Mihawk

[Perly 🦈 @_Shark_byte]

I compiled over 11k bug bounty reports into one library

a little bit ago, I wanted to run some analysis on bounty reports, but had a hard time finding and compiling everything especially across platforms

so I decided to just make a library + api for anyone who wants to run any sort of tests/analysis etc

lemme know what yall think + anything to add to make it as useful as possible :)

link in replies

[MAX @MAXdeg0]

THIS IS F**KING DANGEROUS

THREE OPEN SOURCE AI CYBERSECURITY STACK MOST PEOPLE DONT KNOW EXISTS

METATRON: point it at a target, it recon's, analyzes, and reports on its own —> fully OFFLINE , zero API keys.

NUCLEI : describe a vulnerability in plain English, it writes and runs the actual detection template for you.

GARAK BY (NVIDIA): throws thousands of known prompt injection and jailbreak attempts at an LLM until one breaks through.

Recon —> detection —> and AI red teaming
three layers of the same problem, all open source.

Link to access the REPO’S below

[Cyber Detective💙💛 @cyb_detective]

Threat Intelligence Tools

Malware Analysis
IOC Databases
Vulnerabilities & CVEs
Phishing Detection
Botnet & C2 Tracking
Sanctions & Watchlists
Live Threat Maps
Threat Actor Profiles

https://t.co/GHqr1V6pPh

#cybersecurity

[kernelstub (Prepakis Georgios) @kernelstub]

A new Apache RCE vulnerability has been identified in the latest version. I have not redacted the specific details required for reproduction.

Please feel free to recreate this and use it in the wild. I will be on vacation until the 29th, so my responses may be delayed during this period :").

[cr3ghost @cr3ghost]

Two new logical flaws in Kerberos just dropped at Black Hat. Low-privileged user to full domain takeover, including domain admins.

If you're doing Active Directory pentesting, Kerberos attacks, red teaming, identity security, or detection engineering, read this.

KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Both are logical bugs, not memory corruption. Described as surprisingly easy to exploit.

https://t.co/dgJC3JHjOf

#Infosec #RedTeam #DetectionEngineering

[CyberSudo @Cyber_Sudo]

👁️ How I Track Telegram Users With This Tool

Most OSINT investigations stop at the Telegram handle.

I don’t stop there. A Telegram account can still give you useful pivots, even if the username changes later:
🆔 Telegram ID
📅 Account creation date
🖼️ Current and previous profile pictures
🔁 Previously used usernames
📝 Previously used display names

One tool I use for this is UserSearch.

UserSearch can help you:
- Pull user information
- Pull a user’s old profile pictures
- Extract members from a Telegram channel
- Collect Telegram channel information
- Search public Telegram groups and channels

Once you have the current and previous usernames, run them through UserSearch, WhatsMyName or Sherlock.

This shows you every platform where those usernames appear.

Old profiles = old personal information.

🔗 Tool link: https://t.co/ZpZdrbtJlG
__________

P.S. ♻️ Repost if you found this helpful.

[Ihtesham Ali @ihteshamali]

A two-person security team used AI to find real vulnerabilities in code and earned $250,000 from a single bounty.

Now they have open-sourced the system behind it.

It is called Open-Kritt.

Most people scan a repository by giving an AI one giant task:

“Find every vulnerability in this code.”

Open-Kritt takes a more focused approach.

First, one agent maps every reachable entry point.

Then it launches separate agents to trace each code path and search for specific failures.

Each agent gets its own isolated container, where it can:

> Inspect the code
> Install security tools
> Compile the project
> Run tests
> Fuzz inputs
> Build a proof of concept

The raw findings are then checked, merged when they describe the same bug, and ranked so researchers can inspect the most promising ones first.

It works with Codex, Claude Code, OpenAI, Anthropic, and OpenRouter.

The Kritt team says it used the system to find more than 20 High and Critical vulnerabilities in nine months.

It also finished first in the Firedancer V1 audit competition using fully AI-driven research with no manual review.

