ghost

osint + crypto research. pentester. i break things for a living

[ghost @ghstwnn]

1/ MoneyPilot (run by Bloom Processing LLC) never checked if you actually paid before handing out a premium subscription. i found the hole, reported it the right way, and got stiffed for it. full story below 🧵

[ghost @ghstwnn]

@cantstopnyxia lemme up brochacho

[ghost @ghstwnn]

8/ holding back every value, hostname and internal id. not naming the operator either. point is the class of issue and the fix status, not the secrets.

[ghost @ghstwnn]

1/ a US casino app ships its entire production config from a CDN endpoint that asks for nothing. no login, no key, no referer check. anyone can pull it. found it poking around the app bundle. 🧵

[ghost @ghstwnn]

7/ separate related client side finding is cve tracked. that detail stays private until it wraps. this thread is only the config exposure.

[ghost @ghstwnn]

hey furryfag can you please keep it pushin your activity being laughed at by the WHOLE infosec/cybersec community for being a clout goblin/chaser so please get off @Ivanklydz’s dick bcz youve alr drained him dry no one wants you here 😭✌️

[Fox_threatintel @banthisguy9349]

Intelligence gain method:

Piss off threat actors in a twitter post.

They respond to you through dms and on the post which allows you to gain intelligence.

Can you imagine that you got rage baited by a person that has a fox as a profile picture.

[ghost @ghstwnn]

@urharmless @Natlulz @IntCyberDigest greggy why did you unfollow me and then ignore my dms 💔

[ghost @ghstwnn]

@Natlulz @urharmless @IntCyberDigest holy misinfo klydz aka pryx is far from indian 😭 @Ivanklydz

[ghost @ghstwnn]

@holypryx lowk best parody acc out there icl ur goated sonion 💔

[ghost @ghstwnn]

THIS FUCKASS AI JUST RICKROLLED ME WHILE FIXING MY SPOTIFY CLIENT WTFF 😭✌️

[portbuster @portbuster1337]

Released a new PoC exploit on GitHub for the latest GoBalance issue. Check it out:

gobalance-shred recovers a GoBalance service's master onion identity key
from its public .onion address plus one published v3 descriptor.

https://t.co/5ukNwu5tHa

[ghost @ghstwnn]

@lizardcircles @insidedarknet yo we get that ur a fan 😭😭✌️

[ghost @ghstwnn]

@lizardcircles @shinydreffus @hasanbroked https://t.co/qeZewG8VzK

[ghost @ghstwnn]

me dogging on @kuroi_dotsh also known as dengibitch for 2:06 ft. kernelstub and heathen

[ghost @ghstwnn]

@insidedarknet @KimDotcom @IntelOpsV3 @kernelstub UR DA GOATTT

[ghost @ghstwnn]

MEGAUPLOADDDDDDD @KimDotcom

https://t.co/K8S2ndOxNI

[ghost @ghstwnn]

@kernelstub @KimDotcom @IntelOpsV3 @insidedarknet fuck u never hate on the best filesharing platform in the world