Mahendra Purbia

🕉️ 🚩| Security Engineer🇮🇳 | 3 CVE | CRTP | CEH |Secured 200+ Companies

[Mahendra Purbia @Mah3Sec]

Corruption. Broken education. Poor infrastructure. A dying environment. Every taxpayer can see what's happening.
My patriotism is for my country, not any political party. As citizens, we have every right to question the government. Accountability is their duty. #neetleak

[Vinay sati @_Vinaysati]

Meet Darknet MCP 🌍

Open-source dark web & threat intelligence for AI agents.
68 MCP tools. One local dashboard.
Security researchers & builders worldwide: try it, share feedback, contribute, or star the repo.

https://t.co/YLDLIYgoe8

#CyberSecurity #MCP #darkweb #hacking

[Mahendra Purbia @Mah3Sec]

@_Vinaysati @Hacker0x01 @immunefi Don’t want to influence the younger generation 😂

[Mahendra Purbia @Mah3Sec]

I failed my first CRTO attempt.

7 days later, I came back with a better process, better preparation, and a very different mindset.

I wrote about what went wrong, what I changed, and what I learned from the experience.

Same knowledge. Different discipline.

🔗 https://t.co/bIhfCloNqe

#CRTO #RedTeam #CyberSecurity #InfoSec @_ZeroPointSec

[Mahendra Purbia @Mah3Sec]

We hear “SBOM” everywhere these days.

But when a critical vulnerability hits an open source dependency, can your team quickly answer:

“Are we using it?”

An SBOM can help answer that question.

In our first ForgeGuardian security series, we're breaking down what an SBOM actually is, why it matters, where it fits into software supply chain security, and how ForgeGuardian supports it.

A practical introduction for anyone working with modern software supply chains.

Read the full article below https://t.co/WdPUNS8aVO #SBOM #SoftwareSupplyChain #CyberSecurity #AppSec #DevSecOps #OpenSource #SoftwareSecurity

[Mahendra Purbia @Mah3Sec]

Me and my friend @jaimin2709 started #ForgeGuardian as a weekend experiment around one question:

Can we build a practical, open-source defense layer for software supply-chain attacks?

3 months later, we're putting it out in the open. 🚀

🔎 8 detection engines
🌍 9 ecosystems
🛡️ 223+ detection signatures
💻 CLI + Dashboard
🔒 Offline-first
New threat → New detection → Shared with the community.
Try it. Break it. Tell us what we’re missing.
👉 GitHub: https://t.co/HgF5po2ge9
📚 Docs: https://t.co/hMf3vX0kM4
#CyberSecurity #SupplyChainSecurity #AppSec #OpenSource #infosec #supplychain #devops #secdevops #dev

[Mahendra Purbia @Mah3Sec]

Me and my friend @jaimin2709 started #ForgeGuardian as a weekend experiment around one question:

Can we build a practical, open-source defense layer for software supply-chain attacks?

3 months later, we're putting it out in the open. 🚀

🔎 8 detection engines
🌍 9 ecosystems
🛡️ 223+ detection signatures
💻 CLI + Dashboard
🔒 Offline-first
New threat → New detection → Shared with the community.
Try it. Break it. Tell us what we’re missing.
👉 GitHub: https://t.co/HgF5po2ge9
📚 Docs: https://t.co/hMf3vX0kM4
#CyberSecurity #SupplyChainSecurity #AppSec #OpenSource #infosec #supplychain #devops #secdevops #dev

[Mahendra Purbia @Mah3Sec]

@AseemShrey Thanks Man🔥

[Mahendra Purbia @Mah3Sec]

@d0nutptr 9999

[Mahendra Purbia @Mah3Sec]

I don't think so this gonna solve the problem on platform side as well as researchers are not just on fault. This still seems to be an issue on the platform's side. The H1 triage team isn't actually reading or reviewing reports initially they're relying on their in-house AI for the first pass.

I've seen the AI mark three reports as N/A within a single minute, which strongly suggests they're being processed automatically. The problem is that the AI is incorrectly closing valid reports as N/A or Informative. Only after mediation does a human triager reopen the reports and review them properly.

I've already pointed this out, but this AI triage issue still hasn't been resolved.

[Mahendra Purbia @Mah3Sec]

@hetmehtaa So you're getting paid to teach the AI everything you know... bold move, training your future coworker. 🤖😂

[Mahendra Purbia @Mah3Sec]

@hetmehtaa GTA V

[Mahendra Purbia @Mah3Sec]

@Shruti_0810

[Mahendra Purbia @Mah3Sec]

@Google 🚨🚨🚨

[Mahendra Purbia @Mah3Sec]

@dpradhanbjp @RahulGandhi @INCIndia ऐ नीच, पहले अपनी छवि सुधार और इस्तीफ़ा दे

[Mahendra Purbia @Mah3Sec]

@Dheerajydv19

[Mahendra Purbia @Mah3Sec]

😆😆Storytime (Characters: Peter & Miles)

Miles used AI to perform a white-box penetration test on a web application running in a non-WAF environment. In just 2 days, the AI-generated report contained 65 findings, including a mix of critical, high, medium, and chained vulnerabilities.

Their manager asked Peter to review and validate the AI-generated penetration test report.

Peter spent an entire week just understanding what the AI had actually done and how it reached its conclusions. Revalidating every finding ended up taking longer than the original penetration test itself.

After the review, Peter concluded that around 88% of the reported findings were either false positives or not vulnerabilities at all. Most of the remaining valid issues were relatively basic findings such as TLS misconfigurations, missing Secure cookie flags, clickjacking, and missing security headers.

Moral of the story: AI can speed up finding potential issues, but if its output isn't validated, the time saved during testing can be lost during review. In this case, validating the AI's results took longer than performing the penetration test from scratch.

So, who's responsible: the person who blindly trusted the AI, or the AI for generating incorrect assumptions and hallucinated findings? I think Both

[Mahendra Purbia @Mah3Sec]

@bug_vs_me @zomato congratulations Bro🎉