Bastos

[Web Security Academy @WebSecAcademy]

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇

Try this Practitioner lab now: https://t.co/7PTUqvwHSd

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

Computer vision analysis using yolo v8

[AilaunchX @Ai_Tech_tool]

INSTEAD OF WATCHING NETFLIX TONIGHT.

Spend 1 hour with this.

Claude AI FULL COURSE that teaches you how to BUILD and AUTOMATE anything.

The people who watch this tonight will wake up tomorrow with a new skill.

Watch it and Bookmark it now.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

@Bugcrowd Change GET to DELETE 😎

[bugcrowd @Bugcrowd]

⏰ 30s to find a bug
1️⃣ You can only send a single HTTP request

👇 What’s your payload?

[shubs @infosec_au]

We've just released a high fidelity scanner for CVE-2026-41940 (cPanel/WHM authentication bypass). All public PoCs so far lead to false negatives, and are not reliable. @SLCyberSec's research team's notes on this here: https://t.co/7gik0IY4Cl & tool here: https://t.co/RKoB6WaSQk

[Intigriti @intigriti]

Master broken access control vulnerabilities! 😎

A thread! 🧵👇

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Good work mate, waiting to test it internally 😂

[André Baptista @0xacb]

Exposing Instagram posts from private users. A writeup by @rub003 

https://t.co/kWhb9Yaa0L

[André Baptista @0xacb]

Need to find the APIs the devs forgot about?

Combine waymore with xnLinkFinder or similar.

- waymore: Gathers the archived URL responses.
- xnLinkFinder: Extracts the hidden paths and parameters.

GitHub repos 👇

https://t.co/Npto8caKYR
https://t.co/C4GeKiCVfv

[Jaynit Makwana @JaynitMakwana]

Instead of watching a 2-hour movie, watch this Claude FULL COURSE (Build & Automate Anything):

[CLEAN CAR CLUB @TheCleanCarClub]

How to tie a tow rope correctly

[ProjectDiscovery @pdiscoveryio]

Move beyond simple discovery. Pair Subfinder with httpx to instantly profile your attack surface by extracting tech stacks, status codes, and page titles at scale.

Command👉 subfinder -d target(.)com | httpx -sc -td -title

[mrdesoky0 @mrdesoky0]

Great work @GodfatherOrwa This is a solid bypass.

I recently wrote a write-up on a similar Stored XSS via PDF I found in Sep 2025:
https://t.co/kKyA5whcaA

Keep it up 🔥

[mrdesoky0 @mrdesoky0]

Got high severity vuln via 401 bypass

Low-priv got 401 on normal GET path. /.? appended bypassed it and leaked full sensitive data (PII, images, geo, fingerprints)

Normal: /omni/single-session?id=xxx (401)
Bypass: /omni/single-session/.?id=xxx (succeeds)

#BAC #bugbountytips

[HackingHub @hackinghub_io]

Many WAFs auto-block the default curl User-Agent.

Using the -A flag to spoof a real browser or mobile device is a simple way to bypass basic filters and uncover hidden, mobile-only endpoints.👇

[Abdulkadir | Cybersecurity @cyber_razz]

How to view all hidden logs and file activities on your windows PC

(Perfect to know if someone messed around without your permission )

[teflon @0xTeflon]

Thank you to @NahamSec for inviting me on his channel to talk about some amazing bugs. Go check it out here: https://t.co/hRQtWU9uHH

[Abdulkadir | Cybersecurity @cyber_razz]

How to use burpsuite to test API endpoints

[ProjectDiscovery @pdiscoveryio]

Stop just finding subdomains. Start finding endpoints. 🕸️

Recon doesn't end with a list of domains. By piping subfinder and httpx into katana, you can automatically crawl and map out the entire attack surface of a target in seconds.👇

#Recon #Katana #Subfinder