brian kobz

InfoSec enthusiast by passion||Network security is my lifestyle||IoT is a habit||Crazy foodie by nature||Goofy is my mantra||Art lover||God Above all.

[PictureAddicts @Pictureaddtt]

New Naruto..

[Classic arts & Wallpapers 🥷 @Classisco123]

Ed, Edd n Eddy

[Crazy Kennar @crazy_kennar]

WHAT THEY TOOK,REBRANDED AND SOLD BACK😂😂😂😂

[Moses Kemibaro @moseskemibaro]

Yesterday, I was at Nairobi Street Kitchen for the launch of Absa Next, the new digital financial services app from Absa Bank Kenya, and I have spent the better part of the last day thinking about it.

My opinion is that Absa is disrupting itself before it gets disrupted. Absa Next is not an upgrade to the Absa app. It is a second, open front door into the bank: you do not need to be an Absa customer, onboarding takes under a minute with a mobile number, an ID and a name, and the app brings personal and business wallets, instant credit from KES 500 to KES 1 million, savings of up to 7%, chama and harambee group banking, bill splitting, open banking links to other accounts and Visa cards and a rewards scheme into one place - that's a lot for sure!

Investment products promising up to 16% are due in the coming weeks. That is a neobank, in the mould of a Monzo or a Revolut, built inside a 110-year-old bank.

Three things stood out:

1/ First, a senior technology leader told me the bank essentially built a technology incubator untethered from the legacy business to make this happen, which is a clear statement of intent and, in Kenya, unconventional.

2/ Second, the group sponsor is Sitoyo Lopokoiyit, who ran M-PESA Africa until March 2026 and who said on stage that there is no innovation at the centre of a group; it happens where the bank meets its customers.

3/ Third, there is no finish line: Absa has committed to weekly and monthly drops after launch.

There are also questions:

1/ The 16% is not live yet and sits well above the best money market fund (MMF) in Kenya.
2/ The loan pricing has not been disclosed.
3/ Timiza, Absa's earlier standalone product, is still running and nobody explained how the two relate.
4/ And every rival, from NCBA Loop to KCB, Equity, Co-op and Stanbic, has been building towards the same destination as Absa Next's

I have written it all up in full, with what each of the four Absa speakers said and how Absa Next compares with Loop, the banks and M-PESA here:

https://t.co/wOAVz29ZKx

#AbsaBankKenya #AbsaNext #Banking #MobileBanking #FinancialServices #Fintech #Apps #MobileApps #Technology #Kenya #Africa #BFSI #DigitalFinancialServices

@AbsaKenya @Absa

[Avid @Av1dlive]

jev + opus 5.5... i simply can't comprehend why everyone isn't building this yet.

in my workflow, this cut costs and time by ~80%. i think it's one of the best ways to use it.

→ pick relevant project notes before loading the context
→ route suitable tasks to a faster worker
→ choose a recovery path when a tool fails
→ run focused checks before the full test suite

opus handles the hard reasoning. jev picks from options the harness prepares and validates.

i explain how to build the decision layer in the article below:

[Mr. Buzzoni @Mr_Buzzoni]

this is unreal f*cking gold for Jev builders

20 repos people are building on Jev right now. browser agents, context tools, trading bots, even a drone

