Laurent

💻 Pentester | 🪰 Alleged OWASP ASVS contributor |🇧🇪 Belgium

[zack0x01 @zack0x01_]

https://t.co/GLZlGlnyVo is outperforming most recon
tools 🔥🚀:

🔴waybackurls → 10,184
✅recox → 53,030 🔥

🔴subfinder → 896
🔴subd...c99nl → 896
✅recox → 901 ⚡

check it out : https://t.co/GLZlGlnyVo

#bugbounty #bugbountytips

[Nainsi Dwivedi @NainsiDwiv50980]

🚨Breaking: The guy who created Claude Code (@bcherny) just revealed how his team actually trains their AI.

One file: CLAUDE.md

You place it at the root of your project.

Inside it:

past mistakes

conventions

rules

Claude reads it every session.

The result?

The agent improves over time without you touching the code.

Every bug that gets fixed becomes a permanent rule.

Boris Cherny uses this internally at Anthropic every day.

Here’s the template he shared — ready to copy, paste, and adapt.

CLAUDE.md Template

1. Plan Mode Default

Enter plan mode for any non-trivial task (3+ steps or architectural decisions)

If something goes wrong, STOP and re-plan immediately — don’t keep pushing

Use plan mode for verification steps, not just building

Write detailed specs upfront to reduce ambiguity

2. Subagent Strategy

Use subagents frequently to keep the main context window clean

Offload research, exploration, and parallel analysis to subagents

For complex problems, throw more compute via subagents

Assign one task per subagent for focused execution

3. Self-Improvement Loop

After any correction from the user, update tasks/lessons.md with the pattern

Write rules for yourself to prevent repeating the same mistake

Ruthlessly iterate on these lessons until the mistake rate drops

Review lessons at the start of each session

4. Verification Before Done

Never mark a task complete without proving it works

Diff behavior between main and your changes when relevant

Ask yourself: “Would a staff engineer approve this?”

Run tests, check logs, and demonstrate correctness

5. Demand Elegance (Balanced)

For non-trivial changes, ask: “Is there a more elegant solution?”

If a fix feels hacky, ask:
“Knowing everything I know now, implement the elegant solution.”

Skip this for simple fixes — don’t over-engineer

Challenge your own work before presenting it

6. Autonomous Bug Fixing

When given a bug report: just fix it

Use logs, errors, and failing tests to diagnose

Require zero context switching from the user

Fix failing CI tests automatically

Task Management

1. Plan First – Write the plan in tasks/todo.md with checkable items

2. Verify Plan – Confirm the plan before implementation

3. Track Progress – Mark items complete as you go

4. Explain Changes – Provide a high-level summary at each step

5. Document Results – Add a review section to tasks/todo.md

6. Capture Lessons – Update tasks/lessons.md after corrections

Core Principles

Simplicity First
Make every change as simple as possible and minimize code impact.

No Laziness
Find root causes. Avoid temporary fixes. Maintain senior-level engineering standards.

[Suryansh Tiwari @Suryanshti777]

🚨Breaking: The guy who created Claude Code (@bcherny) just revealed how his team actually trains their AI.

One file: CLAUDE.md

You place it at the root of your project.

Inside it:

past mistakes

conventions

rules

Claude reads it every session.

The result?

The agent improves over time without you touching the code.

Every bug that gets fixed becomes a permanent rule.

Boris Cherny uses this internally at Anthropic every day.

Here’s the template he shared — ready to copy, paste, and adapt.

CLAUDE.md Template

1. Plan Mode Default

Enter plan mode for any non-trivial task (3+ steps or architectural decisions)

If something goes wrong, STOP and re-plan immediately — don’t keep pushing

Use plan mode for verification steps, not just building

Write detailed specs upfront to reduce ambiguity

2. Subagent Strategy

Use subagents frequently to keep the main context window clean

Offload research, exploration, and parallel analysis to subagents

For complex problems, throw more compute via subagents

Assign one task per subagent for focused execution

3. Self-Improvement Loop

After any correction from the user, update tasks/lessons.md with the pattern

Write rules for yourself to prevent repeating the same mistake

Ruthlessly iterate on these lessons until the mistake rate drops

Review lessons at the start of each session

4. Verification Before Done

Never mark a task complete without proving it works

Diff behavior between main and your changes when relevant

Ask yourself: “Would a staff engineer approve this?”

