Sujendranath Tumala

Offensive security, Pentesting.

[Office Of Vijay Patel @VijayGajeraO]

This is an extremely important thread for the Indian Gen Z.
1 Why is the Cockroach Janta Party a threat to national security?

Why are they operating from the USA?

Who is behind Abhijit Dipke and his party?

Keep reading this thread for the complete answer.

[@[email protected] @SecurityMB]

Anyone I know interested in joining the Google Security Team in Zurich? Let me know, I can give a referral :D

Here's the job posting: https://t.co/yH2iUotLGV

[elvis @omarsar0]

Brainstorming with Claude Code for a longer time is underrated.

Some notes on building more confidently with Claude Code (CC) or other coding agents:

If you are building with coding agents like CC, you might be spending a lot of time on the initial prompt. But this is less iterative (not ideal for building) and leads to underspecified prompts that leave the agent guessing in most cases (what framework to use, version, project structure, etc.).

An alternative approach to this, especially if you are not confident in your prompt/context engineering skills, is to interact with your coding agent for multiple turns to help provide it with just enough details before it tries to build the feature/project. It's important not to overdo it. You will know when it's "just right" as you will see the coding agent eager to get started with implementing when it feels it has enough context (apparent from the more confident responses over time).

You want to be productive with the coding agent at the end of the day. Don't be strict with how much you spend on brainstorming, as it depends on the complexity of the feature/project v1. But this process can save you long hours/days of frustrating interactions with the coding agent in the long term. I know many of you are experiencing those today. This is one way you can avoid too many of those frustrating sessions.

I find that conversing with CC for longer helps to build context that CC can then use to build out features or entire projects (end-to-end) in some instances. It's no different from when you are interacting with teammates before deploying. This is particularly useful when you are getting started. What you notice quickly is that you become more aware of what CC lacks upfront, and these longer interactions become less frequent over time and as you work on other projects/features.

The reason I believe this works is that you are essentially narrowing the AI's scope of exploration. And you are helping to fill in project details that the coding agent would otherwise be guessing. Underespecified prompts are the worst, and this applies to coding and other areas.

When building with coding agents, don't underestimate how important your knowledge and skills are to improve the reliability of the agent. Human-AI-Brainstorming is one of the many underappreciated human-in-the-loop approaches that can give anyone (with prior programming knowledge) a significant edge in the age of more advanced coding agents.

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

I had a debate with Marcus Hutchins about AI.

- He basically thinks it's unintelligent autocomplete
- I think it's going to disrupt/replace millions of jobs

https://t.co/DlKSquqief

[ADG PI - INDIAN ARMY @adgpi]

#PahalgamTerrorAttack

Justice is Served.

Jai Hind!

[HD Moore @hdmoore]

The researchers who found the Next.js bug (CVE-2025-29927) have released the full paper:

Set x-middleware-subrequest to
middleware:middleware:middleware:middleware:middleware OR
src/middleware:src/middleware:src/middleware:src/middleware:src/middleware

https://t.co/i4pnTmBGCH

[Gargi #Decolonization 🇮🇳 @gargiuvacha]

I have never seen my husband so angry.
While watching Chhava, he opened the Wikipedia page of Chhatrapati Sambhaji Maharaj to read more about him.
Later, he said to me fuming,
“Write about this. This is a disgrace.”

And he was right!
The Wikipedia page of Chhatrapati Sambhaji Maharaj is nothing short of a malicious, colonial-era propaganda dump, thinly veiled as “neutral information.”
It’s a deliberate character assassination of a Hindu warrior-king who defied Aurangzeb.
Let’s demolish it point by point. 🔥
🧵

[Intigriti @intigriti]

Want to automate SSTI vulnerabilities and achieve RCE? 🤑👇️

Tplmap is an open-source SSTI scanner capable of scanning for all sorts of SSTI vulnerabilities in over 15 templating engines like Jinja2, Tornado, ERB, ...! 😎️

Check it out on Github! 👇️
https://t.co/sRhB4ofOKc

[Sheila A. Berta @UnaPibaGeek]

⚡️New technical post: Dealing with inputs and outputs when writing @pdnuclei 'network' templates - working with `read`, and various complex scenarios :)

https://t.co/m6mqvQmGYQ

[Geekboy @emgeekboy]

[NEW-RELEASE]

Generate @pdnuclei template as you browse the internet using Nuclei AI - Browser extension.

Nuclei AI Extension: https://t.co/lK3c7Ra7vf

#hackwithautomation #appsec #security #bugbounty

[Florian Roth ⚡️ @cyb3rops]

If you really want people to click on your phishing link, make it a small „unsubscribe“ button at the end of an subtly annoying newsletter

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

I just put out v1.0 of my AI Attack Surface Map that goes over the following:

🤖 The primary components of AI attack surfaces
🔓 Learn about AI Assistants, Agents, Tools, Models, and Storage
🎯 Explore various attack methods and their potential impact

https://t.co/ckdTC48e57

[Sujendranath Tumala @blysec]

@john_avex @aaditsh 🤣🤣

[Sundar Pichai @sundarpichai]

We've started rolling out support for passkeys that let users sign in to our products with a fingerprint, a face scan or a screen lock PIN. Starting today, this will be available as an option for Google Account users.
https://t.co/wBSIqAfiCe

[Sujendranath Tumala @blysec]

@LiveOverflow @_JohnHammond It’s all about how precise your question is

[Sujendranath Tumala @blysec]

Better than Google + stack overflow combined for most scenarios 😂

[Angela Yu @yu_angela]

ChatGPT is the new Google.

[Intigriti @intigriti]

Were you able to spot the vulnerability in yesterday's code snippet? 🕵️‍♂️
✅ Yes? Amazing!
❌ No? Don't worry. This was hard, so let's take a look at the writeup 👇
🧵 Be sure to keep reading this thread for more resources and the winner of our swag!

[Sujendranath Tumala @blysec]

@hakluke These also happen to be issues that come out of DAST tools with default configuration 😂

[Orange Tsai 🍊 @orange_8361]

My favorite bug among the vulnerabilities I presented today! 😆

The original intent was to compare the password. However, the developer copy-and-pasted the code but forgot to replace the variable name. That leads to the Authentication Bypass on IIS.

[Utkaarsh Sharmaa @iamRoccoo]

I don't understand why people take freedom for granted. In the name of freedom of speech and freedom of expression; unrealistic, unethical, provoking attributes are being made by some so-called liberals. It is not fair to attack Hindu beliefs. 🤬
#HinduInsultNotArt #kaaliposter