1. JEV-Ultrafast - a fast browser agent
↳ https://t.co/PFrtNfFwsu

2. Fast-JEV-Compaction - context compression
↳ https://t.co/pJ3IgJaN5d

3. JSON-Render - generative UI
↳ https://t.co/dft8Eiz9Br

4. Typesafe-MCP - use Jev with any client
↳ https://t.co/iRG2vsdeS0

5. JEV-MCP - a judgment toolkit
↳ https://t.co/hMIRZ90gdv

6. Semdecide - a classifier that lives in your CLI
↳ https://t.co/OnFPl0RIW2

7. JEV-Codex-Router - routes each task to the right model
↳ https://t.co/elJ3XvVtwr

8. Winnow - garbage collection for your context
↳ https://t.co/PF4qDJ70r8

9. JEV-Review - code review triage
↳ https://t.co/c9XBvClWwl

10. Blink - a repo navigator
↳ https://t.co/j2lwSXZ0NK

11. Agent-Desktop - desktop automation
↳ https://t.co/7JciMbJAfU

12. Typesafe-Mario - an agent that plays Super Mario
↳ https://t.co/jkRuEOKczO

13. JEV-Drone - drone control
↳ https://t.co/xl54NCUvT0

14. OneVOneJev - a browser FPS
↳ https://t.co/NZctHEZWnH

15. JEV-Trader - HFT market making
↳ https://t.co/ICucwtK4E3

16. Prism - liquidity signal detection
↳ https://t.co/KCMi7MlL5u

17. Neo4Jev - knowledge graph traversal
↳ https://t.co/vIocQ1xlb6

18. JEV-Curate - training data screening
↳ https://t.co/oizfIwJTXE

19. Canny - checks whether a task was actually completed
↳ https://t.co/gOlCIN2ms9

20. KillMyIdea - scores startup ideas before you build them
↳ https://t.co/TsWgxCbnXC

pick by what you do:
> coding -> JEV-Review, Blink, Canny, JEV-Codex-Router
> context -> Fast-JEV-Compaction, Winnow
> automation -> JEV-Ultrafast, Agent-Desktop
> clients and tools -> Typesafe-MCP, JEV-MCP, Semdecide
> UI -> JSON-Render
> trading -> JEV-Trader, Prism
> data -> Neo4Jev, JEV-Curate
> founders -> KillMyIdea
> just for fun -> Typesafe-Mario, OneVOneJev, JEV-Drone

grab the one closest to your job and ship something on top of it this week

[Callan @callanxai]

Google Brain founder, Andrew Ng:

"Prompting will die in 6 months. Loops and graphs are what's replacing it."

In 97 minutes he shows how to build agents that plan, execute and improve without you

Prompts → Agents → Loops → Graphs

a loop closes one job without you sitting there

a graph decides which jobs exist and carries every accepted one into the next run

most people are still getting better at the part he gives six months

watch it today, then save the full guide on loops and graphs below ↓

[codila @0xCodila]

Send this Jev prompt to any LLM or AI agent

It sets up Jev → analyzes you → finds where you waste time and money → upgrades your AI setup beyond 95% of people...

Copy this now. Thank me later:

[Khairallah AL-Awady @eng_khairallah1]

this is f*cking gold

How to build your first AI agent (Full guide)

this is basically everything you need to know about building with Jev

in the right hands, this changes everything:

[Achei Mantos @lethinoais]

Na moral.. bem mais bonito que o iPhone 18

[lumxss @bkdgiffug]

做安全工作的，可以收藏下这个仓库：Anthropic-Cybersecurity-Skills。

里面整理了 817 个 AI Agent 安全技能，覆盖威胁狩猎、事件响应、数字取证、恶意软件分析、红队、云安全等 29 个方向。

每个技能都按 Agent Skills 标准整理，能直接给 AI Agent 调用。

还兼容 Claude Code、Cursor、Codex 等主流工具，GitHub 已经 2.6 万星。

安全方向想让 AI 帮忙干活的，这个技能库可以看看。
🔗 https://t.co/wH7dghpQbP

[Backpacking Daku @outofofficedaku]

Visa processing mood of each #Schengen country as of now...

About time I did this again...

Austria - Give me everything fully booked, including all internals too, and I'll grant you a visa, but I am still moody with approvals. We love emailing your employer to check the authenticity of your work profile, etc., so always give me updated details and also warn your employer to keep checking emails. Give me a dummy ticket, and I'll wait for the dummy ticket to expire and then reject your visa.

Belgium - I may or may not approve a visa, even if you give me all the docs. Even under the Friends and Family category for visiting my own son/daughter, I may just not approve. Also, I need to be reminded to push the file, as I'll keep the files pending.

Bulgaria - Newly added, and I am learning. I am what Croatia was when it joined Schengen. If I don't understand a profile, I would rather reject it than approve it. But I am slowly learning.

