AnkSec

[Kanishk Dadhich @whotfbunny]

🚀 Just open-sourced Mass PII & Secret Finder.

Modern web apps load hundreds of JavaScript files, making it easy for exposed secrets and PII to go unnoticed. This tool automates the entire process—from discovery to validation.

🔍 Features:
• Crawl the target & discover every JS asset
• Detect 90+ secret types (AWS, GitHub, Stripe, Slack, GCP, JWTs, API keys & more)
• Find exposed PII
• Reduce false positives with entropy scoring, structural validation & reachability checks
• Export results to JSON, HTML, Markdown, CSV & SARIF
• CI/CD friendly
• Built-in scope enforcement & authorization confirmation
💯 Open Source:
https://t.co/uF3zSG8jfx
If you're into #BugBounty, #AppSec, or #InfoSec, I'd love your feedback, feature requests, and contributions.
@theXSSrat

#OpenSource #CyberSecurity #JavaScript #OSINT

[Intigriti @intigriti]

Mastering CPDoS! 🤑

A thread! 🧵 👇

[Intigriti @intigriti]

JS sourcemaps are a goldmine for bug bounty hunters! 🤠

1. Grab any target's source map files
2. Unpack them using sourcemapper
3. Run metis on the TypeScript source files

Example! 👇

[Vishal Vishwakarma @rootxvishal]

Built 2 free browser-based recon tools for bug bounty 🛠️
No install, no API keys, nothing logged.

🔍 Subdomain enum → https://t.co/83JmFWhKs1
🕸️ Passive URL crawler → https://t.co/uVJYeaXiqu

Open a tab, type a domain, go. Authorized recon only free sources, so a source may rate-limit/block occasionally.

#BugBounty #Recon #OffensiveSecurity #InfoSec #CyberSecurity #OSINT #PenetrationTesting #AppSec #bugbountytips

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[AnkSec @ank_sec]

@OreoB1scuit There is a github repo named allThingsSSRF I guess . It contains many writeups and videos related to ssrf

[termireum @termireum]

23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite
https://t.co/u9diA6VRnt

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

lof web apps that are built by AI, it have .md and mostly 🔥
so any app you test, JSP / PHP / ASP

Add for fuzzing the extensions
ffuf -w /wordlist -u .com/FUZZ -e .md,.db,.txt,.xml,.sql,.7z,.zip,.tar.gz,.env

it will take some time, but it will be back with very good results♥

[Patrickbatman @hamidonsolo]

https://t.co/VyI219VEmd

[zack0x01 @zack0x01_]

Here’s how I discovered an Account Takeover using https://t.co/GLZlGlnyVo (endpoint discovery function) 👇:

#bugbounty #bugbountytips

[Sharik Khan @4non_Hunter]

I just published a new #article on Medium.

How I Earned $76,000 Bounty From a Single Program on @Bugcrowd .

#BugBounty #Bugcrowd #CyberSecurity #EthicalHacking @Hacker0x01 @yeswehack @intigriti

https://t.co/pQelmwcQLQ

[Griffin @aussinfosec]

I have been doing bug bounty since 2011 and ran a program for a multinational bank. Put everything I've learned into https://t.co/78z1JfSzmr. Target selection, recon pipelines, chain patterns, report templates, the business side. Free, no paywall, no course upsell.

[Het Mehta @hetmehtaa]

LLMs for vulnerability research by @0xAsm0d3us

https://t.co/GLaabD7Ahi

[Damian Strobel @damian_89_]

Hey guys, I just launched https://t.co/ruxCzwsAni - if you are into IT security, bug bounty hunting, red teaming, ... this is interesting for you!

https://t.co/LdIxeQKhQw

[Behi @Behi_Sec]

https://t.co/K8gZsopzNg

[Truffle Security @trufflesec]

🚨 Google told devs: API keys aren't secrets. Gemini changed that.

😱 We found ~3,000 public keys silently authenticating to Gemini - exposing private files, cached data & charging for LLM usage

💥Even Google's own keys were vulnerable.

🔗 https://t.co/UYRE9uCozc

[André Baptista @0xacb]

Our pentesting agent found a 1-click ATO to RCE in @openclaw Gateway Control UI in under 2 hours.

Local instances can also be exploited with one click.

Patched in main, update now.

Watch the exploit 👇

[Six2dez 🇵🇸 @Six2dez1]

Burp AI Agent is now public

MCP-powered AI agent (and server) living inside Burp. Instead of a chat next to it, extends itself: tools, actions, live traffic and findings. AIO to reduce context switching while testing

Repo: https://t.co/tSIHsmY4wE
Docs: https://t.co/khQnwiJ2ZE

[AnkSec @ank_sec]

@Kle0z 😁

[André Baptista @0xacb]

@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯

@claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments. 

All fixed in v1.0.93 by switching from blocklists to allowlists.

Blog link 👇
https://t.co/1jCHd7AMtm