Tanmay

Cyber Security Researcher | Ex-Army

[JS0N Haddix @Jhaddix]

24 apex enumeration techniques, 63 subdomain enumeration techniques. Bypasses most CDN based WAF configurations... Our Armada Overwatch module is fucking 🔥🔥🔥

[Kapso @kapso_com]

Give your AI agent a WhatsApp number.

[Coffin @lostsec_]

Instead of Subfinder, try Subfaster.
It’s faster than Subfinder and uses keyless sources like thc, submd, crt, shodanct, rapiddns, hackertarget, and sitedossier.

It also has an option to resolve subdomains and keep only the live ones, so you don’t need to run httpx separately just for resolving. ⚡
https://t.co/RO1QFcLD5L

[TheOuts1derX @TheOuts1derX]

GitHub repos with reports/writeups for bug bounty hunters:

1. HackerOne Reports https://t.co/AFNt3oGGO0
2. Google VRP Writeups https://t.co/hkuwO1Yz6i
3. Facebook Bug Bounty Writeups https://t.co/H2AbmfHrRJ
4. Awesome Bugbounty Writeups https://t.co/8vrqvBWsh3
5. Daily Bugbounty Writeups https://t.co/82Bja7EERg

#BugBounty #BugBountyTips #Infosec #EthicalHacking #CyberSecurity

[Tanmay @blackk_hawkkk]

@hackinghub_io http://0.0.0.0/😁😁😁

[Coffin @lostsec_]

https://t.co/LNOtI3uoqk
Finally… my first members-only video is live 🔥

In this video, I’ve broken down everything you need to know about finding and exploiting Google API keys for Gemini access and other services.

No fluff. No theory-only talk. This is a complete, practical workflow on real live bug bounty targets.

Here’s exactly what you’ll learn:

1. Advanced GitHub dorking techniques that i personally use that actually lead to valid API keys on target companies and organizations with many techniques..
2. Manual hunting methods to increase impact that many experienced bug hunters ignore..
3. Using Burp Suite extensions for fast and efficient discovery
4. 403 bypass methods to unlock restricted endpoints with live bypass on google domain.
5. A private tool to scan single domains, multiple domains, and JS files with flexible options
6. API key verification and compatibility testing in the tool to maximize impact and high bounties.
7. A custom advance chat interface to use Gemini api key with some advanced internal models.
8. An additional tool to test Google Api keys across services like Firebase, Google Maps and much more..

And yes… I’ve included live findings on real bug bounty targets for poc**, so you can see exactly how everything works with zero false postive and speed.

Honestly, I wasn’t planning to share this at all. But I decided to release it as a members-only video for people who are serious about it can benefit, while keeping competition and duplicate reports under control on bug bounty platforms. Because if I made this public, it would quickly turn into mass scanning and duplicate submissions everywhere, which helps no one. Keeping it members-only means a smaller group can actually take fully advantage of it.

After watching this video, I’m confident that even if you’re new to bug bounty hunting or have never explored Google API key vulnerabilities before, you’ll be able to start hunting at scale and actually start earning good amount of bounties.

Don’t skip this video. Seriously.. you’ll thank yourself later.

[Tanmay @blackk_hawkkk]

@realDonaldTrump Need world response #world #IranWar‌ #Israël #usa

[Nicolas Krassas @Dinosn]

SecurityClaw - Open-source SOC investigation tool https://t.co/dBmas04pgi

[obscaries ❘ AppSec @obscaries]

🚨 SSRF in Next.js Apps – Interesting Research

If you're testing modern web apps, this is a great read from Assetnote on how SSRF can appear in Next.js applications.

Key attack surfaces they discuss:
🔹 /_next/image endpoint
🔹 Redirect-based bypass tricks
🔹 Server Actions behavior
🔹 Host header manipulation

Modern frameworks = new bug hunting opportunities. 🕵️‍♂️

🔗 https://t.co/hzk90Axdvk

#BugBounty #AppSec #WebSecurity #NextJS #SSRF

[zack0x01 @zack0x01_]

Hey #BugBounty hunters 👋

I found a bug that started as a low-severity HTML injection and ended up becoming a full account takeover.

Here’s the story of how it happened 👇
https://t.co/wO9ljpzXNZ

[Virrender Sehwag @virendersehwag]

Pressure?
Woh kya hota hai.
Our Boys played like it’s a Sunday gully match.
World Champions, Bharat🇮🇳🏆, third time in T20 World Cups

[Yuvraj Singh @YUVSTRONG12]

Back-to-back #WorldChampions! Defending a #WorldCup takes character and this team led by @surya_14kumar played with real intent on the biggest stage! 🇮🇳

@IamSanjuSamson @ishankishan51 @OfficialAbhi04 were outstanding in the final. Sanju, across the opportunities showed again why he’s a match winner. Ishan was consistent right through and played a solid role in India’s run. @IamShivamDube @hardikpandya7 shifted momentum at will when the game demanded it.

@Jaspritbumrah93 was truly special, the tougher the situation the better he got! @akshar2026 was magical with the ball, picking up crucial wickets, with Hardik, @arshdeepsinghh and #VarunChakaravarthy keeping the pressure on throughout.

Congratulations to coach @GautamGambhir and the entire support staff as well! A lot of hard work goes into moments like this!

India, World Champions again. 🇮🇳🏆

@BCCI

#ICCT20WORLDCUP #INDvNZ

[BCCI @BCCI]

𝐂.𝐇.𝐀.𝐌.𝐏.𝐈.𝐎.𝐍.𝐒 🇮🇳

#TeamIndia clinch a record 3️⃣rd ICC Men's #T20WorldCup title 🏆

Take. A. Bow 🫡

#MenInBlue | #Final | #INDvNZ

[Sachin Tendulkar @sachin_rt]

Winning the World Cup twice in a row, the first time any team has done so in the T20 format. Totally deserving and rightful winners of the trophy.

What a fantastic performance by our team and a special brand of cricket on display.

Well done, Team India. Jai Hind! 🇮🇳🏆

[Narendra Modi @narendramodi]

Champions!

Congratulations to the Indian team on winning the ICC Men’s T20 World Cup!

This remarkable triumph reflects exceptional skills, determination and teamwork. They have shown outstanding grit through the tournament.

This victory has filled every Indian heart with pride and joy.

Well done, Team India!

[Md Ismail Šojal 🕷️ @0x0SojalSec]

100+ AI agents turn into your autonomous pentest/research assistant:

AD-security, penetration-tester,plus tons of vuln-hunting & hardening
Deep semantic vuln detection across codebases
OWASP-style reviews & exploit path tracing
SecLists payloads & wordlists as installable skills

[Tom Dörr @tom_doerr]

Captures Android network traffic without proxies or certificates

https://t.co/yapp5OoF1Z

[Justin Gardner @Rhynorater]

Freaking sick

[Tanmay @blackk_hawkkk]

@intigriti As per scope large, medium or small. For medium need 3 days to understand the flow and all post professional life