Bhaskar kannan

[Tom Dörr @tom_doerr]

Equip AI agents with 818 cybersecurity skills mapped to 6 industry frameworks.

https://t.co/e4iY76zKIO

[Abhishek @aacle_]

I Connected Claude Code direct to Burp via MCP

one command:

```
claude mcp add burp --transport sse http://127.0.0.1:9876
```

that's literally it.

after that Claude start working by himself:

- browse my proxy history
- do auto-recon on target
- create testing todo-list
- play with requests and responses
- find bugs while i do other stuff

i just give him scope. he do the grinding. i do the thinking.

result so far: **11 confirmed bugs**

real bugs. not hallucination. i verified each one.

https://t.co/4ritanX0F4

[Aisar @aisarcore]

𝗛𝗢𝗪 𝗗𝗢 𝗬𝗢𝗨 𝗛𝗔𝗖𝗞 𝗧𝗛𝗘 𝗣𝗘𝗡𝗧𝗔𝗚𝗢𝗡 𝗔𝗡𝗗 𝗚𝗘𝗧 𝗖𝗔𝗨𝗚𝗛𝗧 𝗕𝗬 𝗔 $𝟮𝟱𝟬 𝗧𝗥𝗔𝗡𝗦𝗔𝗖𝗧𝗜𝗢𝗡.

– Kai West was 25, British, and running the dark web's biggest stolen data marketplace under the name IntelBroker

– His victim list reads like a who's who. Apple. AMD. Cisco. Nokia. General Electric. Europol. The US Pentagon.

– And a database containing the personal information of every member of the US Congress.

– He sold everything in Monero only. Untraceable by design. For 2 years nobody could touch him.

– Then in January 2023 an FBI agent reached out to buy $250 worth of stolen data and talked him into accepting Bitcoin just this once

– That $250 went into a wallet tied to his real Coinbase account. Registered with his actual UK driver's license. His real name and his real face.

– The FBI spent the next 2 years quietly building the case. Matching his YouTube watch history to posts on his hacker forum. Piecing everything together.

– He even had a fake LinkedIn saying he worked at the UK equivalent of the FBI. They publicly said they had never heard of him.

– In January 2025 he stepped down from running the forum. Said he was "too busy."

– He was arrested in France 3 weeks later.

– $25 million in damage. 40+ companies. 2 years of running the biggest stolen data operation on the dark web.

Brought down by $250 and one moment of trusting the wrong coin.

The most untraceable hacker on the internet forgot that Coinbase needs your ID.

[nisarga @ni5arga]

I had hacked CBSE's OSM (On-Screen Marking Portal) in February and had reported the vulnerabilities to CERT-In, but they were unable to patch most of them.

I've written a detailed blog post about it here: https://t.co/qyT23GkTEJ

[Bhaskar kannan @BhaskarKanan]

@ctrlaltintel @ctrlaltintel : Add this CVE-2025-7771 as well.. It is linked with Gentleman RaaS #Ransomware #APT #Malware #Cybersecurity

[hoeem @hooeem]

https://t.co/KW3rQbdBJT

[Nav Toor @heynavtoor]

🚨 BREAKING: Claude can now build your entire resume and LinkedIn profile like a $500/hour executive recruiter from Robert Half. For free.

Here are 12 prompts that get you interview calls within 7 days:

(Save this before it disappears)

[Bhaskar kannan @BhaskarKanan]

@YungBinary Thats interesting.. Based on my research, I don't find any CVEs exploited by #Tsundere botnet...did you find any?

[Mustafa Can İPEKÇİ @mcipekci]

On one of the recent engagements, the target was vulnerable to SQL injection, but the DBMS used was Oracle.

During testing, we noticed that the application was filtering SELECT, AND, OR and similar keywords, along with || to prevent string concatenation.

After a few attempts, I managed to bypass the application's filtering using newline characters like %0a and %0d in the request. This only allowed bypassing the SELECT keyword; AND and OR operators were still detected.

To use a traditional CASE WHEN construct, we needed string concatenation, but || was still being blocked.

At that point I tried |%0a| and realized that Oracle actually allows newlines between the concatenation operator. This made it possible to exploit the issue and extract data from the target.

The final payload looked something like this:

String'|%0a|(case when (select%0ausername%0afrom%0all_users%0awhere%0atrim(username)%0ais%0anot%0anull%0afetch%0afirst%0a1%0arow%0aonly)='<value>' then '1' else to_number(user) end)|%0a|'

This forced the application to generate an error when the false condition was triggered.

I hope this gives an idea for whoever reads this to never giving up and trying unusual, unexpected stuff during testing.
#BugBounty #pentesting

[Bhaskar kannan @BhaskarKanan]

APT #muddywater exploiting CVE-2026-1281 ... #Iran #CyberAttack

[Peter Girnus 🦅 @gothburz]

I am a diplomatic aide in the Sultanate of Oman's Ministry of Foreign Affairs.

My job is logistics. When two countries that cannot speak to each other need to speak to each other, I book the rooms. I prepare the briefing materials. I make sure the water glasses are the right distance apart. You would be surprised how much of diplomacy is water glasses. Too close and it feels informal. Too far and it feels like a tribunal. I have a chart.