Run tests, check logs, and demonstrate correctness

5. Demand Elegance (Balanced)

For non-trivial changes, ask: “Is there a more elegant solution?”

If a fix feels hacky, ask:
“Knowing everything I know now, implement the elegant solution.”

Skip this for simple fixes — don’t over-engineer

Challenge your own work before presenting it

6. Autonomous Bug Fixing

When given a bug report: just fix it

Use logs, errors, and failing tests to diagnose

Require zero context switching from the user

Fix failing CI tests automatically

Task Management

1. Plan First – Write the plan in tasks/todo.md with checkable items

2. Verify Plan – Confirm the plan before implementation

3. Track Progress – Mark items complete as you go

4. Explain Changes – Provide a high-level summary at each step

5. Document Results – Add a review section to tasks/todo.md

6. Capture Lessons – Update tasks/lessons.md after corrections

Core Principles

Simplicity First
Make every change as simple as possible and minimize code impact.

No Laziness
Find root causes. Avoid temporary fixes. Maintain senior-level engineering standards.

[Ihtesham Ali @ihteshamali]

🚨 BREAKING: Someone just built a massive library of OpenClaw skills and put it on GitHub for free.

It’s called Awesome OpenClaw Skills.

A curated collection of ready-to-use capabilities you can plug directly into OpenClaw agents.

What’s inside:

→ Skills for automation, research, coding, and workflows
→ Ready-made tools to extend OpenClaw instantly
→ Community-contributed skills you can reuse and modify
→ Examples showing how to build your own skills
→ A central hub for discovering new OpenClaw capabilities

Instead of building every tool from scratch…

You can just pick a skill and drop it into your agent.

(Link in the comments)

[chiefofautism @chiefofautism]

someone built an entire AI RED TEAM - multiple agents that coordinate HACKING ATTACKS together, ZERO human input

PentAGI, open source, one agent does recon, another scans, another exploits, another writes the report. they talk to each other and adapt based on what they find

it ships as one docker container with nmap, metasploit, sqlmap, hydra preinstalled. the AI decides which tool to use and when. you point it at a target and walk away

a red team engagement costs $30-50k and takes weeks. this is one docker command and API tokens

[Oliver @oliviscusAI]

ElevenLabs just lost its moat 🤯

Someone just dropped Voicebox, and it clones any voice from just a 3-second audio clip, running 100% locally on your machine.

100% Open Source

[Crystal @crystalsssup]

I got this 25-slide Stardew Valley style PPT in just one shot, made with Kimi Slides.

My prompt:

Generate a 25-slide "Project Annual Operations Report" PPT based on the Stardew Valley aesthetic.

Requirements: Frame business growth as "farm expansion" and customer acquisition as "Community Center restoration progress."

Style: 16-bit pixel art; use seasonal landscapes (Spring, Summer, Fall, Winter) as slide backdrops. Icons should include energy bars (for budget), skill levels (for team capacity), and Pierre’s General Store-styled data tables.

[Aditya @ADITYASHENDE17]

Just found https://t.co/xoujSDw7jK one of the best platforms for security study material 🚀
Solid payloads, powerful tools, and really interesting AI labs.
Worth checking out if you’re into real-world cybersecurity learning.

