Luke Stephens (hakluke)

Dad x3, hacker (cybersecurity), marketing expert, serial entrepreneur.

CEO of cybersecurity companies: Ironbark Cyber, HackerContent, TRIAGERS™.

[Luke Stephens (hakluke) @hakluke]

Quick reintroduction, because a lot of you followed me for hakrawler and XSS payloads.

Since then: 3 kids, and a group of cyber companies. HackerContent runs social for cyber brands (some accounts you follow are ours!). Ironbark Cyber does offensive work. TRIAGERS™ handles bug bounty triage. I'm also a partner at Submersion AI, training small cyber models that hold their own against frontier ones.

These days most of my hacking runs through AI agents I built. Most of my consulting is helping businesses hand real work to AI without it blowing up.

That's what I'll post about.

Good to be back.

[Luke Stephens (hakluke) @hakluke]

I wrote a blog about how to set up your hacking tools for your hacking AI agent

[Detectify @detectify]

Doug McIlroy wrote the design rules for AI agents in 1978: “Make each program do one thing well.”

New on our blog: @hakluke on building a hacking agent out of tiny, boring tools 🧵

[Luke Stephens (hakluke) @hakluke]

https://t.co/wb3MnOIiGX

[Luke Stephens (hakluke) @hakluke]

A single typo in a government DNS record whitelisted +32k IPs to send authenticated email as a local government.

Research from SH Consulting found 43 US state and local .gov domains with dangling DNS records, ranging from a missing letter in Amazon SES (https://t.co/HJHyVNZXGl) to misspelled Proofpoint subdomains listed for sale for $350.

Because these typos pass SPF, an attacker doesn't need to breach a server or bypass MFA. They just buy the typo domain and start blasting out mail that looks fully authorised.

Full breakdown 👇

[Luke Stephens (hakluke) @hakluke]

@garethheyes Awesome - I feel like Burp AT has struck a really good balance between full autonomous AI and human testing

[Gareth Heyes \u2028 @garethheyes]

Help your 'self' to some credentials.

Content-Security-Policy: default-src 'none'; form-action 'self';

Learn how to bypass this CSP and exfiltrate credentials using a Burp AT skill. Link to blog post 👇

[Luke Stephens (hakluke) @hakluke]

@synick it's been a while mate hope you're good!

[Luke Stephens (hakluke) @hakluke]

What’s your cybersecurity take that has you feeling like this?

[Luke Stephens (hakluke) @hakluke]

@synick not to be confused with pi (π), or pie 🥧

[Burp Suite @Burp_Suite]

Burp AT brings a whole new level of automation to your favorite intercept proxy!

We are very excited to see what you'll do with it.

[Luke Stephens (hakluke) @hakluke]

@Hacker0x01 @HackerContent https://t.co/EfbwKZMRcH

[Luke Stephens (hakluke) @hakluke]

Over a year ago, we wrote a blog post for @Hacker0x01 on The Origin of AI Security and Agentic Defence.

We were just starting to dive into the topic back then. It's crazy to see how many of our clients at @HackerContent are actively working on agentic defence/pentesting today.

It makes me wonder what early trends we’re researching now will be mainstream next year.

Check out the original blog post 👇

[Luke Stephens (hakluke) @hakluke]

@mdp_sec Does it handle private programs?

[Luke Stephens (hakluke) @hakluke]

@iguptapankaj This is literally the slop I’m talking about👆

[Luke Stephens (hakluke) @hakluke]

Running a marketing agency for security companies has really taught me the importance of founder-led marketing... and it's especially true in 2026 when socials are filled with sloppy slop.

Time after time, I watch the companies who have high-profile founders winning. People go to them because they trust them personally - and the brand is an extension of them.

[bugcrowd @Bugcrowd]

ASN enumeration is an important yet frequently overlooked recon method.

Finding the ASN can reveal the target's network ranges.

Tools include:
- https://t.co/uMX4tHKKY3
- https://t.co/z8bIbQABb3
- @Yassineaboukir's ASNlookup

And more!

What tools do you like to use?

[Luke Stephens (hakluke) @hakluke]

@0xTib3rius @chrmina CVSS 11

[Luke Stephens (hakluke) @hakluke]

I’m in one of those local Facebook groups and every other day someone posts a grainy photo of a shoplifter and there are 100 comments saying “can someone who has AI please enhance the face” and then someone actually does it but the AI face looks nothing like the shoplifter so they get away with it

[Web Security Academy @WebSecAcademy]

How to Find Path Delimiter Issues with Burp Suite Intruder

Sometimes web servers treat special characters (like ; or ?) differently in URLs.

This can lead to security issues like web cache deception or access control problems.

Here's how you can test for path delimiter discrepancies:

1️⃣ Capture the Request

Find a request you want to test

GET /my-account HTTP/2

2️⃣ Right click the request and "Send to Intruder".

In Intruder, highlight add a new position after /my-account followed by abc. It should look like this:

GET /my-account§§abc HTTP/2

Attack Type = Sniper (only changing one spot).

Payload: Paste a list of special characters, like this:
!
#
$
%
&
'
(
)
*
+
,
-
.
/
:
;
=
?
@
[
\
]
_
~
...
A full list of delimiters can be found here: https://t.co/MR8nOlPONM

3️⃣ Start the Attack

Press Start Attack.

Look at the Status, Length, and Response columns.

Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉

Why is this important?

When special characters confuse the server or cache, you might find:
🔸 Web cache deception: Caching personal pages by accident
🔸 Access bypass: Skipping security checks
🔸 Leaked info: Seeing data you shouldn't

Try this lab for yourself and dive even deeper into how to exploit this when you find it: https://t.co/BNsSJCWkn5

#BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity

[Luke Stephens (hakluke) @hakluke]

Companies need to stop using AI models that live in someone else's datacentre. It's a huge security risk that everyone is just ignoring. Not only that, but you don't control it, so you might lose access to the functionality you need from that model.

At @SubmersionAI our Basin model, under 50B parameters, made the CyberGym top 10 and can run fully air-gapped on (relatively) cheap hardware.

Now there's no excuse to keep sending your sensitive security information to third parties.

[Luke Stephens (hakluke) @hakluke]

Having 3 kids totally changed what I measure.

I used to count bugs, followers and revenue. Now I think in terms of the legacy I'll leave: what will still be standing in 100 years because I built it?

Most of what I've done so far doesn't pass that test. Watch this space.

[Luke Stephens (hakluke) @hakluke]

One of my north star goals is to use AI to make offensive security very cheap.

For so long, smaller orgs like your local hospital or school have not been able to afford cybersecurity services, even though they really need it. I want defence to get cheap first for the people who need it most.

I've been thinking hard about what that looks like, practically.