𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩

Associate Security Consultant | CRTP | eWPTXv2 | eMAPT | Bug hunter | Secured Apple, Asus,LG, Lenovo, Nokia and many more

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

Found reflected xss on aon VDP
#Hackerone

[Stephen Sims @Steph3nSims]

I want to share a quick thought for people in cyber security. This will be my longest tweet ever.

I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”

Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.

• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.

Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring

But other areas are expanding rapidly:

• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection

Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.

There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.

The worst thing you can do right now is fall into a doom loop.

...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.

But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”

…mute it and move on.

Instead:

Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.

We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!

[Altered Security @AlteredSecurity]

On-Prem Red Team Week Giveaway!

Win FREE access to:
• 1 CRTP seat
• 1 CRTE seat

How to participate:

1. Like & follow us
2. Comment which course you’re interested in and why
3. Repost

Winners will be announced on Jan 30, 2026.

On-Prem Red Team Week is live (28 Jan – 3 Feb 2026):

• 15% off on a single purchase
• 20% off on 2 or more purchases
• 25% off on 5 or more purchases
(includes extra 5% Early Bird for first 100)

Use code: REDTEAM2026

For more details: https://t.co/EbnixEzhNg

#RedTeam #OnPremSecurity #CyberSecurity #AlteredSecurity

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@AlteredSecurity CRTE🩷

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

I just published Bypassing SSL Pinning in Android Apps Protected with Talsec RASP
https://t.co/AsnbnBj558

#AndroidPentesting #Android #RASP_BYPASS

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

Interesting read on how red teams approach physical security bypasses and what organizations can learn from it. Worth checking out 👇
https://t.co/XSic67Rf4H
#redteam #physicalsecurity

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@TheGodOfficiall No

[Behi @Behi_Sec]

SSRF Trick:

Instead of 169.254.169.254, try http://instance-data.

It resolves to the same metadata IP and might bypass blacklists.

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@AlteredSecurity @nikhil_mitt 🩷

[Altered Security @AlteredSecurity]

GIVEAWAY!! 🔥

We’re giving away 1 seat of @AlteredSecurity Certified Evasion Techniques Professional (CETP) – Evasion Lab. 🚀

👉 How to participate:
1️⃣ Like 👍 this post
2️⃣ Repost🔁
3️⃣ Comment 💬 what makes it useful to you
4️⃣ Follow @nikhil_mitt & @AlteredSecurity

A random winner will be announced on Monday, 8th September 2025.

🔗 https://t.co/jUUjo8gC5M

#EvasionWithAltSec #CETP #AlteredSecurity #RedTeam #Pentesting #InfoSec #CyberSecurity #Giveaway

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@5hady_ Bro chose violence 🤣

[ReconOne @ReconOne_bk]

Did you know? This website allows you to identify the technologies behind web applications based on 404 errors

👇🔗

#BugBounty #enumeration #recon #recontips #pentest

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@5hady_ @GoogleVRP Paylaod?

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@deadvolvo @Akamai Congratulations🥳

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@bugoverfl0w @Hacker0x01

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@GodfatherOrwa @StandoffBB @bsidesahmedabad 🤣🤣

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@5hady_ @intigriti Payload?

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

Did a grey-box pentest on a web app — all the right controls in place: no IDOR, solid access control, JWT + proper session management.
Funny part? Deleted a user from admin, but that user could still able to login and do everything 🤣Never thought this test case would work!

[Sergey Toshin @_bagipro]

New Android host validation bypass technique!

[1/4] All parsed URIs in Android are https://t.co/x8giXOfU0w.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@Gomawyy Bro 🤣🤣🤣

[𝙍𝙖𝙢𝙆𝙧𝙞𝙨𝙝𝙣𝙖 𝙎𝙖𝙬𝙖𝙣𝙩 @GHOST_OPERATOR_]

@deadvolvo Need blog on this