Splint3r7

Hacker & Bug Bounty Hunter | BlackHat MEA 3x Speaker // 🔈 MCTTP, DeepSec, SaScon + 15 more

[Splint3r7 @Splint3r7]

@mrarslanakhtar No worries, good luck ;)

[Splint3r7 @Splint3r7]

Bug Bounty | Internal SSRF | $2,000

Found an Internal SSRF vulnerability

The ticketing integration feature (Jira, Zendesk, ServiceNow) accepted a user-supplied URL and passed it directly into a server-side request with zero validation. By replacing the URL with http://127.0.0.1:[PORT], I was able to enumerate internal hosts and ports unreachable from the public internet, one of which exposed a sensitive internal service (https://t.co/OEizQVPbxL)

Lesson learned: always test third-party integration fields. They are often overlooked but can make direct backend calls, making them a prime target for server side vulnerabilities.

#bugbounty #bugbountytips #ssrf

[Splint3r7 @Splint3r7]

@mrarslanakhtar Here's the Write-up https://t.co/YGFNUJc6MG (Redacted Version)

[Splint3r7 @Splint3r7]

@mrarslanakhtar Here's the Write-up https://t.co/YGFNUJc6MG (Redacted Version)

[International Cyber Digest @IntCyberDigest]

‼️ HackerOne disclosed it was training its AI with "12+ years of real-world vulnerability data," and now is in damage control after backlash over how it marketed its new AI product.

That line set researchers off. Bug bounty hunters accused HackerOne of using researchers' reports and prior bounty findings to train its Hai agentic AI system, framing it as theft.

HackerOne answered the next day. It admitted the messaging "created confusion" and stated that researcher submissions are not used to train, fine-tune, or improve generative AI models. The company said this applies across H1 Continuous Testing, H1 Agentic PTaaS, and Hai, and that third-party model providers are barred from retaining or using researcher data for their own training. It said it updated its website language.

This week the platform launched H1 Continuous Testing, pitched as "continuous assurance built for how attacks actually work." Its own page says the product uses specialized AI agents to find, validate, and prove exploitable risk across applications.

The gap that remains: the marketing still credits "12+ years of real-world vulnerability data," while the denial is scoped tightly to training generative models. HackerOne has not said what that data set actually is, or how it differs from the submissions hunters spent more than a decade filing.

[Splint3r7 @Splint3r7]

@souravpaul_01 Yeah docker-lambda was running on port 9001 as well - program managers also confirmed that :)

[Splint3r7 @Splint3r7]

Lovely! I have also exploited such vulnerabilities in wild in the past. I’m more into integrations testing and finding bugs like SSRF’s there. Although the current one is not really classy but clearly shows that critical bugs exists in integrations. Would definitely share a write-up!

[Splint3r7 @Splint3r7]

@mrarslanakhtar Okay, let me setup a detailed write-up in few days!

[Splint3r7 @Splint3r7]

After speaking at 15+ cybersecurity conferences, including Black Hat MEA 3x, I still want to give back to the community.

I'm planning on sharing all of my bug bounty findings, some might be boring, but hopefully some findings will be worth sharing.

Should I do this?

#Bugbounty

[Splint3r7 @Splint3r7]

I earned $200 for my submission on @bugcrowd https://t.co/cPqT1Qlgv9 #ItTakesACrowd

[Splint3r7 @Splint3r7]

I earned $600 for my submission on @bugcrowd https://t.co/cPqT1Qlgv9 #ItTakesACrowd

[Tur.js @Tur24Tur]

Just ported my AI agent from Claude Opus 4.6/4.7 to @deepseek_ai V4 Pro. Same multi-agent architecture, same pipeline, fraction of the cost. Let's see if the Chinese 🇨🇳 model can match Anthropic's best

#DeepSeek #ClaudeOpus #DeepSeekV4Pro

[Tur.js @Tur24Tur]

I ran @deepseek_ai V4 Pro against 3 different security experiments SQLi, Android root detection bypass, and advanced XSS. I gave each run log to Opus 4.7 to review. Sharing each one in a separate tweet. Starting with the SQLi:

Experiment 1/3 SQL injection attack, listing the database contents on non-Oracle databases (using DeepSeek V4 Pro):

I requested the agent to log in as administrator on an expert-level @PortSwigger lab with no credentials provided.

