimate token cost
• Audit if your repo is ready
• Add memory/state
• Add human handoff
• Add verification gates
• Run agents safely through GitHub Actions

The wild part is the shift in thinking.

Prompt engineering was about writing better instructions.

Loop engineering is about building a system where agents keep working, checking, fixing, and escalating without you babysitting every step.

This is what AI coding looks like when it stops being a chat session and starts becoming an operating system for software teams.

Repo: https://t.co/2USzC6KHUt

[x86byte @x86byte]

We're building a small community around binary security research — RE, obfuscation, exploit dev, compilers, malware analysis, binary hardening.

GitHub → https://t.co/3EqUEqV2yO
Discord → https://t.co/eO0YbarXZM

come join us. Always happy to meet more RE people.

[Profundis.io @profundisio]

Claude can hunt. Now it can see.

The Profundis MCP gives Claude the one thing it was missing in bug bounty: recon data. Hosts, DNS, WHOIS, TLS certs, subdomains, ASN, perceptual favicon search.

Watch it map a real public target end-to-end.

[0xor0ne @0xor0ne]

Reverse engineer and get full root access on a TP-Link Tapo C200 (@qkaiser, 2025)

https://t.co/bZs0gVGO5L

#infosec

[pkqs91 @pkqs91]

https://t.co/Ae4Pbk32vZ

[OffsecPedia_QF @Hacks23715974]

@VittoStack Would like to join , thanks

[André Baptista @0xacb]

We've all been there: found an XSS, blocked by CSP.

There's a bunch of CSP bypasses that you can try by @renniepak:
https://t.co/0aA3GyIOVz

It has a compilation of bypasses, based on the exact CSP you're up against. 

Here’s a quick tutorial on how to use it 👇

[Ridark @ridark_eth]

I genuinely don't understand why everyone isn't using this yet

Andrej Karpathy, a co-founder of OpenAI, posted a simple idea that hit 16 million views: stop using AI to write code, use it to build a second brain.

You point Claude Code at a folder, drop in any source, an article, a transcript, a PDF, and Claude reads it, links it, and files it into a living wiki of everything you know. It compounds like interest, the more you feed it, the smarter it gets.

Here's the whole thing:

> Install Obsidian, create a vault, open it in Claude Code

> Paste Karpathy's wiki idea file and tell Claude to build it

> Claude makes three folders: raw for sources, wiki for its pages, a CLAUDE.md that runs it

> Drop any source into raw and say "ingest this"

> Ask questions across everything, forever

Five minutes to set up, and you never start from a blank chat again.

Full step-by-step guide with Claude and Obsidian, link below.

Bookmark this

[Swissky @pentest_swissky]

The Mythos We Have At Home: A Patch-Diffing Pipeline for N-Day Generation - Tyler Holmwood - @originhq
https://t.co/qM0ClRVskh

[7h3h4ckv157 @7h3h4ckv157]

How I Use Every Claude Code Feature as a Security Engineer - Part 1

Author: Muh. Fani "Rama" Akbar
Read: https://t.co/qogHXeDacc

[Tech with Mak @techNmak]

CocoIndex Code is a semantic code search engine for your codebase that plugs into Claude Code, Codex, and Cursor.

Your coding agent currently searches your code the way grep does - by text.

CocoIndex Code gives it AST-based semantic search instead. It indexes code structure and meaning. Your agent finds the right functions by describing what they do, not by guessing what they're named.

The result: 70% fewer tokens on codebase searches.

Here is what that looks like in practice:
ccc search "find how user sessions are managed" => returns session management logic even if the word "session" never appears in function names.

ccc search "authentication error handling" => returns the three relevant functions instead of every file mentioning "auth."

ccc search "database connection pooling" => finds ConnectionManager, not 400 grep results.

Install as a Claude Code skill:
npx skills add cocoindex-io/cocoindex-code

The skill handles everything - initialization, indexing, keeping the index current as files change. You don't need any config file or database to manage. No API key required for local embeddings.

Built on CocoIndex, a Rust-based indexing engine. Supports 28+ languages. Works via Skill or MCP.

80k downloads per month. Apache 2.0. Open-source.

Here's the GitHub Repo: https://t.co/bQ2MjyJmNW

[Densel @luckyhacker43]

First public macOS kernel memory corruption exploit on Apple M5 🤯🔥

👨‍💻 Calif Team
🔗 https://t.co/UUMeELSA6c
🔗 https://t.co/c2BgqhjLHU

[Vincent Yiu @vysecurity]

Turns out the Russian guy was using https://t.co/KU1ukP7Esx to run the FortiBleed...

[7h3h4ckv157 @7h3h4ckv157]

Kernel-Exploit-Dojo 📍

Curated archive of 100+ Linux kernel exploitation CTF challenges, organized by bug class, exploitation primitive, final technique, difficulty, and solve count.

The goal is to organize practical kernel pwn techniques such as UAF, heap spraying, pipe_buffer abuse, msg_msg, modprobe_path overwrite, and cred overwrite.

Resource: https://t.co/h1F2CD70Oc

[s1r1us (mohan) @S1r1u5_]

this is insane, if you have a money-printing machine and can max out tokens, then sure, it is worth keeping an agent in the loop and feeding it every single file.

a better harness, cheaper models, and a strong group of security researchers can produce the same results, or even better ones, at a fraction of the cost.

[Exodus Intelligence @XI_Research]

We’re opening the Exodus research vault.

Over the coming weeks, we’ll publish technical writeups highlighting vulnerability research, exploit development, and deep reverse engineering from our team.

First up: Michele Campa’s Adobe Acrobat Reader Escript.api use-after-free RCE.

https://t.co/iycMuZQLix

#VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #OffensiveSecurity #CyberSecurity

[Tyson Benson @tysonbenson]

My IoT Firmware Hacking playlist is live.

The full series:
🔌 Dump firmware with a $15 CH341A programmer
🔬 Extract squashfs with binwalk and dd
🔑 Find hardcoded AES keys in Ghidra
🥷 Same analysis in Binary Ninja - then decrypt the files
🤖 EMBA scan → 2,732 CVEs in one camera

From zero hardware knowledge to exploitation.

🎥 https://t.co/qa1ijUhgNz

#IoTHacking #FirmwareHacking #HardwareHacking #Binwalk #Ghidra #CH341A #CyberSecurity

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4