This is an open-source research lab that turns AI agents into a small security team.

https://t.co/SbjO3mBhm7

[Clandestine @akaclandestine]

GitHub - nikaiw/VMkatz: Extract Windows credentials directly from VM memory snapshots and virtual disks · GitHub https://t.co/vy6A9RiuhJ

[VIEH Group @viehgroup]

Use NextJS? Recon ✨

A quick way to find "all" paths for Next.js websites:
DevTools->Console

console.log(__BUILD_MANIFEST.sortedPages)

javascript​:console.log(__BUILD_MANIFEST.sortedPages.join('\n'));

Credit: @ofjaaah

#infosec #bugbountytips #bugbounty

[N45HT @N45HTOfficial]

PoC:

[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core 👾💥

- https://t.co/ky9FQtBq8i
- https://t.co/AZ3sH8BAhH
- https://t.co/x9d2FlkKcC

- https://t.co/NPvc6ali0E

- https://t.co/ovf3izejBZ
- https://t.co/cVoDWXQBt0

[Cyber Detective💙💛 @cyb_detective]

Telegram posts search tool

175,000,000+ posts
2,000,000+ channels
Data range from 2026-03-09 (for free search)

Partly free

https://t.co/TvCKD3ShN1

#socmint #telegram

[Cyber Detective💙💛 @cyb_detective]

Basic Telegram Google Dorks

Can be used on various search engines.

Part of @D4rk_Intel Telegram Intelligence Toolkit.

https://t.co/3TSjlOLENV

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🐀 Prepping for the OSCP? RatCTF just dropped a full FREE OSCP path — 9 modules, 13 machines, every technique that actually shows up on the exam. Enumerate first, build your own playbook, and drill Active Directory + buffer overflow until they're muscle memory. 3 free labs a day, worked in order.

👉 https://t.co/6KEyQgZACW

Liked this? Level up your fundamentals faster with my 901 Beginner Web Hacking Guide Bundle — a discount applies via the link: https://t.co/0DRvm9TFbD

#infosec #bugbounty #ctf #OSCP

[SOMA @somadinaaaa]

Day 30/100 of Cybersecurity.
Hunting a kernel level Malware.

How do you detect a malware threat that hides directly in the kernel? 🕵️‍♂️

In this deep dive, I show you how to use Wazuh SIEM to hunt down a rootkit called Diamorphine and flag hidden processes that bypass standard OS checks.
👇

Special thanks to @TechSphereAcad for being a great online institute for learning cyber skills

#Cybersecurity #InfoSec #Wazuh #Malware

[Nicolas Krassas @Dinosn]

theteatoast/local-vuln-research-pipeline: Fully local vulnerability research pipeline — 14B code-specialized LLM reviews every source file exhaustively. https://t.co/uV50BHHevw

[0x6rss @0x6rss]

The Loot feature on @etugenio is genuinely great.

Seeing Telegram bot tokens, exfiltration channels, and C2 traces from open directories / exposed content in a single view creates serious value for CTI.

Especially for Telegram C2 hunting, this is a very powerful approach. Thanks to this feature, you can use the open-source #matkap tool (github/0x6rss/matkap) to work on C2 hunting.

Happy hunting!

[0xor0ne @0xor0ne]

Series on using LLMs for vulnerability research (@ZephrFish)

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#infosec #llm

[Cyber Detective💙💛 @cyb_detective]

APT Intelligence

Threat Nexus
https://t.co/ViGL8Pb8Wb

APTMap
https://t.co/DoCFCYlTZm

Threat Group Cards: A Threat Actor Encyclopedia
https://t.co/GwOJeGmpSW

Global Threat Map
https://t.co/dgdoRLcbue

APT & Threat Actor Resources
https://t.co/n8HWwOsNBb

#cti #cybersecurity

[CyberSudo @Cyber_Sudo]

🔍 OSINT TOOL OF THE DAY

Search Inside Messengers

Ever wanted to uncover groups, channels, or hidden communities inside messaging apps?

Waybien lets you search across major messengers & social platforms using keywords, then filter results with precision:
🌍 Geography
🗣 ️ Language
📌 Topic
👥 Member count

Perfect for investigations, intel gathering, and mapping how conversations spread across regions.

A clean, efficient, and underrated addition to any OSINT workflow 😄🧠

And in a future post, I’ll share a free tool that lets you map mobile network coverage and locate 2G–5G cell towers. 😉

You can check it out here https://t.co/DXiZjYgX4i
------------
P.S. ♻️ Repost if you found this helpful.

If you would like to learn more about website OSINT and much more, check out the OSINT Mastery course at https://t.co/o7UQQR6SNU you’ll learn OSINT from scratch with a real-life investigation.