zodiac_

Bug hunter @Hacker0x01
github :

[zodiac_ @_zodiacHacker]

Risk-V Emulator in C: Development from Scratch by Zodiac Hacker
Youtube: https://t.co/qdIoDJ1f7L
Blog: https://t.co/TbRzXGxNqw

[zodiac_ @_zodiacHacker]

API Exploitation For Bug Bounty| Hacktricks by Zodiac Hacker https://t.co/MzXMEH7LeB

[Abhishek Meena 🏵️ @aacle_]

CACHE POISONING QUICK WIN:

Most apps validate X-Forwarded-Host as a single value.
But try this:

X-Forwarded-Host: https://t.co/c9BKdXEdW3, https://t.co/TIqwqgLYcJ

• CDN: Reads first → Allows ✅
• App: Reads last → Injects ⚠️

[zodiac_ @_zodiacHacker]

Behind the Scenes: Hack The Box: | Reversing Engineering Challenge

[zodiac_ @_zodiacHacker]

Hack The Box: Bypass -> 32-bit exe file -> Reversing Engineering -> OllyDbg: 32-bit assembler

[zodiac_ @_zodiacHacker]

Spooky License: HackTheBox Reversing Challenge

[zodiac_ @_zodiacHacker]

Simple Encryptor - HackTheBox Reversing Engineering Challenge #htb

[zodiac_ @_zodiacHacker]

Bypass SSL Pinning & Intercept ANY App Traffic (2026 Guide) | Intercept ... https://t.co/AYBsButrnI via @YouTube

[zodiac_ @_zodiacHacker]

Root Any Android in 5 Minutes | No TWRP or Recovery IMG Needed | 100% Wo... https://t.co/RzFyfJtpds via @YouTube

[zodiac_ @_zodiacHacker]

Xiaomi Phone Bootloader Unlock & Root! (REDMI/POCO/MI) 2025 Guide https://t.co/9WFV1AXlzJ via @YouTube

[zodiac_ @_zodiacHacker]

Install & Setup Genymotion & MobSF for Android APK 📱 Dynamic Analysis (... https://t.co/749AuAgaHl via @YouTube

[zodiac_ @_zodiacHacker]

Intercept Android Traffic Over USB→ Burp Suite - USB Debugging (No Root... https://t.co/t9C3NRckg1 via @YouTube

[zodiac_ @_zodiacHacker]

Mobile Hacking Resource Kit: Your one‑stop hub for iOS and Android pen testing By @Bugcrowd

https://t.co/DcMQwPeSMc

[zodiac_ @_zodiacHacker]

Android Bug Bounty

Building an Android Bug Bounty lab: the ultimate guide to configuring emulators, real devices, proxies and other mobile hacking tools (featuring Magisk, Burp, Frida):

https://t.co/azZxQRV8R1

[zodiac_ @_zodiacHacker]

https://t.co/VGqtpUZDSW

[Web Security Academy @WebSecAcademy]

“HTTP/1 is simple” is one of the most dangerous lies in web security.

Its hidden complexity has fueled years of desync vulnerabilities across the internet.

Here are 5 lies about HTTP/1.1 and why they’re dead wrong👇

1️⃣ Lie 1: An HTTP/1.1 request can't directly target an intermediary

In reality, attackers can craft requests that hit reverse proxies or CDNs directly, bypassing intended routing and opening doors for desync exploits.

2️⃣ Lie 2: An HTTP/1.1 desync can only be caused by a parser discrepancy

While parser mismatches are common, other quirks like HTTP/2 downgrades or non-standard header handling can also cause dangerous request misalignments.

3️⃣ Lie 3: An HTTP/1.1 response contains everything a proxy needs to parse it

Proxies often need the original request context to know where the response ends. Lose that, and you get chaos.

4️⃣ Lie 4: An HTTP/1.1 response can only contain one header block

Multiple header blocks are possible, especially with quirks like the Expect header. This breaks assumptions and can leak sensitive data.

5️⃣ Lie 5: A complete HTTP/1.1 response requires a complete request

Responses can arrive before the client finishes sending the request, creating opportunities for timing-based smuggling attacks.

The truth?

HTTP/1.1’s design leaves tiny bugs with massive consequences.

Proxies need complex branching logic to handle header quirks, multiple blocks, and incomplete requests, all while guessing where one request ends and the next begins.

HTTP/1.1 is not simple.
It’s fragile, unpredictable, and inherently insecure in modern architectures, making more desync attacks are inevitable.

The only REAL fix is moving to upstream HTTP/2.

Learn more in @albinowax's latest whitepaper "HTTP/1.1 must die: the desync endgame"👇
https://t.co/1GJRNTaliX

[zodiac_ @_zodiacHacker]

HTTP Request Smuggling In Bug Bounty Hunting by Zodiac Hacker https://t.co/ekYRlhE8Aj

[zodiac_ @_zodiacHacker]

I completed the Web Security Academy lab:
Client-side desync

@WebSecAcademy
https://t.co/Jdm2Tw4gQC

[zodiac_ @_zodiacHacker]

I completed the Web Security Academy lab:
Server-side pause-based request smuggling

@WebSecAcademy
https://t.co/t0Ei2G0XA7

[zodiac_ @_zodiacHacker]

I completed the Web Security Academy lab:
Bypassing access controls via HTTP/2 request tunnelling

@WebSecAcademy
https://t.co/53rnwiygHF