Czechia - I am the best country to apply to if you are doing the Czech + Austria + Hungary cluster. But visa-shop with me, and I may revoke your visa even before the trip or even during the trip. Otherwise, I am pretty chill.

Croatia - We joined Schengen in 2023 but still have not changed our processing process. But hey, we did reduce the maximum days before applying from 60 days to 45 days. That's an achievement, right? We are still slow in processing files. Appointments are occasionally not available.

Denmark - If your purpose is actually coming to our country, you're most welcome. No dummy flights. I'll also approve visas for the Faroe Islands. But we may call and ask you all the details about your trip.

Estonia - Most people visiting me do a day trip from Finland or are on business visits. Don't visa-shop with me, please.

Finland - You're welcome. Give me all your bookings and itinerary correctly, and take the visa. I am also quite liberal with visas under Friends and Family. Again, I am a Nordic country, so no dummy stuff with me, please.

France - I am the only country which will take your file even if the trip is next week. No questions asked. Haven't lived in India for the last 6 months? Don't worry, we'll manage it. Apply anywhere from India, and we'll process it within a week max. Quite liberal with approvals. While I do reject files occasionally in case you are visa-shopping, otherwise I am cool. My appeal process is pathetic, so just re-apply rather than waste time on an appeal.

Germany - Processing time has taken a hit with us, but we sometimes surprise travelers by processing visas in 2–3 days. I do have categories for urgent business travel, which helps. Also, I am the only country to write in my checklist that VFS cannot stop you from giving me any number of additional documents for your visa. Quite liberal with approvals too, and I'll always give you an MEV, but it will be for a short period, so there's no use for the actual trip.

Greece - I am a moody country. I did get liberal post the agency fiasco in Dec–Jan, but then I became how I was before. Still much more liberal than earlier. I also randomly reject the file for your spouse while granting you the visa. I am like that. Don't have your spouse's name in your passport? I need an Attestation/Apostille.

Hungary - The second-best country to apply to if you're doing the Czech, Hungary and Austria cluster. Not that fond of giving long visas, but I'll grant you one occasionally. Processing times are 2 weeks, and I get the job done.

Iceland - Don't play games with me. Give me everything fully paid and booked, and I'll grant you a visa. I hate dummy bookings. I'll also mention the exact reason in case I reject your file. All in all, I am quite liberal if you give me all confirmed bookings, including internals. Also, don't make the mistake of telling me you won't hire a car or go with some tour but will use public transport to do the Ring Road trip.

Italy - I'll not change my processing times. I have a hell lot of travelers coming in, and I don't care. I'll not add more staff. I'll also randomly jump appointment dates by 30 days, so many travelers just get stuck. And having jurisdiction is the icing on the cake, so you cannot apply from anywhere. Also, I won't ever answer a single email or call to the Embassy. I am just okay with granting LTV (Long-Term Visa) if you qualify.

Latvia - I do process a few files. Again, don't come to me just because you see a nice percentage of approvals or early appointment dates.

Liechtenstein - Switzerland handles my visa processing. I am not into all this. I have my money, and I chill.

Lithuania - In 2025, some 900-odd Indians applied with me, of which I approved 600 cases, I think. Just visit me by taking a visa from some other country for the maximum stay and, while passing by, say hi.

Luxembourg - I am liberal with the F&F category; otherwise, for tourism, etc., it's hard to justify the maximum days in such a tiny country.

Malta - Again, I am a moody country. Don't like many visitors. In fact, I am not good at approving the F&F category either. But sometimes, when companies have an R&R, etc., I am liberal, as the hotels earn from such large groups.

Netherlands - For the past few years, I relied on our staff in the Netherlands and other countries to process my files. Gulf tensions made those employees leave for safety, and I am stuck now. 3 weeks was my actual processing timeline, but now I process in approximately 45 days. Just one random day, I put out the notice that I'll now process in 45 days and derail the plans of so many travelers. But that's how it is? Bear with us. Ohh, and also, when applying under F&F, I'll love to have the municipality letter, even if it's not mandatory if you're not sponsored.