Opus 4.7 feedback:

The agent followed a clean, textbook manual SQLi methodology:

Step 1: Fetched the homepage, identified a product category filter at /filter?category=
Step 2: Injected a single quote — got a 500 error confirming injection exists
Step 3: Used ORDER BY to determine column count (2 columns)
Step 4: Confirmed injectable columns with UNION SELECT NULL,NULL
Step 5: Queried information_schema.tables to enumerate all database tables
Step 6: Found the users table name (randomized name — not guessable)
Step 7: Queried information_schema.columns to get column names
Step 8: Dumped all rows with UNION SELECT to extract usernames and passwords
Step 9: Extracted the administrator password from the dump
Step 10: Fetched a fresh CSRF token from /login in the same session
Step 11: Submitted the login form as administrator with the stolen password
Step 12: Followed the 302 redirect — lab solved

Clean execution didn't skip column count enumeration. Handled CSRF token correctly by keeping cookies in the same session jar. No wasted tool calls, no unnecessary retries. 26 tool calls, 3 minutes.

Next tweet: Android root detection bypass

#DeepSeek #BugBounty #DeepSeekV4Pro

[Hasan Toor @hasantoxr]

Goodbye Claude Code subscription fees.

Someone just built a proxy that runs Claude Code completely free... and it's wild.

You literally plug in a free NVIDIA API key and point Claude Code at localhost.

That's it.

It handles everything:
- Converts Anthropic API calls to NVIDIA NIM format
- Unlocks 40 requests/min for free
- Supports Kimi K2, GLM 4.7, MiniMax M2, Devstral and more
- Streams thinking tokens and tool calls live
- Even includes a Telegram bot so you can run Claude Code from your phone

No API bill. No rate limit panic. No vendor lock-in.

Honestly, this goes beyond router tools like OpenRouter.

It doesn't just swap the model... it turns Claude Code into a free agent you can control remotely.

The project is open-source on GitHub.

It's called free-claude-code.

[axiaisacat @axiaisacat]

🧨 刚发现一个 Claude Code 新玩具——

只需一行命令，就能把任意 Android APK 扒得底裤都不剩：

/decompile app.apk

它能做什么？

→ 反编译 APK / XAPK / JAR / AAR → 自动提取所有 Retrofit 接口、OkHttp 调用、隐藏 URL

→ 追踪 Activity → ViewModel → Repository → HTTP 的完整调用链

→ 一键分析 Manifest、架构模式 → 甚至能处理 ProGuard/R8 混淆过的代码

说白了：任何 App 的 API 文档，AI 帮你 5 分钟写完。

安全研究 / 竞品分析 / 学习逆向，这个工具直接起飞 🚀
👇

[dawgyg - WoH @thedawgyg]

They spent $20k finding their bugs, while I spend less than $1000 on my fuzzing setup and found alot of the same bugs (several in their announcements i found and have in my 'to report' docs since they werent exploitable beyond DoS). i havent found 'thousands' but i have found nearly 1000 since December. And the VAST majority that have been found with AI and fuzzing are Null Ptr Derefs. and as mentioned, they are almost never exploitable on modern systems since memory at 0x0000000 cant be mapped to anything anymore. (it cant with like +8/16/32/64 offsets either, i forget what the first usable spot is but its not anywhere near a null ptr deref location). Mythos might be good at finding bugs, but it is not finding things that would set the internet on fire in most instances. im sure they found some nice bugs in their thousands, but most of them would be DoS impact at absolute most.

[Nicolas Krassas @Dinosn]

Open-source cross-modal and multimodal prompt injection test suite. 38,000+ attack payloads across text, image, document, and audio modalities. Research-backed by OWASP LLM Top 10, CrossInject (ACM MM 2025), FigStep (AAAI 2025), DolphinAttack, and CSA 2026. https://t.co/fPNsIDg46K

[Harshleen @0xharshleen]

📍client-side-bugs-resources
- JS Analysis
- Writeups
- Challenges
- Series
- Blogs
- CSP Resources
- Prototype Pollution
- Learning Resources
https://t.co/aIr70NkudZ
@zomasec

[How To AI @HowToAI_]

🚨 BREAKING: Someone just open-source a pre-built, fully jailbroken IOS 26 virtual machine.

vphone-aio uses one script to deploy a fully functional, jailbroken virtual iPhone. It skips the complex configuration and sets up the whole environment locally.

100% Open Source.