Asad Anwar

Ethical Hacker || Penetration Tester || Bug-bounty Hunter

[Asad Anwar @asad_anwar90]

Stick to one program and deep dive, just sharing my recent 2 p1 reward form indeed program.

@Bugcrowd #ItTakesACrowd

[OpenAI @OpenAI]

Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.

In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.

[Hacktron AI @HacktronAI]

Two weeks on: what happened with the “Black October” vulnerabilities 🧵

𝗙𝘂𝗹𝗹 𝘄𝗿𝗶𝘁𝗲-𝘂𝗽: https://t.co/DJ3NdqpxHV

[Asad Anwar @asad_anwar90]

@hakluke @thedawgyg

[PsyopAnime @PsyopAnime]

funds are...safu?

[Abdelrhman Allam @sl4x0]

In this article, I break down how I built OSA, the architecture behind it, the tools I use, and the lessons I’ve learned along the way. https://t.co/00s1qu5Z1J

[shubs @infosec_au]

Published our high fidelity scanner for node2shell: https://t.co/mgoyVGpP2s

Detection logic was written by @hash_kitten late last week. Open sourcing it to do public good in detecting this issue black box.

[Alex Veremeyenko @alex_verem]

<!--
THIS PROMPT TURNS CLAUDE CODE INTO A NIGHT GUARD FOR YOUR SERVER.

RUN IT BEFORE BED TONIGHT.

Hackers hit the PHP bug within hours. Cloudflare saw millions of attempts. Today OpenAI found another hole, in Brotli.

You'll patch in days. They attack in minutes.
-->

[Kirill Firsov @k_firsov]

php2shell

Tomorrow is a helluva day.

[Asad Anwar @asad_anwar90]

@an1msh_ @OriginalSicksec @AnthropicAI @cjav_dev got approved in under 10 days

[Asad Anwar @asad_anwar90]

@mdp_sec

[Asad Anwar @asad_anwar90]

RT @ITSecurityguard: New research from our team at @SLCyberSec :

Pre-Auth Remote Code Execution in Adobe AEM!

👇🏻
https://t.co/b2WMbkoXA…

[Damian Strobel @damian_89_]

Rarely I post bug bounty tips anymore but this small gem is unknown to most ;)

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Everyone has access to the same stuff, but not everyone knows how to use them differently.

We get into it with @fransrosen in episode 195! https://t.co/YhDS6tOhSz

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

My First Article, if you like it retweet ♥, ill do more ♥ https://t.co/dQWkEaZw8j

[Simon @soeckly]

I got $90,000 for a RCE in Google.
https://t.co/cjm7ZaNMeq

[Tib3rius @0xTib3rius]

Repeat after me: UUIDs are not a fix for IDOR.

[cje @caseyjohnellis]

respectfully: i 👏 can 👏 barely 👏 open 👏 my 👏 harness 👏 without 👏 a 👏refusal.

do better @AnthropicAI. practitioners care about your actions, not your words.

https://t.co/5c53BjRZBb

[zonduu @zonduu1]

How I got RCE and full cloud takeover on Meta at their in-person event in Taiwan

https://t.co/iz8hwVbosw

[Asad Anwar @asad_anwar90]

Is @claudeai down?

[Intigriti @intigriti]

Manually searching through HTTP traffic for leaked credentials can be tedious... 😓

Leaked-Credentials by @h4x0r_dz gives you a ready-to-use regex that catches API keys, secrets, tokens, and database passwords across 100+ common patterns. It works directly in Chrome DevTools, Firefox and Burp Suite! 🤠

Check it out! 👇
https://t.co/9oiSV0TcBE