Norway - We have appointments ready. Again, no dummy stuff with me, please. Book everything. Make a plan yourself and apply. I may call to ask questions, but if you know what you're doing, I'll approve.

Poland - I am doing everything slowly. Appointments are still a pain. But I am slowly working towards it. The site is always under maintenance. But if you ignore the warning and go ahead, you may find an appointment.

Portugal - It's 2026, but I need a wet stamp on your leave letter if you're applying in Mumbai jurisdiction. I don't care if your company is digital or not; now I need a wet stamp. That's all. I need a wet stamp. And I am moody, and I process files leisurely.

Romania - I have joined Schengen, but my process is still with me, not with VFS. I'm still figuring out how, what, where, and when. In a few more months, I will be able to understand what's happening around me. Meanwhile, if you have a visa from another Schengen country, you are most welcome to visit.

Slovakia - Very rarely do travelers apply with us. Do a day trip from Austria or Hungary, or if you're a business traveler, apply for meetings, etc.

Slovenia - I am a mean-level pro if you apply with me. I'll ask you for fully confirmed flight tickets and stay bookings, which are non-refundable, and then I'll reject your visa. I can do that, and I may do it. So apply with caution. Even if you have a photography course booked with me, I'll still reject your visa if I'm in the mood.

Spain - I process the fastest visas of all the Schengen countries. But my agency, BLS, is a pain. They will hide appointments. They even make you buy Prime Time, etc. If a group is traveling from both jurisdictions, Delhi and Mumbai, I'll just apply separately and not show each other. Neither of the embassies talks to the other, and the file will just remain pending. Also, in Delhi, the timelines are not as fast as in Mumbai jurisdiction. All in all, pretty liberal country to get your visa. I'm pretty cool with dummy reservations. My appeal process is the most robust across all Schengen countries.

Sweden - Give me a proper itinerary. Again, I don't like dummy bookings. Share everything confirmed with me, and make sure you understand the itinerary, and I'll grant you a visa. I may call you randomly to inquire about the itinerary. That's all.

Switzerland - Follow the 15-day rule from appointment to travel, and I am good. Even if you have had a previous rejection from some other country and now you come to Switzerland, I may just approve your visa. Again, it depends on the mood and the documentation. I'll not take any additional docs other than those in the checklist. If you request, I will take a few docs. I am quite liberal with dummy reservations.

Share | RT

#DakuKaGyaan

[Marius du Preez @mdp_sec]

A lot of people have asked how the browser side of my AI bug bounty system works.

It is probably the part people struggle with most because giving a model browser access is easy. Giving it browser access that can survive real signup flows, CAPTCHA, anti-bot systems, authenticated testing, multiple accounts, and concurrent hunts is a completely different problem.

I currently run 100 persistent headed Chrome profiles on the same server as the rest of the research system.

They are not disposable Playwright sessions and they are not clean profiles created for every target. Each one has its own Chrome user directory and keeps its cookies, local storage, history, consent state, challenge cookies, saved sessions, and anything else the browser normally accumulates.

That means a profile becomes more useful over time.

If it has already passed a Cloudflare challenge, accepted a consent banner, signed into Google, or built normal browsing history, that state is still there when it starts again. Four profiles also have their own Google accounts signed in for targets where normal registration is blocked and social login is the only realistic path.

Every profile has a fixed Webshare IP.

The pool is currently split into 50 US profiles, 20 UK, 10 Australia, 10 Germany, and 10 Singapore. When a target needs a specific country, the system leases a free profile from that range. If geography does not matter, it selects a free profile from the full pool.

The same profile returns through the same IP rather than changing exit every request. That matters because the target is not looking at the IP in isolation. It sees the IP, country, timezone, cookies, account history, challenge state, and browser storage together. Keeping an old session while rotating through a different country every few minutes creates more problems than it solves.

Chrome also starts with a timezone that matches the profile's exit country. This is done at process level, so Date and Intl behave natively. I am not patching the timezone in JavaScript after the page loads.

I do not assume a proxy is good because the provider sold it as residential.

