Mantis

Husband and Father of 2 | Hacks things | InfoSec Stuff | Twitch: | YT:

[Mantis @MantisSTS]

So I started a YouTube channel and started an iOS hacking series. Check it out! https://t.co/gxtgQGkYjQ

I know I sound like a mong on it but hey, just trying to share some knowledge. I want go get out a new video every couple of days!

#bugbountytips #bugbounty

[Mantis @MantisSTS]

https://t.co/ZoXdIx7y7i

[⚡️🌙 @dystopiabreaker]

you may think your app's service listening on localhost cannot be accessed by random websites. however, have you considered:

[Security Harvester @secharvesterx]

CVE PoC Search
https://t.co/W5LMcqmIC1

[Mantis @MantisSTS]

4 days! Absolute piss take 😂

[Jordy Zomer @pwningsystems]

InfoSec: "Running random Docker containers is a massive security risk."

The risk: Spawning a native window to play ASCII DOOM at 60fps.

[Intigriti @intigriti]

Day 9 of #BugQuest! 🤠

Yesterday, we listed an overview of the primary ways to discover endpoints. Today, we're diving deep into one of the easiest and most overlooked methods: common configuration files.

Files like robots.txt and sitemap.xml were designed to help search engines, but they often leak valuable information about application structure, including endpoints not referenced anywhere else on the target.

Swipe through to see a few examples of config files to check and what they can reveal!

#BugBounty #HackWithIntigriti #BugQuest

[André Baptista @0xacb]

Next.js, cache, and chains: The Stale Elixir

A nice work by @zhero___

This zero day brought web cache poisoning to the spotlight. His extensive research showed how source code analysis helped him craft a technique that resulted to CVE-2024-46982.

Blog link 👇
https://t.co/FG2PpfNngh

[Six2dez 🇵🇸 @Six2dez1]

burp-ai-agent v0.4

https://t.co/d4iPeGtrKW

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[Intigriti @intigriti]

@hakluke @xnl_h4ck3r 4️⃣ JSAnalyzer

JSAnalyzer by @_jensec automatically extracts API endpoints, secrets, URLs, and sensitive files from JS responses, with smart noise filtering to reduce false positives! 🤠

🔗 https://t.co/MX5NCbb3zu

[Six2dez 🇵🇸 @Six2dez1]

reconftw v4.1

https://t.co/x8jSI0uzAH

[m0n1 @m0n1x90]

Built WinGraph, my new project - a BloodHound-style dependency visualizer for every binary in Windows System32 directory.

4,000+ DLLs, EXEs. Every import. Every export. One interactive graph.

Check it out now : https://t.co/sRtf2Lnmqn

[Nicolas Krassas @Dinosn]

Reverse engineering Zomato's Android app: Bypassing SSL pinning to find plain-JSON MQTT credentials https://t.co/RvUVrXWLRS

[Thierry @0x7hierri]

🔥This is a continuously updated pentesting wiki by @Six2dez1 offering tools, techniques, cheat sheets, and guides covering recon, enumeration, web, cloud, mobile, Windows/Kerberos, and Burp Suite.
Link: https://t.co/HXDXglxU0H

[Nicolas Krassas @Dinosn]

Using AI to Do Simple Reverse Engineering https://t.co/H25Z3Wj79I

[André Baptista @0xacb]

Tired of hitting 403 errors during your security testing? 

NoMore403 by @devploit automates bypass techniques to get past those pesky restrictions. 

Try it at 👇
https://t.co/kX3a0oFGxO

[Mantis @MantisSTS]

Anyone here big on the @msftsecurity programs? I have a few questions about a bug that I've found

[Mantis @MantisSTS]

@BuildHackSecure Rigorous? Idk I'm sure there's something there 😂

[Mantis @MantisSTS]

@BuildHackSecure Repeated Colon Exams? 🤣