We had a very good month.

Since January, Oman has been mediating indirect talks between the United States and Iran on Iran's nuclear program. The talks were held in Muscat and in Geneva. The Americans would sit in one room. The Iranians would sit in another room. I would walk between them. My Fitbit says I averaged fourteen thousand steps on negotiation days. The hallway between the two rooms at the Royal Opera House conference center is forty-seven meters. I walked it two hundred and twelve times in February. This is good for my cardiovascular health. It was less good for my knees. Both are in the service of peace.

By mid-February, we had something.

Iran agreed to zero stockpiling of enriched uranium. Not reduced stockpiling. Zero. They agreed to down-blend existing stockpiles to the lowest possible level. They agreed to convert them into irreversible fuel. They agreed to full IAEA verification with potential US inspector access. They agreed, in the Foreign Minister's phrase, to "never, ever" possess nuclear material for a bomb. I have worked in diplomacy for seven years. I have never seen a country agree to this many things this quickly. I made a spreadsheet of the concessions. It had fourteen rows. I color-coded it. Green for confirmed. Yellow for pending. By February 21 the spreadsheet was entirely green. I printed it. It is on my desk in Muscat. It is still green.

That phrase took eleven days. "Never, ever." The Iranians initially offered "not seek to." The Americans wanted "will not under any circumstances." We landed on "never, ever" at 2:14 AM on a Tuesday in Muscat. I typed the final version myself. I used Times New Roman because Geneva prefers it. The document was fourteen pages. I was proud of every comma.

Here is what they said, in the order they said it.

February 24: "We have a once-in-a-generation opportunity." — The Foreign Minister, private briefing to Gulf Cooperation Council ambassadors. I prepared the slide deck. Slide 14 was the implementation timeline. Slide 15 was the signing ceremony logistics. I had reserved the Palais des Nations in Geneva, Room XX. It seats four hundred. We discussed pen brands for the signing. The Iranians preferred Montblanc. The Americans had no preference. I ordered twelve Montblanc Meisterstucks at six hundred and thirty dollars each. They arrive on Tuesday.

February 27, 8:30 AM EST: "The deal is within our reach." — The Foreign Minister, CBS Face the Nation. He sat across from Margaret Brennan. He said broad political terms could be agreed "tomorrow" with ninety days for technical implementation in Vienna. He said, and I wrote this line for the briefing card he carried in his breast pocket: "If we just allow diplomacy the space it needs." He praised the American envoys by name. Steve Witkoff. Jared Kushner. He said both had been constructive.

I watched from the Four Seasons Georgetown. The minibar had cashews. I ate the cashews. They were nineteen dollars. The most expensive cashew I have ever eaten. But it was a good morning and we were within our reach.

February 27, 2:00 PM EST: Meeting with Vice President Vance, Washington. The Foreign Minister presented our progress. Zero stockpiling. Full verification. Irreversible conversion. "Never, ever." The Vice President used the word "encouraging." His aide took notes on an iPad. The aide did not make eye contact for the last nine minutes of the meeting. I noticed this. Noticing things is the only part of my job that is not water glasses.

February 27, 4:00 PM EST: "Not happy with the pace." — President Trump, to reporters.

Not happy with the pace.

We had achieved zero stockpiling. Full IAEA verification. Irreversible fuel conversion. Inspector access. And the phrase "never, ever," which took eleven days and cost me two hundred and twelve trips down a forty-seven-meter hallway.

Every American president since Carter has failed to get Iran to agree to this. Forty-five years.

Not happy with the pace.

February 27, 9:47 PM EST: The Foreign Minister's flight departs Dulles for Muscat. I am in the seat behind him. He is reviewing Slide 14 on his laptop. The implementation timeline. Vienna technical sessions. The signing ceremony. The pens.

I fall asleep over the Atlantic. I dream about water glasses.

February 28, 6:00 AM GST: I wake up to push notifications.

February 28: "The United States has begun major combat operations in Iran." — President Trump.

Operation Epic Fury. Coordinated airstrikes. The United States and Israel. Tehran. Isfahan. Qom. Karaj. Kermanshah. Nuclear facilities. IRGC bases. Sites near the Supreme Leader's office. Israel called their half Operation Roaring Lion. Someone in both governments spent time choosing these names. Epic Fury. Roaring Lion. I spent eleven days on "never, ever." They spent it on branding. The President said Iran had "rejected American calls to halt its nuclear weapons production."

Rejected.

Iran had agreed to zero stockpiling. Iran had agreed to full verification. Iran had agreed to "never, ever." Iran had agreed to everything in a fourteen-page document that I typed in Times New Roman.

The President said they rejected it.

I do not know which document the President was reading. I know which one I typed.

February 28, 18:45 UTC: Iran internet connectivity: four percent. — NetBlocks, confirmed by Cloudflare. Ninety-six percent of a country went dark. You cannot negotiate with a country at four percent connectivity. You cannot negotiate with a country that is being struck. You cannot negotiate. This is not a political opinion. This is a logistics assessment.

