T

[JS0N Haddix @Jhaddix]

For our courses and our testing we saw the need for a new tool.

It incorporates old school features of BeEF and modern Blind XSS and Cred Capture Frameworks.

Soon to be a giveaway as part of the courses! Welcome to the world WRAITH

[Tom Dörr @tom_doerr]

PwnPad teaches hardware hacking through challenges

https://t.co/H0bgZUPeNQ

[Prajwal Tomar @PrajwalTomar_]

Vibe coders are getting sued.

People are shipping apps with real users and skipping the boring stuff that kills them.

A 20+ year dev shared the pre-launch checklist every AI builder needs.

I added what I learned after shipping 60+ apps at the agency.

Don't skip this:

1. Protect yourself, not just your app. The moment you collect user data you're in legal territory (GDPR, CCPA). Have a privacy policy. Know where user data lives.

2. Row Level Security. Without RLS, anyone can open DevTools and read your entire database. Supabase → Auth → Policies. Zero policies means your app is naked. 5 min to fix.

3. Test the failure path, not just the happy path. Wrong password 5x. Reset for an email that doesn't exist. Verification link clicked twice. Signup with an existing email. Catches 80% of auth bugs.

4. Security baseline in 2 min. Prompt your AI: "Review my app as a security specialist and make sure I have strong security headers and a solid baseline security posture."

5. OWASP. Prompt: "Review my app against OWASP standards and highlight vulnerabilities." This is where SQL injection, XSS and auth bugs actually get caught.

6. Client-side validation is UX, not security. Attackers disable JS and hit your API directly. Validate again on the server. Every time.

7. AI code leaks data in 3 spots: .env values in the frontend, API responses returning too much, secrets in logs. Prompt: "Check my app for credential or sensitive data leaks in frontend or API routes."

8. API keys in the frontend means game over. If it's in the browser, assume it's already taken. Move it server-side or proxy it.

9. Rate limits before someone burns your API bill. Cap every endpoint hitting a paid API. I've watched a Supabase bill jump from $20 to $200 in a day.

10. CAPTCHA on public forms (Cloudflare Turnstile is free) plus CORS locked to your domain. 10 min, kills bot floods.

11. Error messages that don't leak. "User not found", not "SELECT * FROM users failed". Log full errors server-side, show users generic messages.

Build fast. Just don't ship naked.

(full breakdown in my article below)

[Priyansh @itspriionly]

All Paid Courses (Free for First 4500 People)

𝗣𝗮𝗶𝗱 𝗖𝗼𝘂𝗿𝘀𝗲 𝗙𝗥𝗘𝗘 (PART - 2)
1. Artificial Intelligence
2. Machine Learning
3. Prompt Engineering
4. Claude,Chatgpt,Grok
5. Data Analytics
6. AWS Certified
7. Data Science
8. BIG DATA
9. Python
10. Ethical Hacking

(72 Hours only )

Like + RT + comment ' Drive '

Must Follow me so I can DM you.

[Es Geeks @EsGeeks]

🕵️‍♂️🔍 FBI Watchdog | Detección en tiempo real de incautaciones y cambios en dominios y sitios .onion

Monitorea DNS, HTTP, WHOIS, IP y Tor. Alertas consolidadas con capturas de pantalla en Discord y Telegram.

#OSINT #ThreatIntel #Ciberseguridad #Tor #BlueTeam

[Hacking Articles @hackinarticles]

Penelope: A Modern Alternative to Netcat for Red Teamers

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Tired of unstable reverse shells and basic netcat listeners? Penelope provides a powerful shell-handling experience for Red Teamers and CTF players ⚠️

📚 What You'll Learn in This Guide

🔍 Introduction to Penelope
⚙️ Installing & Configuring Penelope
🎯 Replacing Traditional Netcat Listeners
🐚 Automatic PTY Upgrades
📂 Built-in File Transfer Capabilities
🔄 Session Management & Multi-Shell Handling
📝 Command Logging & History Tracking
🚀 Generating Reverse Shell Payloads
🛠️ Port Forwarding & Pivoting Features
🎮 CTF & Red Teaming Use Cases
🧠 Productivity Tips & Best Practices
🛡️ Operational Security Considerations

💡 Penelope is a modern shell handler designed to overcome the limitations of traditional netcat listeners by offering automatic TTY upgrades, session management, file transfers, logging, and other features that make post-exploitation workflows significantly more efficient.

