Leonel Flores

So addicted to podcasts…and the cyberspace🧑🏼‍🚀

[me @twetsfyp]

Stanford has just leaked this free class that explains how claude and chatgpt work from the inside

The majority wastes 90% of its potential

Stanford teaches it to you in 1h50 minutes

Save this to favorites so you don’t lose it​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​.

[0xdf @0xdf_]

WingData from @hackthebox_eu features a null-byte Lua injection in Wing FTP Server for RCE, cracked password hashes for a pivot, and a Python tarfile extraction-filter bypass for arbitrary write to root.

https://t.co/fuS43FYvYz

[Ayush Anand @Securityinbits]

Three ssh.exe -R reverse tunnels in MDE. Same binary, three different shapes.

1️⃣ -R 9090:127.0.0.1:8080: 1 IP, 1 port, 1 success, 0 failures. A fixed forward to one service.

2️⃣ -R 8888: 1 IP, 1 port, 1 success, 1 failure. SOCKS, but pointed at known hosts.

3️⃣ -R *:10400: 250 IPs, 5 ports, 6 successes, 296 failures. SOCKS proxying a subnet sweep.

The scanner never touches the command line. The IP and failure counts give it away.

[Kostas @Kostastsale]

You can now provision a whole Active Directory environment within Threat Hunting Labs Playground.

Use Atomic Red Team from the main console or get direct access to the provision resources to run your own tests and inspect the telemetry in the SIEM of your choice!

[Faiyaz Ahmad @thehacktivator]

What if I told you that a seemingly secure endpoint returning 403 Forbidden could still expose another user's data?

In my latest video, I demonstrate a lesser-known IDOR bypass technique that can sometimes slip past authorization mitigations implemented by developers.

You'll see:
• A practical exploitation demo
• Why the mitigation fails
• A source code walkthrough
• The underlying security concepts behind the issue
• How developers can properly fix it
One of the biggest mistakes in web application security is assuming that a blocked request automatically means the underlying authorization logic is secure. This video shows why that's not always the case.
Watch here:
https://t.co/QP6lBOz8F8

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

WAF bypass + critical blind SQLi stacking up — this is what real bug bounty grind looks like. 🔥 Great work. The WAF is never as scary as people think once you understand how it actually parses input. 🐀

[DirectoryRanger @DirectoryRanger]

Windows Privilege Escalation
01: Initial Enumeration https://t.co/RwJyWY2A1l
02: Running through PrivEsc Paths from Zero https://t.co/81DbZ1UaNv

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🔍 Free Security Testing Checklist for Bug Bounty Hunters!

I put together a comprehensive web app security checklist covering everything you need:

✅ Recon & Hidden Endpoints
✅ XSS (Stored/Reflected/DOM/Blind)
✅ SQLi, SSRF, SSTI, XXE, CSRF, IDOR
✅ Command Injection, LFI/RFI
✅ File Upload, HTTP Headers
✅ Vulnerability Chaining strategies

100% free & open source. Use it, fork it, improve it.

🔗 https://t.co/qbagcHlQ9O

#BugBounty #PenTest #WebSecurity #XSS #Hacking #CyberSecurity #OSCP

[0xdf @0xdf_]

NanoCorp from @hackthebox_eu is a Windows AD box. A careers site extracts uploaded zips, so a .library-ms file leaks a Net-NTLMv2 hash. Then ACL abuse to reset a Protected Users account, and a Checkmk agent privesc to SYSTEM.

https://t.co/Cf4IxTPbIW

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🐀 subScraper — Your Recon Command Center is here! 🔍

Full pipeline automation: Amass → Subfinder → ffuf → httpx → nuclei → nikto all in ONE go!

✅ Live web dashboard with real-time job tracking
✅ Stateful & resumable scans — pick up where you left off
✅ System resource monitoring (CPU, RAM, disk, network)
✅ Screenshot gallery, actionable reports & export to JSON/CSV
✅ Docker support (amd64, arm64, armv7)
✅ User auth, HTTPS, and auto-install helpers

Check it out & drop a ⭐ — 306 stars and counting!
👉 https://t.co/gpt9ovEdzg

#BugBounty #Recon #EthicalHacking #CyberSecurity #OpenSource

[BRute Logic @BRuteLogic]