February 28: The governor of Minab reported forty girls killed at an elementary school.

I do not have logistics for that. There is no slide for that. The water glass chart does not cover that.

February 28: Lockheed Martin: up. Northrop Grumman: up. RTX: up. Dow futures: down six hundred and twenty-two points. Gold: five thousand two hundred and ninety-six dollars. An analyst at AInvest published a note titled "Iran Strikes: Tactical Plays." The note recommended positions in oil, defense stocks, and gold.

The most expensive cashew I have ever eaten was nineteen dollars. The most expensive pen I have ever ordered was six hundred and thirty dollars. The math suggests I have been working in the wrong industry. Defense stocks do not require water glasses. Defense stocks do not require eleven days. Defense stocks require one morning.

February 28: Israel closed its airspace and its schools. Iran launched retaliatory missiles toward US bases in the Gulf. The Supreme Leader promised a "crushing response." Israel's defense minister declared a permanent state of emergency. Everyone is using words I recognize in an order I do not. I recognize "permanent." I recognize "emergency." I do not recognize them next to each other. In diplomacy, nothing is permanent and everything is an emergency. In war it is the reverse.

February 28: The Foreign Minister has not made a public statement.

The briefing card is still in his breast pocket. It still says "within our reach."

[Dr. 2G Spectrum 🍇 💰 @EURONGREYJOY007]

#HappyNewYear2026 guys.... ❤️

Wish you a very very successful, happy &amp; prosperous new year ahead... 👍

[Bhaskar kannan @BhaskarKanan]

@_0b1d1 PDF please

[Defence Core @Defencecore]

���INDIA’S INFORMATION WARFARE GAP🔴

In 2019, Wing Commander Abhinandan’s actions reflected India’s 🇮🇳 clear tactical and operational success in the aftermath of the Balakot airstrike, where he shot down an F-16 while flying a generation-older MiG-21. Similarly, during the recent Operation Sindoor, the Indian Air Force inflicted heavy damage on Pakistani air assets and other military infrastructure. However, both instances expose a recurring gap, India’s underperformance in the Information Warfare (IW) domain.

Despite superior capabilities and clear military advantages, India has consistently struggled to control or even influence the global narrative. In the case of Operation Sindoor, the Indian Armed Forces decisively and unilaterally outmatched Pakistani forces, leaving no room for ambiguity on the battlefield, but much of the public discourse was hijacked by Pakistan’s fabricated "6-0" narrative. This misleading portrayal gained traction, despite India possessing satellite imagery, credible BDA (Battle Damage Assessment), and technical intelligence that could have been leveraged to shape perception globally.

The contrast becomes starker when compared to how other nations like Iran and Israel conduct synchronised IW campaigns. These nations demonstrate integrated strategic communication cells, bringing together defence SMEs, Indipendent OSINT analysts, digital creators, and diplomatic voices in a real-time, coordinated effort.

Notably, Pakistan was seen operating a centralised digital war room during the recent conflict, producing curated content, managing narratives, and launching coordinated misinformation offensives across platforms. This is an area where India, despite having significantly better resources and a vibrant defence analysis ecosystem, has room for improvement.

What Can we Learn and Do?

Institutionalise Information Warfare Cells: A permanent, multi-agency IW unit including MoD, MEA, and vetted OSINT/SME voices should be activated to proactively shape narratives.

Leverage Credible Indipendent OSINT Voices: Unlike legacy mainstream media, many OSINT analysts today command more trust and reach globally on digital platforms. India must identify, engage, and empower such voices as part of the narrative-building ecosystem.

Real-Time Digital Communication Infrastructure: A dedicated command-and-control centre for digital information operations, manned by experts on social media, cybersecurity, and defence, should be considered a national security imperative.

India's kinetic victories must be matched by narrative victories. The inability to capitalise on strategic wins, like Balakot or Operation Sindoor, reduces their long-term impact on deterrence and global perception.

[ADG PI - INDIAN ARMY @adgpi]

#PahalgamTerrorAttack

Justice is Served.

Jai Hind!

[Bhaskar kannan @BhaskarKanan]

@Vishnu_reddy17 Bro can't dm you.. I need a ticket

[Daniel López @0xDanielLopez]

TweetFeed is back again! 🔥

After some months paused, I could bring it back to life (thanks to @phage_nz)

✓ TweetFeed collects IOCs shared by the community here in in 𝕏
✓ Serves them via Feeds and an API
✓ All free

→ https://t.co/RFI7R9Tk6I

[Mrudul @__mrudul]

@5mukx This is the best blog for ad attacks from @M4yFly
Check it out https://t.co/2OObu1hxx1

[Bhaskar kannan @BhaskarKanan]

@polimernews WWw2``waaaaaaaaaaawaaaasWSWSwAeAWWwSWWSsaWSqqw

[Mayfly @M4yFly]

GOADv3 🏰 is almost ready !
You can now try the v3-beta version 🥳

📂 Repository : https://t.co/efjhSZddsa

📖 Documentation :
https://t.co/85kBU6q95u

What's new ? 🧵👇