All 100 assignments are checked against the live provider inventory. Traffic is sent through every assigned proxy to confirm the actual exit IP and country with Cloudflare. The IPs are also checked through ip-api, ProxyCheck, and Scamalytics so I can compare geography, proxy flags, hosting flags, blacklist data, and fraud risk.

Those services disagree more often than people probably expect. A live Australian exit can be routed correctly while one older database still reports another country. One provider can call an IP residential while another calls it business or hosting. The audit records those disagreements and tracks changes over time. It does not automatically replace an IP because one service returned a bad-looking label.

Each browser is fully headed.

When a profile starts, it gets its own isolated 1920x1080 virtual display, its own small window manager, and its own noVNC connection. The 100 browsers do not share one desktop, so one profile cannot steal focus, resize another browser, or put a window over another hunt.

Most of the time the AI drives Chrome through CDP. Each profile has a known CDP port, so the research phases can attach to the existing tab, navigate, inspect the DOM, fill forms, upload files, execute JavaScript, read console output, extract cookies, and capture screenshots.

But because it is headed Chrome, I can open the exact same profile from my dashboard at any time.

If a login needs MFA, a consent manager is stuck inside a cross-origin iframe, a CAPTCHA does not solve, or something on the page needs human judgment, the system surfaces the profile that needs attention. I open it through noVNC, complete that step, and close the viewer.

The browser itself never moved. The same account, IP, cookies, tab, traffic, and authenticated state remain available to the AI when it continues.

Every profile also has NoPECHA installed for reCAPTCHA, hCaptcha, Turnstile, Cloudflare challenges, and Geetest.

Running the extension across 100 persistent profiles created its own reliability problem. An extension can be installed but missing its API key, missing its stored settings, disabled in the profile, or waiting for Chrome to download its code.

Before a profile starts, the lifecycle manager checks the extension files, settings database, preferences, API configuration, and toolbar state against a known working copy. If anything drifted, it repairs the profile while Chrome is stopped. The automation also knows the solver may be clicking inside a challenge, so it waits for the challenge to clear instead of sending CDP input at the same time and breaking it.

Normal browser traffic goes through a separate mitmproxy instance for each profile.

The route is Chrome, then the profile's MITM, then its fixed Webshare proxy, then the target. Each browser writes to its own flow file, so traffic from two hunts is never mixed together.

This is what makes the browser useful for more than navigating pages.

The AI can register an account, perform one normal action, and capture the exact requests the real product generated. That includes OAuth redirects, token refreshes, GraphQL operations, multipart uploads, presigned storage requests, CSRF headers, service-worker traffic, and APIs that were never obvious from static recon.

Once a valid request exists, the system decides whether it still needs the browser.

Most API testing is faster through curl or a script using the browser's authenticated state. IDOR matrices, parameter tampering, injection, race conditions, and mass assignment do not need a UI click for every payload.

If a request depends on rotating browser state, a service worker, SPA middleware, or page context, it can be executed inside the existing tab through CDP instead.

There is also a no-MITM mode.

Some anti-bot systems fingerprint TLS at the edge. Akamai is a good example. Chrome can look normal in JavaScript, but once mitmproxy terminates TLS, the target sees a different network fingerprint and refuses to validate the browser session.

For those targets I switch that profile to a small authentication-forwarding tunnel. Chrome still uses the same fixed Webshare IP, but its TLS passes through without being decrypted. I lose traffic capture for that session, but the target sees native Chrome TLS and the login flow works.

This is why CAPTCHA, JavaScript fingerprinting, TLS fingerprinting, and IP reputation cannot all be treated as the same browser problem. Each layer has a different fix.

Profiles are leased to an exact platform, target, research cycle, and role. Two agents are never allowed to drive the same profile because tabs share cookies, storage, account state, and the same MITM file. Sharing a browser would create fast progress that nobody could trust.

When a profile starts, the lifecycle manager archives its previous live capture, checks the exit configuration, fixes stale ports from crashed processes, clears only Chrome's crash-restore markers, verifies the CAPTCHA extension, starts the display, MITM, Chrome, and runtime support, waits for CDP, then records who owns it.