📖 Article:
https://t.co/0oSOCH7bGF

#Penelope #Netcat #RedTeam #Pentesting #CyberSecurity #EthicalHacking #CTF #Linux #PostExploitation #InfoSec

[7h3h4ckv157 @7h3h4ckv157]

OSED Notes (Offensive Security Exploit Developer)

Resource: https://t.co/CZ3Zvz2aMv

[Vivek | Cybersecurity @VivekIntel]

🎓 Cybersecurity Books Collection
(Ethical Hacking • Red Teaming • Malware • Linux • Programming)

https://t.co/sbOMMjFosQ

[The Hacker News @TheHackersNews]

⚠️ Old routers are being pulled into attacker infrastructure.

AryStinger #malware has infected 4,300+ legacy routers and uses them to scan targets, tunnel traffic, and run commands remotely.

It is less about DDoS and more about reconnaissance and proxy access.

Read the full story: https://t.co/WrLsi0a66h

[Hacking Articles @hackinarticles]

Burp Suite for Pentester: XSS Validator

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Finding and validating Cross-Site Scripting (XSS) vulnerabilities manually can be time-consuming. XSS Validator helps automate the detection and validation process directly within Burp Suite ⚠️

📚 What You'll Learn in This Guide

🔍 Understanding XSS Vulnerabilities
🛠️ Introduction to XSS Validator Extension
⚙️ Installing Extensions from the BApp Store
📦 Setting Up XSS Validator in Burp Suite
👻 Configuring PhantomJS as an XSS Detector
🎯 Automating XSS Detection & Validation
📋 Fuzzing Web Applications for XSS
🚀 Integrating XSS Validator with Burp Intruder
🧠 Customizing Payload Lists
📂 Analyzing Successful XSS Findings
🛡️ Improving Web Application Security Testing
⚠️ Best Practices for XSS Assessment

💡 XSS Validator is a powerful Burp Suite extension that works alongside Burp Intruder to automate the detection and validation of Cross-Site Scripting vulnerabilities, helping penetration testers identify exploitable injection points more efficiently.

📖 Article:
https://t.co/4PKYt4RSlM

#BurpSuite #XSS #XSSValidator #WebSecurity #BugBounty #Pentesting #CyberSecurity #EthicalHacking #InfoSec #AppSec

[Vivek | Cybersecurity @VivekIntel]

Looking for Web Security & Bug Bounty Tools?

WebHackersWeapons is a massive curated collection of tools used by security researchers, penetration testers, and bug bounty hunters.

Inside you'll find:
• Recon & OSINT tools
• Fuzzers & vulnerability scanners
• Burp Suite, Caido & ZAP extensions
• Cloud security tools
• Secret scanning utilities
• XSS, SSRF, SQLi & API testing resources
• Wordlists & payload collections

A useful bookmark for anyone working in AppSec, Bug Bounty, or Web Security.

🔗 https://t.co/ghlsFRnFsK

#CyberSecurity #BugBounty #AppSec #Pentesting #WebSecurity #OSINT #InfoSec #OpenSource #Hacking #GitHub

[PHYR3WALL 🇺🇲 @phyr3wall]

I've been building my AI-powered offensive security harness for the past few weeks. It's successfully solved every active HTB box (minus the insane machines). To help others learn and build alongside me, I'm giving away your choice of a 1-Month Claude Pro subscription or 1-Month HTB VIP+.
Follow -> Like -> Retweet to enter

[Vivek | Cybersecurity @VivekIntel]

🛡️ Anthropic Cybersecurity Skills - The Largest Open-Source Cybersecurity Skills Library for AI Agents

Anthropic Cybersecurity Skills is a collection of 754 production-grade cybersecurity skills across 26 security domains, designed to give AI agents structured workflows for DFIR, Threat Hunting, Threat Intelligence, Cloud Security, Web Security, Pentesting, Malware Analysis, SOC Operations, and more.

