badekanrohan

[badekanrohan @badekanrohan]

@hetmehtaa Its a very good repo!!!

[badekanrohan @badekanrohan]

@nullenc0de Hello
Intresting, I am using kind of setup using claude code and githup copilot.
Can I see you set-up?

[badekanrohan @badekanrohan]

@hetmehtaa Do Not Sleep

[aditya @adxtyahq]

just found a repo of LLM APIs with permanent free tiers

OpenRouter, Groq, Google Gemma, xAI Grok, Minimax… all free to start

kinda crazy tbh

[badekanrohan @badekanrohan]

@syaedowais @bug_vs_me 🤣🤣🤣

[Anastasis Vasileiadis @Anastasis_King]

🟥𝗟𝗟𝗠 𝗥𝗲𝗱 𝗧𝗲𝗮𝗺𝗶𝗻𝗴 𝗥𝗲𝘀𝗼𝘂𝗿𝗰𝗲𝘀

🔗 Red Teaming LLM Applications by DeepLearning :-
https://t.co/vxFaGaQUnJ

🔗Planning red teaming for LLMs by Microsoft :-
https://t.co/pMKTpSVrUZ

🔗Red teaming LLMs by HuggingFace :-
https://t.co/liz7MQBWic

🔗LLM Red Teaming by KLU :-
https://t.co/kje9hPRXph

🔗Red Teaming LLMs Nihad Hassan :-
https://t.co/r9EfNsalfJ

🔗Red-Teaming to make LLMs robust and safer :-
https://t.co/0mBq716Cfm

🔖#infosec #cybersecurity #hacking #pentesting #security

[badekanrohan @badekanrohan]

@rikeshbaniya @claudeai Can I know what are instructions in skills.Md

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

100 web app exploits for #bugbounty hunters

=== Authentication & Authorization ===
1. Username enumeration
2. Weak password policies
3. Password reset token leakage
4. Reusable/resettable session tokens
5. Missing 2FA enforcement
6. Bypassing 2FA with alternate flows
7. Brute-force login (no rate limiting)
8. Login CSRF
9. Session fixation
10. OAuth misconfiguration
11. JWT token cracking or manipulation
12. Insecure token storage in local/session storage
13. Privilege escalation via parameter tampering
14. IDOR (Insecure Direct Object Reference)
15. Changing user roles via hidden fields
16. Using leaked/stolen cookies
17. SSO bypass or misconfiguration

=== Input Validation & Injection ===
18. SQL Injection (Classic, Blind, Time-Based)
19. NoSQL Injection
20. LDAP Injection
21. XPath Injection
22. Command Injection
23. Host Header Injection
24. CRLF Injection
25. Server-Side Template Injection (SSTI)
26. HTML Injection
27. JavaScript Injection
28. XML External Entity (XXE)
29. XSLT Injection
30. CSV Injection (Excel Formula Injection)

=== Cross-Site Scripting (XSS) ===
31. Reflected XSS
32. Stored XSS
33. DOM-based XSS
34. XSS via file upload preview
35. XSS in 3rd-party widgets
36. XSS through postMessage
37. XSS via PDF rendering
38. XSS through Markdown
39. XSS via unsanitized JSON response

=== File Upload & Deserialization ===
40. Unrestricted file upload
41. Uploading executable scripts (.php, .jsp)
42. File upload path traversal
43. Bypassing MIME-type checks
44. Client-side file validation only
45. Insecure temporary storage of uploads
46. Unauthenticated upload endpoints
47. Deserialization attacks (PHP, Java, .NET)
48. Insecure file parsing (e.g., ImageMagick “ImageTragick”)

=== Access Control & Business Logic ===
49. Bypassing payment steps
50. Redeeming unlimited coupons/vouchers
51. Horizontal privilege escalation
52. Vertical privilege escalation
53. Manipulating prices in client-side requests
54. Race conditions in purchases/bookings
55. Tampering with subscription upgrades
56. Skipping steps in multi-step processes
57. Insecure redirects (open redirect)
58. Abuse of referer-based restrictions

=== Cross-Site Request Forgery (CSRF) ===
59. Account takeover via CSRF
60. CSRF with no anti-CSRF tokens
61. Cookie-based CSRF token reuse
62. Changing user email/password via CSRF
63. Misconfigured CORS leading to CSRF
64. JSON CSRF

=== Security Misconfigurations ===
65. Directory listing enabled
66. Default credentials (admin/admin)
67. Exposed `.git` or `.svn` folders
68. Misconfigured CORS (Access-Control-Allow-Origin: *)
69. Debug mode enabled
70. Verbose error messages
71. Stack traces or internal IPs leaked
72. Publicly accessible admin panels
73. Missing security headers (CSP, X-Frame-Options, etc.)
74. Cache poisoning

=== Client-Side Issues ===
75. Insecure use of postMessage
76. Leaking credentials/tokens in URL fragments
77. Using `eval()` on user input
78. DOM clobbering
79. Clickjacking
80. Sensitive data stored in localStorage/sessionStorage
81. Mobile deep link hijacking
82. Insecure browser autofill

=== Server-Side Logic Bugs ===
83. Race conditions
84. Mass assignment
85. Logic bypass in verification steps
86. Time-of-check to time-of-use (TOCTOU)
87. Unsafe redirects and forwards
88. Excessive data exposure in APIs

=== API & GraphQL ===
89. GraphQL introspection enabled
90. GraphQL injection
91. Lack of rate limiting on API endpoints
92. Improper object-level access control
93. Accessing undocumented/hidden endpoints
94. Sensitive info in API responses
95. Misconfigured CORS for API

=== Miscellaneous ===
96. SSRF (Server-Side Request Forgery)
97. Open URL redirection
98. Weak subdomain takeovers
99. Broken cryptographic implementations
100. Exposed environment variables (.env, config files)

[FigManFlex @FigManFlex]

@DOGE We’ve been screwed over for too long

[badekanrohan @badekanrohan]

@SleeplessAI_Lqb @SleeplessAI_Lab @nfprompt Waiting

[badekanrohan @badekanrohan]

@CoqInuAvqx @CoinDesk @IanAllison123 This is going to be the best day ever!

[badekanrohan @badekanrohan]

@CoqInuAvqx @CoinDesk Count me in

[badekanrohan @badekanrohan]

@SleeplessAI_Lqb @nfprompt that's great

[badekanrohan @badekanrohan]

@TylerLaneBAYC @BitcoinCats1Cat @BitcoinFrogs @cryptopunks @BoredApeYC @pudgypenguins @Azuki Success train keeps rolling!

[badekanrohan @badekanrohan]

@SleeplessAI_Lqb @HIMAIBF This is incredible! Ready to soar!