Narna

Strongly encrypting the world. I'm a Security Researcher, :) BB HUNTER on @Bugcrowd @Hacker0x01. The secrete behind the side of your screen ;)

[Abhishek @aacle_]

JWT testing gets tedious fast.

Decode → edit → re-sign → repeat.

Hakluke’s ( @hakluke ) toolkit makes it much faster.

Paste a token and you can quickly test:

- alg:none + case variants
- Algorithm confusion
- kid injection
- Weak JWT secrets
- Claim injection
- Tampered tokens without re-signing

The last one is my favorite.

Disable auto re-sign → modify the token → send it.

If the server accepts the tampered JWT without verifying the signature, you’ve got a finding.

https://t.co/yRB7x5qr3T

[Nitin Gavhane @NitinGavhane_]

Bug Bounty Methodology with OpenCode CLI

1/10
Turn your terminal into an AI-powered bug bounty machine.

Recon → Hunt → Validate → Report — all inside OpenCode.

No more context-switching. Just pure hunting flow.

#BugBounty #OpenCode #CyberSecurity #WebAppSec

[Narna @HackerNarna]

@ChessLordK Ronaldo De Lima

[Narna @HackerNarna]

@LegacySiu Cannavaro

[Vishal Vishwakarma @rootxvishal]

Day 4 / 30 — PARAMETER DISCOVERY ARSENAL

Hidden params = hidden bugs. Skip this step and you skip half the attack surface.

Tools:
→ ParamSpider— https://t.co/qnj84RJdjd
→ Arjun (@s0md3v) — https://t.co/R6VNh302tP
→ x8 — https://t.co/9zH4ZJZvtx
→ Param Miner — Burp BApp store
→ gf(@TomNomNom) — https://t.co/WEwrN2sESw

gf patterns repo: https://t.co/FVtDUemt9s

#bugbountytips #recon #paramspider #infosec #cybersecurity

[Faiyaz Ahmad @thehacktivator]

Recently came across a pretty interesting XSS payload that managed to slip past some generic WAF rules and basic mitigations.

Could be useful in situations where you already have HTML injection on the target and traditional payloads keep getting blocked.

Payload: <svg><animate onbegin="alert(1)" attributeName=x></svg>

If you want to learn more on cyber security, bug bounty and penetration testing then feel free to check out my youtube channel where i have uploaded 180+ videos on various topics like xss, sql injections, unique/underrated vulns, chaining bugs together etc...all practical!

Link: https://t.co/gavWFZXUqx

[obscaries ❘ AppSec @obscaries]

🔥 Great read on breaking 2FA the real way (logic flaws, not brute force myths)

Covers practical bypass techniques like:
• Flow manipulation
• OTP leakage
• Weak rate limiting
• Session handling issues

If you're into bug bounty / web security, this is gold 👇

🔗https://t.co/J9eQjFLfVz

#BugBounty #WebSecurity #AppSec #CyberSecurity #Infosec

[obscaries ❘ AppSec @obscaries]

Just came across this insanely clean browser-based pentest cheatsheet 👀

Source: https://t.co/YNOvOjulMW

580+ pentesting commands organized for recon, privesc, AD, web testing, pivoting & more, all inside a fast terminal-style UI.

No setup. No clutter. Just practical workflows ⚡

Perfect for OSCP/OSEP prep, labs, CTFs, and real-world engagements.

#cybersecurity #bugbounty #pentesting #redteam #oscp

[Vishal Vishwakarma @rootxvishal]

Bug Bounty Tip 🎯 - WordPress /wp-json/wp/v2/users/ Still Works in 2026

WordPress user enumeration via REST API is old. It still works everywhere.

curl https://t.co/G8IQSQ8Zwm

Got: name, slug (= login username), user ID, profile URL

Then the chain: Username known → /wp-login.php?action=lostpassword → host header injection in reset email → ATO

Add it to your checklist. It takes 2 seconds and the slug is usually the WP login.

#bugbountytips #cybersecurity #wordpress #recon

[Vishal Vishwakarma @rootxvishal]

Day 5 / 30 — JAVASCRIPT FILE ANALYSIS

JS files leak endpoints, API keys, internal infra. Read them. Don't just scan.

Tools:
→ subjs — https://t.co/zPExrFNVPQ
→getJS — https://t.co/GkthKpZznx
→ LinkFinder — https://t.co/BxOXVfgh8l
→ JSluice — https://t.co/Pz235uFkaI
→ SecretFinder — https://t.co/hEI40yUaNm
→ trufflehog — https://t.co/QcB8XmPw8Z

Read the comments. Devs leave goldmines.