When it stops, Chrome closes but the user directory remains. The profile keeps the state that made it useful. Inactive profiles are also included in an encrypted daily backup because recreating Chrome is easy. Recreating months of browser state and authenticated sessions is not.

That is the browser stack.

The model gets CDP access, but CDP is only one part of it. The useful system is persistent identity, fixed and measured egress, headed Chrome, isolated displays, CAPTCHA handling, traffic capture, native-TLS fallback, human takeover, ownership, and recovery working together.

Without those layers, AI spends half the run fighting the environment and then reports the environment failure as target behavior.

And yes this is a massive read

#BugBounty #CyberSecurity #TogetherWeHitHarder

[0xor0ne @0xor0ne]

Using LLMs for vulnerability research (@ZephrFish)

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#infosec #llm

[cr3ghost @cr3ghost]

Two new logical flaws in Kerberos just dropped at Black Hat. Low-privileged user to full domain takeover, including domain admins.

If you're doing Active Directory pentesting, Kerberos attacks, red teaming, identity security, or detection engineering, read this.

KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Both are logical bugs, not memory corruption. Described as surprisingly easy to exploit.

https://t.co/dgJC3JHjOf

#Infosec #RedTeam #DetectionEngineering

[Luke Stephens (hakluke) @hakluke]

JWT testing can be pretty tedious: manually tweaking headers, re-encoding base64, re-signing with a cracked HMAC secret, testing alg confusion. Easy but just fiddly.

So I vibe coded a little app to do it. Works as a hands-on JWT hacking tutorial, or just a JWT editor / payload generator if you want to skip straight to breaking things!

Link in comment.

[Coffin @lostsec_]

Finally, the wait is over! 🔥

I know a lot of beginners have been waiting for this because there hasn’t been a single complete guide showing how to set up Claude Code for bug bounty hunting and using the DeepSeek API at a very affordable cost.

In this video, I’ll walk you through the entire setup step by step, and you’ll also see how powerful DeepSeek V4 Flash is for real-world bug hunting tasks.

Trust me, the results will surprise you.

🎥 Watch now and level up your bug hunting workflow.
https://t.co/tOnpkzGKq0

[Anatoli Kopadze @AnatoliKopadze]

Google just dropped a 1-hour course on agentic engineering from scratch:

00:00 - Build your first AI agent
08:24 - Give your agent real memory (short, persistent, long)
28:34 - Agentic loops that run for hours on their own
40:04 - Build your own MCP (MCP VS API)
1:00:22 - Wire up multi-agent systems

72 minutes and you'll understand agents better than most people building them.

Watch it today, then read the step by step guide for beginners on building loops below.

[Vikas gupta @vicky_grok]

there are five phases in every agent loop. most people only build two.

loop engineering is deciding what happens in each phase, and what earns the right to move to the next.

every phase answers one question.

1) plan
→ what is the single next action? not the whole roadmap. plans written at turn one are wrong by turn four.
keep it one line: state, gap, next move.

2) act
→ one action, executed. the design decision is size.
right-sized = the largest chunk you can still verify with a single check.

3) observe
→ the raw result comes back. 4,000 lines of test output when the agent needs 12.
truncate, summarize, highlight. context is a desk, not a landfill.

4) evaluate
→ did it work? are we closer? hard verification (tests pass, schema validates) beats a model's opinion every time.
this phase is what separates toy agents from real ones.

5) terminate
→ success exit, iteration cap, budget cap, stuck detection.
a loop with only the success exit is how surprise api bills happen.

not which model you picked.
whether every turn makes verified progress toward a defined finish line.

reliability is not a model property. it's a loop property.

full breakdown in the article below.

[Anatoli Kopadze @AnatoliKopadze]

Anthropic engineer:

"You're not supposed to prompt Claude. You're supposed to build a system that prompts itself."

In 45 minutes she shows exactly how Anthropic builds agents that remember, fix their own mistakes and get smarter with every run.

This beats any paid course on agents I've seen.

Watch it, then read the guide on building loops below.