Wayback URL Recon - One Liner

curl -s 'https://web .archive.org/cdx/search/cdx?url=testphp.vulnweb.com/*&output=text&fl=original&collapse=urlkey&filter=statuscode:200' | grep -viP '\.(png|jpg|jpeg|gif|svg|ico|pdf|css|mp4|woff2?|ttf|eot)(\?|$)' | sed 's/:80\//\//' | sort -u

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Subscraper - the one stop shop for all your subdomain needs https://t.co/fHiR4LAa2t

With it's built in workflow and FREE open source tech ... anyone can make this into anything you need/want

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Just dropped: 2026 Practical Bug Bounty Guide 🐀

Full methodology — picking platforms, recon, Burp workflow, XSS/SSTI/SQLi/IDOR/SSRF/XXE, modern surface (GraphQL, OAuth, prototype pollution), WAF bypass, chains & reporting.

https://t.co/s72ZEfSNUw

#infosec #bugbounty

[0xdf @0xdf_]

Interpreter from @hackthebox_eu features unauthenticated XStream deserialization in Mirth Connect for RCE, cracking a password hash from the Mirth database, and Python f-string injection through eval for root.

https://t.co/fRpWxJtyhk

[Vivek | Cybersecurity @VivekIntel]

⚔️ Claude-Red = Offensive Security Skills for Claude AI

A massive open-source framework that transforms Claude into a context-aware red team assistant. 🔥

📚 100+ offensive security skill modules
🌐 Web exploitation
🧠 Active Directory attacks
☁️ Cloud attack paths
📡 Wireless exploitation
💥 Exploit dev & fuzzing
🤖 AI security testing

Built for:
🎯 Bug bounty hunters
🛡️ Red teamers
🔬 Security researchers
🎓 CTF players
☁️ Cloud pentesters

Capabilities include:
✅ SQLi / XSS / SSRF / RCE
✅ ADCS / Kerberos / ACL abuse
✅ EDR bypass & shellcode ops
✅ WPA2/WPA3 attacks
✅ OAuth & JWT exploitation
✅ Prompt injection & jailbreak testing

🔗 https://t.co/QraHdkdU0A

#RedTeaming #Hacking #CyberThreat #ThreatIntel #Pentest #OpenSource

[Vivek | Cybersecurity @VivekIntel]

AdStrike — AI Powered Active Directory Attack Framework 💀🔥

A modular red-team framework built for advanced AD operations, Kerberos workflows, ADCS abuse, credential access, lateral movement & attack-path analysis. ⚡

🔥 58 interactive modules
🛡️ Kerberos-aware workflows
🤖 AI-assisted operator agent
📊 HTML / JSON / Markdown reporting
⚔️ BloodHound, Impacket, Certipy, NetExec integration

Built for professional red team operations & authorized security testing.

📌 Credit: @tmrswrr
🔗 https://t.co/eRNFDgJBQd

#ActiveDirectory #RedTeam #CyberSecurity #Pentesting #ADSecurity #OffensiveSecurity

[BRute Logic @BRuteLogic]

Path Traversal Bypasses

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32Fpasswd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

[0xdf @0xdf_]

MonitorsFour from @hackthebox_eu features PHP type juggling to dump users, CVE-2025-24367 for RCE in Cacti, and CVE-2025-9074 to abuse the Docker Desktop API and mount the Windows host drive for root. Beyond Root: a shell on Windows."

https://t.co/DtjU6qwqjB

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

IDOR is the bug that pays beginners their first bounty. Most hunters walk straight past it.

Run this on any target today:

1. Make 2 accounts — A and B. You need a victim to prove real impact.

2. As account A, log every request that carries an ID: /api/user/1043, ?invoice=88, /orders/55.

3. Swap in account B's ID. Test all four verbs: read, update, delete, create.

4. Don't stop at numbers. Decode base64 IDs (often just integers in a costume), reuse UUIDs you leaked elsewhere, and check IDs buried in JSON bodies — not only the URL.

5. Hit the boring endpoints: export, PDF download, "email me a copy", avatar upload. Devs forget access control on features nobody demos.

6. Always escalate. Reading a user's data = finding. Changing their password or reaching an admin object = CRITICAL. Same root cause, 10x bounty.

Why it pays: scanners can't catch it. They don't know A shouldn't see B's data. Only a human with 2 sessions does.

Go find one. 🐀

[Amarillo @anyelamarillo]

Este video contiene las principales metodologías que utilizan los atacantes para hackear sitios web de WordPress.