HackerContent

We create content and manage socials for your cybersecurity organization. 🚀

Sound good? 👉 by @hakluke

[HackerContent @hacker_content]

How to break into WordPress installations and how 2FA can prevent it!

All is discussed in this @WPSecScanner blog by @hakluke! 🚀

👇

https://t.co/ki2Zm52Qg3

[Gareth Heyes \u2028 @garethheyes]

Help your 'self' to some credentials.

Content-Security-Policy: default-src 'none'; form-action 'self';

Learn how to bypass this CSP and exfiltrate credentials using a Burp AT skill. Link to blog post 👇

[HackerContent @hacker_content]

Cross site request forgery (CSRF) for Hackers and DevSecOps 🚀

In this @snyksec Learn module you'll learn:
✅ How to Craft a CSRF attack
✅ Why it works
✅ How to mitigate against CSRF

👇

https://t.co/fSD8ph5OEl

[Mykyta Pavlenko @mktpavlenko]

@hakluke Hand-prompted, small batch. The way grandma used to make them.

[HackerContent @hacker_content]

10 types of web vulnerabilities that are often missed

🐞 HTTP/2 Smuggling
🐛 XXE via Office Open XML Parsers
🐜 SSRF via XSS in PDF Generators
🕷 XSS via SVG Files
🦟 Blind XSS

What else? 👇

https://t.co/c2AIi8ev8Q

[STÖK ✌️ @stokfredrik]

We need fixbots
not more hackbots

[Luke Stephens (hakluke) @hakluke]

I'm a bit disappointed that nobody has commented on the new https://t.co/edCi1n1cbW design yet.

I used my bare hands and raw organic intellect to ask Claude to redesign it all by myself.

[bugcrowd @Bugcrowd]

API Tip 💡

Thank you, @InsiderPhD 🙌

[Web Security Academy @WebSecAcademy]

In Burp Repeater, try changing the file’s Content-Type to image/jpeg.

If a previously blocked upload is now accepted, the server may be trusting the multipart header instead of checking the file itself.

That header is supplied by the client. Validation also needs to consider the filename, extension, actual contents, storage location, and whether the server can execute the uploaded file.

Try it in the file upload labs 👇
https://t.co/4DRoefS1M5

[HackerContent @hacker_content]

Here's an old blog we wrote for Project Discovery. What a great read.

Hacking an ASM platform with @pry0cc using @pdiscoveryio tools.

1️⃣ The scanner
2️⃣ The Importer
3️⃣ The Queue
4️⃣ The Worker
5️⃣ The Scheduler
6️⃣ The API
7️⃣ The Results

https://t.co/TPgM8aVNme

[HackerContent @hacker_content]

JavaScript Malicious Code Injection ☠️💉💻

This @snyksec Learn module covers:
💉 How code injection works
💉 How to protect against it
💉 How to exploit the vulnerability
💉 How to analyze the vulnerable code
💉 Remediation and prevention options

https://t.co/9vba4oqDNm

[Luke Stephens (hakluke) @hakluke]

There has never been a more important time to learn cybersecurity.

[NetworkChuck @NetworkChuck]

At 40, you may be behind on energy. But you've got something they don't: 15+ years of experience, the discipline to grind through the boring parts, and the courage to start over in a new field. That's your superpower.

[André Baptista @0xacb]

Just reproduced sshole (CVE-2026-123158), beautifully simple bug by @kultekin

Needs password auth on and no PAM, but you can ssh as root into an unpatched Alpine box with any 257+ byte password.

musl crypt() returns "*" for any password over 256 bytes. a locked account's shadow field is also "*". sshd compares them and they match.

fix: openssh 10.6p2

[bugcrowd @Bugcrowd]

403 bypass tricks that (may) still work in 2026 😏

🧵👇

[Luke Stephens (hakluke) @hakluke]

What’s your cybersecurity take that has you feeling like this?

[HackingHub @hackinghub_io]

Here’s how you verify an SSRF finding: 👇

[Web Security Academy @WebSecAcademy]

How to manually check for CL.TE Request Smuggling Vulnerabilities:

1️⃣ See if a GET request accepts POST
2️⃣ See if it accepts HTTP/1
3️⃣ Disable "Update Content-Length"
4️⃣ Send with CL & TE headers:
POST / HTTP/1.1
Host: <HOST-URL>
Content-Length: 6
Transfer-Encoding: chunked

0

G

5️⃣ Send request twice.

If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability!

Try this out for yourself in our CL.TE lab: https://t.co/NvIsGL9cL1

[HackerContent @hacker_content]

Why did you stop writing your blog?

[HackerContent @hacker_content]

When this blog was released, it went crazy on socials. Most of the advice is still right on point 👌, the difference is that today you can just pass the information to your AI hackbot!

How to Hack APIs with @Farah_Hawaa and @hakluke. This @detectify blog deep dives into the world of API hacking!

👇
https://t.co/zVP1u6repM