PinkArmor

[bytehx @bytehx343]

I am releasing Ollama AI analyzer burp extension. It runs right on your local computer and uses Ollama's AI models to analyze your HTTP requests and response while keeping your data private.

https://t.co/VEN5nQ8gtq

[0xor0ne @0xor0ne]

How to use LLMs for vulnerability research by @ZephrFish

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#cybersecurity #llm

[termireum @termireum]

DOM XSS via postMessage on Bing - Microsoft Bug Bounty.
https://t.co/iQuPSyZQVz

[PinkArmor @PinkArmor56394]

https://t.co/4lizWAMwL6

[PinkArmor @PinkArmor56394]

Just bagged a P1 (Critical) on @NASA! 🚀🪐

Stoked to receive an official Letter of Recognition (LOR) for this finding via @Bugcrowd. Securing a legendary target like NASA is a massive milestone in my bug bounty journey. Huge props to their security team for the rapid fix! 🛡️💻

[Radvan Mohamadzade @nexovir]

I built Forbidra because most existing 401/403 bypass tools felt too limited and didn’t cover enough request variations. So I made a tool that tries to cover as many different 401/403 bypass techniques and request variations as possible, all in one place

https://t.co/dz2ITrJldO

[Aditya @ADITYASHENDE17]

Try this: Bug hunters just dropped GhostJS Burp Extension. It passively scans JS, HTML, and JSON for secrets. API keys, tokens, endpoints. Zero config, 150 plus patterns, totally free.
Install, browse, let it hunt

https://t.co/mEX5tGvTAZ

[Nafiz Bayındır @NafizBayindir]

Send us your mobile app link.

30 minutes later, get the checklist:
What works
What doesn't
What needs attention ⚠

Before your users find out.

[Franc Vian @fr4vian]

I had a great time presenting at the Mobile Hacking Community! Met a lot of interesting people and had some great time along the way 😉
https://t.co/Qm6TjCJPqK

[zack0x01 @zack0x01_]

XSS using "xss.pdf" 👀

I’ve seen a lot of people successfully find XSS by uploading a malicious PDF that gets rendered inside a PDF viewer.

But there’s another angle people often miss: data exfiltration doesn’t always require JavaScript execution.

Depending on how the PDF viewer handles interactive PDF features, an attacker may be able to trick users into submitting sensitive information through a malicious prompt or form.

I put together the PDF PoC here:
https://t.co/9MgYEL0tE1

For more technical details on portable data exfiltration:
https://t.co/UlhWc07N8J

Only test this on systems you own or have explicit authorization to assess.

#bugbounty #bugbountytips

[PinkArmor @PinkArmor56394]

@sudosu01 @NASA Hey man, I just found a P1 report on the NASA VDP (via Bugcrowd) that has been marked as "unresolved." I wanted to ask: roughly how long does it take to receive the Letter of Recommendation (LOR), and how is it delivered?

[Marius du Preez @mdp_sec]

An API key in an APK can be limited, monitored, or designed for a public client.

A production TLS private key has no reason to be there.

One app shipped the encrypted key and the material needed to decrypt it. Once unpacked, the client contained the full credential used by the live service.

Reward was $3,500.

Mobile review should classify secrets by authority:

- Public identifier.
- Quota-bearing API key.
- User-scoped token.
- Shared signing secret.
- Production private key.

Do not report every random string as Critical.

But when an app ships infrastructure identity, prove the exact certificate or signature relationship and treat it accordingly.

.

#BugBounty #CyberSecurity #TogetherWeHitHarder #ItTakesACrowd #Bugcrowd #Hackerone

[Ankur Gautam @NexxelSecurity]

OpenCode + Burp Suite MCP - AI-Powered Pentesting 💀

[kaize @0x_kaize]

Found a big collection of jailbreaks

Prompt collections for working with GPT, Claude, Gemini, DeepSeek, Grok, and more: github{.}com/...

1. elder-plinius/L1B3RT4S

> GitHub stars: 21K
> supports models: ChatGPT, Claude, Gemini, DeepSeek, Grok, Llama, Copilot, Cursor, Perplexity

2. ShadowHackrs/Jailbreaks-GPT-Gemini-deepseek-

> GitHub stars: 1.1K
> supports models: GPT, Sora, Claude, Gemini, DeepSeek

3. Calrton/jailbreak-prompts

> GitHub stars: 86
> supports models: Codex, GPT-5.x, Claude, Gemini, DeepSeek, Grok

4. Quincunx33/Ai-jailbreak

> GitHub stars: 10
> supports models: Qwen 3.5, Gemma 4, Llama 4, Kimi K3, GPT-5.x, Gemini 3.x, Grok 4.x

Found this while digging deeper after the GPT 5.6 prompt. The repo ecosystem is way bigger than the jailbreak itself.

[PinkArmor @PinkArmor56394]

@Un9nPlayer I already messaged you on Chat

[PinkArmor @PinkArmor56394]

@Un9nPlayer I’m also planning to develop a Burp Suite extension focused on injection, authentication, and authorization bug like the one you’re working on. Could we discuss this further?

[PinkArmor @PinkArmor56394]

@Toshusec_ Are you using freebuff?

[Intigriti @intigriti]

When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠

From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎

In our latest article, we've teamed up with Orwa Atyat (@GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation.

Read the article now! 👇
https://t.co/QwjSWShCto

[Un9nPlayer @Un9nPlayer]

I built an AI-powered Burp Suite extension, so I threw an XSS payload at it.

The real test: can it actually detect and analyze the vulnerability without me hand-holding it?

Let’s see.
#burpsuite #ai #security