#bugbountytips #javascript #bugbounty #infosec #cybersecurity

[Joruno @wsl8297]

做渗透测试，最耗时间的从来不是“找不到漏洞”，而是扫描器误报满屏，你还得一条条手动复核，真正的高危点反而被噪音淹没。

最近看到一个开源安全扫描器 Lonkero，主打“把误报压下去”。它用贝叶斯假设引擎 + 智能过滤，把误报率做到约 5%，比行业常见水平低出一截，结果更干净，验证更省事。

Lonkero 基于 Rust 构建，内置 125+ 专业扫描器，覆盖注入、认证、API 安全、现代框架等场景；还能��动识别技术栈并动态调整测试策略，不用你反复手动配置。

GitHub：https://t.co/7tQ6QI7rR6

它还带机器学习引擎：每次扫描后都会学习响应模式，越跑越准；同时支持联邦学习，只共享模型权重、不上传原始数据，让社区一起把模型越训越好。

如果你想要一个低误报、高效率、适配主流技术栈的渗透测试工具，或者已经受够了传统扫描器的“误报海”，Lonkero 值得试一试。

[Brute @BRuteLogic]

PHP Null Byte on Parameter Trick
Use to fool WAFs that decode before parsing.

It might consider the anchor with dangling (but harmless) markup instead of the real vector.

param%00p%3D&lt;A/Href="&lt;Svg/OnLoad=alert(1)//

More on https://t.co/7OQf9q3gJ3

PoC https://t.co/FXIFrgjemu

[Vishal Vishwakarma @rootxvishal]

🎯 Bug Bounty Tip:

Hunting on targets running Jira, Confluence, Bitbucket, Jenkins, Solr, or Nexus?

Bookmark this PoC goldmine 👇

https://t.co/KTFYFlYzYg

CVEs + payloads ready to test. Save hours of recon.

#bugbounty #infosec #cybersecurity #bugbountytips

[Hacking Team @HackingTeam77]

🧠 AI-Powered Red Team — 28 Specialized Agents for Offensive Security 🤖🔥

Turn Claude into a full pentesting team.

• 28 agents (Recon, AD, Web, Cloud, Mobile)
• Auto task routing → correct agent
• Real tools support (nmap, sqlmap, nuclei, BloodHound)
• Recon → Exploit → Report

Link: https://t.co/O7OBGldz9q

#AI #RedTeam #Pentesting #CyberSecurity #Infosec

[Hacking Articles @hackinarticles]

Mobile Application Penetration Testing Cheat Sheet

https://t.co/ZfZ2eM0eo6

#infosec #cybersecurity #pentesting #oscp #informationsecurity #hacking #cissp #redteam #CyberSec #mobile #Android #ios

[Mobile Hacker @androidmalware2]

iOS Pentesting Series

Learn how to work with useful tools and apps such as Frida, Objection, 3uTools, Cydia, Burp, fsmon, fridump, SSL bypass, reFlutter etc.

Part 1: https://t.co/nSPl5yZa18
Part 2: https://t.co/t6UFBy1wm9
Part 3: https://t.co/zud0PguDCS via @KishorSec

[Harshleen @0xharshleen]

👉Practice and get certified in Mobile application pentesting

🌟Frida Labs by DERE-ad200 Thank you Joas A Santos for this gem!
https://t.co/QYgdOkXC2s

🌟Damn Vulnerable iOS App
https://t.co/0ssOhrDsvl

🌟Oversecured Vulnerable IOS App by oversecured
https://t.co/wlVKCkebzW

[7h3h4ckv157 @7h3h4ckv157]

MOBEXLER 📍

A Mobile Application Penetration Testing Platform
https://t.co/EPVPAidao7

NB: Content Sharing != Content Stealing

#Hacking #infosecurity #infosec #Pentesting #redteam #pwn #CyberSecurity #CTF #CyberSecurity #ArtificialIntelligence #CyberSecurityAwareness

[DarkShadow @darkshadow2bd]

WHAT THE HACK HAPPENS IN THIS YEAR!

cPanel &amp; WHM - Auth bypass (CVE-2026-41940)

here is the exploit POC: https://t.co/uLFJ5XqTc0

Join my bugbounty telegram chennal: https://t.co/J6uPf8H57o

#bugbounty #cpanel #cve