Aalap Siddhpuria

Mind Brute-forcer | Cyber Security Enthusiast

[Ren @Ryrenz]

🧑‍🏫 兄弟们，想把 C 和 Linux 系统编程真正啃透的，伊利诺伊大学这本 Coursebook 直接免费拿去读

GitHub 上 2200+ star、两百多个 fork，它就是伊利诺伊大学厄巴纳-香槟分校 CS 341 系统编程课在用的教材

系统编程这块最难受的是资料断层：入门书讲到指针就收尾，真要搞懂进程、内存、文件描述符和并发，又只能去啃手册和大部头，翻两页就想放弃。Coursebook 假设你已经上过一门编程课、见过汇编指令，从这个起点接着往下讲，代码和讲解全是 C。

它最早是 Angrave 教授发起的一个众包 wikibook 实验，后来被课程社区接着做成了正式教材：补引用、补脚注、补延伸阅读和术语表，把当年野生的内容一点点做严谨，同时保持谁都能读、谁都能改。

想在电脑上看、想打印出来、想丢给 AI 当资料，pdf、markdown、html 三种导出格式都有，构建还是自动化的。

一门大学核心课的教材完全摊开在 GitHub 上，这事本身就挺了不起。

GitHub：https://t.co/fbv2gJrRe3

[spencer @techspence]

This Microsoft Defender for Endpoint ASR rule is really strong:

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Why is there no equivalent with other EDR products?

[Blackstorm Security @blackstormsecbr]

Our new website is live: https://t.co/eSjzqmwhvx

Since 2017 we have done one thing: vulnerability research and exploit development.

19 research articles · 1,657 pages · free
22 technical courses across 5 tracks

Original Research. Reliable Exploitation.

[@[email protected] @christruncer]

I always look forward to when we, CISA’s red team, gets to publish our reports, and today is one of those days! “A Tale of Two SOCs” - a story where we targeted two different orgs, with the same tradecraft, and very different responses. Read it! - https://t.co/vTldiRTi7J

[Mashood K @fromcodetocloud]

Free Linux resources that actually taught me the fundamentals. No paid courses needed.

Beginner:
1. https://t.co/cDL7hONKP6 — best free visual Linux learning site
2. https://t.co/vk3jphNqMp — learn Linux by hacking. Addictive.
3. https://t.co/QAHMJhkXjy — paste any command, it explains every part

Intermediate:
1. https://t.co/diFHopj5Ox — short, practical man pages. Way more useful than man.
2. https://t.co/Dh1lzQhFaG — MIT course on tools every dev needs. Free.
3. youtube: LearnLinuxTV — practical, no fluff

Advanced:
1. https://t.co/ifOyr2uP8v — Brendan Gregg's blog on Linux performance. Elite level.
2. https://t.co/8hGBTSI8XJ — full man pages when you need the real detail
3. https://t.co/NVXbhpZp2T — when you want to go very deep

[Aalap Siddhpuria @Aalapsec]

@uwu_underground @elasticseclabs A little context is appreciated.

[Aalap Siddhpuria @Aalapsec]

@alisaesage Somehow the joy of the process has now been disappeared because of this.

[Muhammad Ayan @socialwithaayan]

🚨 BREAKING: Someone just built the exact tool Andrej Karpathy said someone should build.

48 hours after Karpathy posted his LLM Knowledge Bases workflow, this showed up on GitHub.

It's called Graphify. One command. Any folder. Full knowledge graph.

Point it at any folder. Run /graphify inside Claude Code. Walk away.

Here is what comes out the other side:

-> A navigable knowledge graph of everything in that folder
-> An Obsidian vault with backlinked articles
-> A wiki that starts at index. md and maps every concept cluster
-> Plain English Q&A over your entire codebase or research folder

You can ask it things like:

"What calls this function?"
"What connects these two concepts?"
"What are the most important nodes in this project?"

No vector database. No setup. No config files.

The token efficiency number is what got me:

71.5x fewer tokens per query compared to reading raw files.

That is not a small improvement. That is a completely different paradigm for how AI agents reason over large codebases.

What it supports:

-> Code in 13 programming languages
-> PDFs
-> Images via Claude Vision
-> Markdown files

Install in one line:

pip install graphify && graphify install

Then type /graphify in Claude Code and point it at anything.

Karpathy asked. Someone delivered in 48 hours.

That is the pace of 2026.

Open Source. Free.

[Graham Helton (too much for zblock) @GrahamHelton3]

I'm literally begging people to start collecting, curating, and reading RSS feeds to get a good pulse in what's going on in the industry. There is no better concentrated source of information than a well curated RSS feed.

[AllTables @Jev_3ng]

Most SOC reports and write-ups are punchy, to-the-point, polished reports. After all, every investigation (regardless of vertical) starts out as a chaotic mix of different threads that we corral into order like a tired sheepdog dreaming of making it as an internet meme and retiring on the royalties.

Unfortunately, these polished reports don't capture how we actually form our suspicions, the pivots, the dead ends, the moment it all starts to make some semblance of sense.

If you've ever wondered what that process actually looks like, I've spun up a blog series that breaks down real MDR incidents to capture what it's like riding the investigation roller-coaster, so those new to the industry can see how we progress from start to end within the context of a SOC investigation.

Please enjoy this breakdown of a threat actor's attempt to enumerate and pivot further into the victim's environment — made with 100% organic human analyst tears! https://t.co/quNqiPaTDl

[wetw0rk @wetw0rk7]

Have you ever seen a CVE and want to turn it into an exploit but don't know how? Check out my latest tutorial where I turn CVE-2018-1160 into a fully functioning exploit!

Video can be found here:

https://t.co/VMtvy4U8ov

[Aalap Siddhpuria @Aalapsec]

@vxunderground They'd be scared - HELL TRUEEEEE!!

[Aalap Siddhpuria @Aalapsec]

@infinitelogins RESOURCES

[zseano @zseano]

It’s time to lock in. If you’re struggling with bug bounties, spend the next few weeks finding a target you personally enjoy. Bigger the scope the better! Then focus on them everyday for the entire year. Aim to hack 2-3 hours minimum a day. You’ll learn lots and find bugs.

GL!

[Aalap Siddhpuria @Aalapsec]

@ryancbarnett This is what I was looking for. Thanks Ryan for sharing.

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

OffSec Exam HTB Lists
#hacking #oacp #offsec #htb
https://t.co/PBSQvDoQCc

[Aalap Siddhpuria @Aalapsec]

@NanoBaiter Would you care to elaborate how exactly you managed to get into his system?

[Aalap Siddhpuria @Aalapsec]

@Wietze ., z⬆️

[Luke Stephens (hakluke) @hakluke]

Is Remote Code Execution the same as Remote Command Execution? It’s a trick question, and a common point of confusion for anyone new to cybersecurity.

We’ve all been there, staring at a list of terms that seem identical:

• Remote Code Execution
• Remote Command Execution
• Code Injection
• Command Injection
• RCE

I've spent enough time explaining this to others that I finally broke it all down. Let's make it simple.👇

[Interrupt Labs @InterruptLabs]

Our next 'Pathway to VR' profile comes from Adam, a researcher in our Basebands team.

Like many researchers, Adam honed his hacking skills by taking part in CTFs. He gives some great insights about the need for perseverance and continual curiosity in VR.