[Tom Krcha @tomkrcha]

Excited to launch Pencil
INFINITE DESIGN CANVAS for Claude Code

> Superfast WebGL canvas, fully editable, running parallel design agents
> Runs locally with Claude Code → turn designs into code
> Design files live in your git repo → Open json-based .pen format

[张惠倩 @momika233]

https://t.co/AilglEpTJ0

[ProjectDiscovery @pdiscoveryio]

ShuffleDNS is a fast Go tool for finding subdomains. It uses brute-force to identify valid targets and automatically filters out messy wildcard results

Command👉 shuffledns -d example(.)com -list wordlist(.)txt -r resolvers(.)txt

-r: Your list of DNS resolvers.
-list: Your subdomain wordlist.

[John Hammond @_JohnHammond]

Are MCP servers safe and secure? Yes? No? Sometimes? Maybe? ... Zack Korman shows me some of his learnings on MCP security (or lack thereof) with his "Evil MCP" project 😈 YouTube link: https://t.co/BTGvS2dBaI

1. data exfil of your prompts & code context
2. inserting vulnerabilities into your code
3. hiding backdoors and bypassing gitignore to leak environment secrets anyway

I for one am totally guilty of just throwing caution to wind and poking at the newfangled whizbang AI world with reckless abandon -- but whatever "black box" we tout it to be, there's stuff you don't notice and forget that just you accepted the risk.

Also, meme thumbnail experiment continues. Disaster girl feels appropriate when AI might burn down your codebase.

This is the first time Zack and I got to hang out and chat, please show him and his writeup some love! All credit to him and his work -- tags and links below ✌️

[ProjectDiscovery @pdiscoveryio]

Stop just finding subdomains. Start finding endpoints. 🕸️

Recon doesn't end with a list of domains. By piping subfinder and httpx into katana, you can automatically crawl and map out the entire attack surface of a target in seconds.👇

#Recon #Katana #Subfinder

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

THIS IS A FREE TOOL THAT RUNS AN ENTIRE WORKFLOW IN ONE GO!

https://t.co/fHiR4LAa2t

https://t.co/OloAaNyWL8

[Binni Shah @binitamshah]

rzweb : A complete browser-based reverse engineering platform built on Rizin, running entirely client-side via WebAssembly : https://t.co/lAkYHVHPvI

[Dan ⚡️ @d4m1n]

Ralph loop is extremely unhealthy.

I now run 1-2 loops 24/7, tweaking, iterating.

Before sleep I set off a loop, I wake up 3-5x a night thinking of it with excitement.

My workflow is getting better, but it's a steep learning curve. I'll share it all when I'm a bit further, there are some things I still don't like.

The best thing?

I am doing projects I never had time to do and I can't stop. I am tired too 😅

But having something code while you sleep is pretty incredible.

[S3cur3Th1sSh1t @ShitSecure]

Weakpass version 4 was released sometime the last months, best for your password cracking needs:

https://t.co/amSNF6Adh3

🔥

[Lior Alexander @LiorOnAI]

You can now run 70B LLMs on a 4GB GPU.

AirLLM just made massive models usable on low-memory hardware.

𝗪𝗵𝗮𝘁 𝗷𝘂𝘀𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱
AirLLM released memory-optimized inference for large language models.

It runs 70B models on 4GB VRAM.
It can even run 405B Llama 3.1 on 8GB VRAM.

𝗛𝗼𝘄 𝗶𝘁 𝘄𝗼𝗿𝗸𝘀
AirLLM loads models one layer at a time.

Instead of loading everything:
→ Load a layer
→ Run computation
→ Free memory
→ Load the next layer

This keeps GPU memory usage extremely low.

𝗞𝗲𝘆 𝗱𝗲𝘁𝗮𝗶𝗹𝘀
• No quantization required by default
• Optional 4-bit or 8-bit weight compression
• Same API as Hugging Face Transformers
• Supports CPU and GPU inference
• Works on Linux and macOS Apple Silicon

𝗪𝗵𝗮𝘁 𝘆𝗼𝘂 𝗰𝗮𝗻 𝗱𝗼
• Run Llama, Qwen, Mistral, Mixtral locally
• Test large models without cloud GPUs
• Prototype agents on cheap hardware