Each skill is mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, and NIST AI RMF, making it a powerful knowledge base for Claude Code, Copilot, Cursor, Gemini CLI, Codex CLI, LangChain, CrewAI, AutoGen, and other AI agent platforms.

🔗 https://t.co/SfV3E8nI0G

#CyberSecurity #ThreatIntel #DFIR #SOC #AIAgents #MITRE #InfoSec

[John @johnvirality]

claude fable 5 just made it possible to post 100 AI UGC videos per day across 4 platforms in JUST 30 minutes of production

everything else runs 100% autonomously

clippers might be cooked 😭

this mythos model watches raw video footage and finds viral moments transcripts would miss

it scrolls tiktok while you sleep and builds trend reports, generating 100 production packages and renders them through higgsfield MCP without you touching another tab.

so i documented the ENTIRE machine with every prompt, every setup instruction, and every workflow step

here's what's inside:

→ the overnight market research system that runs while you sleep

(cowork scrolls 5 platforms, analyzes 60-80 pieces of content each, returns a trend intelligence report with 10 specific content ideas by the time you wake up)

→ raw-pixel clip identification that finds moments human clippers miss

(facial expression shifts, product reveals, body language peaks, visual incongruities. all timestamped and ranked by predicted virality.)

→ batch script and asset generation: 20 complete production packages per prompt, run 5x for 100 total

(6-shot scripts, character prompts, product frame prompts, voice direction, platform captions. 15-25 minutes total.)

→ the higgsfield MCP pipeline that renders all 100 videos automatically

(fable 5 calls seedance 2.0 directly. character reference locked. lip sync aligned. zero human involvement.)

→ the virality predictor that filters your top 20 candidates before posting

(hook score, hold rate, brain region activation. bottom 5 get diagnosed and revised automatically.)

→ the CPM math: 400 platform-posts/day × 3,000 avg views = 36M views/mo = $180k/mo at $5 CPM

→ all 6 copy-paste prompts that run the entire machine

all from my personal experience in looking behind the scenes on how Rizz App + Looksmax AI + Memix scaled past 7-figures with this method

like + comment "100" and i'll send you the ENTIRE system

(must be following + RT for priority access)

will stop sending these out in 24h...

[Joseph Thacker @rez0__]

As a person who has done a ton of red teaming and finding jailbreaks in oai and anthropic models, my guess is that Anthropic is actually correct about the jailbreak presenting no additional risk. So many people claim jailbreaks but the model actually hedged, output false info on purpose, or it’s like 10% functional.

At the end of the day, it’s all moot because 4.6-4.8 can find critical vulnerabilities

[AI探路者Tim @AIExplorerTim]

我最近发现了一个超酷的网站检查工具叫 Web-Check。它有很强的黑客范儿。

它让你能检查网站的几乎所有信息：IP 详情、SSL、DNS 记录、cookies、域名信息、爬虫规则、服务器位置、重定向历史、开放端口、路由追踪、DNSSEC、网站性能、关联主机名等等。

https://t.co/W9uSjIkehX

[Replit ⠕ @Replit]

New video is out! You no longer build one thing at a time on Replit.

Run parallel agents to ship a website, mobile app, video, and pitch deck from one project, all at once.

And you can now add multiple artifacts to projects you already have.

[Matt Johansen @mattjay]

a new github account named MSNightmare just posted a Windows Defender exploit with PoC that works on Windows 11 and 10.

They say Windows Server is vulnerable too but the PoC needs to be tweaked.

Guessing the github wont be up long if this is NightmareEclipse who was banned.

[Matt Johansen @mattjay]

Huge pickup for OpenAI

[The Hacker News @TheHackersNews]

🔥 AI just found 21 zero-days in FFmpeg.

That’s the video library bundled inside many apps, tools, containers, and devices. Some bugs sat untouched for 15–20 years.

Google Chrome also dropped PATCHES for a record 429 vulnerabilities this week.

Read: https://t.co/6MEVD9ufxu