dog

Life is the childhood of our immortality.

[cr3ghost @cr3ghost]

Adding to this list. All free. No paywall. No signup.

https://t.co/x516DQRcB8 - 700+ pages of malware analysis and exploit research

https://t.co/cgxRDKvx2g - full university malware analysis course

https://t.co/7uSbDhTq6s - RE101, RE102, macOS RE, PE injection

https://t.co/mRHslgjr4f - ARM assembly, shellcode, heap exploitation

https://t.co/SLm7Vlyd93 - applied RE series and hypervisor development

https://t.co/3SLFBf6xSp - buffer overflows to kernel exploitation

https://t.co/gDWRH5YpIx - 30+ courses, WinDbg, IDA, Ghidra, UEFI, kernel exploitation

https://t.co/rA4x1Hv2iE - 41 tutorials spanning 17 years of exploit dev

https://t.co/DIqWzR1Xp3 - 19-part series, usermode to kernel

https://t.co/BJpRHdbTHu - Windows internals, secure kernel, VBS, KDP, dynamic analysis

YouTube:
https://t.co/KLUDZ9us2g
https://t.co/yxJUVqTzvK
https://t.co/IvelLJIQhH
https://t.co/C8aErWJ5RJ
https://t.co/NDG3swCvB1

Thousands of dollars worth of knowledge. All free.

#ReverseEngineering #MalwareAnalysis #InfoSec

[七言 @0xQiYan]

兄弟们，有人喜欢琢磨网络安全的吗？俄罗斯网安团队 VXControl 开源了个狠货——PentAGI，全自动渗透测试AI。

🔗https://t.co/851J4CvoXi

丢个网址进去，它自己扫描、挖洞、写报告，全程不用人管。背后是 13个AI智能体 协同，调用 20多款黑客工具（nmap、sqlmap、metasploit……），越用越聪明。

团队跟俄罗斯网安巨头 Positive Technologies 有关联，实力在线。GitHub上已 8200多星。

想玩���以，但跑之前先掂量掂量——别把自己的机器给端了。

[Sam (caffeine) @caffeinedoom]

@intigriti https://t.co/F4DKfdqcts has over 3 million URLs with tons of vulnerability signals with cool parameters to test from multiple bb programs btw :)

[Intigriti @intigriti]

It is no secret that hidden parameters can lead to all sorts of vulnerabilities, such as SQLi, XSS & SSTI! 😎

But you have to find them first... 😓

In our comprehensive guide, we've uncovered the top 5 common ways to uncover unreferenced parameters in your target, including a list of common tooling to help you automate these 5 methods.

Check it out! 👇
https://t.co/areeGv7UYS

[Md Ismail Šojal 🕷️ @0x0SojalSec]

This is the exact loop that’s going to separate serious bug bounty agents from the rest.

Static LLM knowledge is the biggest bottleneck in real pentesting right now.

This demo shows it clearly:

- Cloudflare WAF eating every manual payload
- Agent pulls fresh corpus on previous bypasses via Preview RAG
- Generates & iteratively tests variants
- Lands a working XSS

The method to any single payload (because public payloads die fast).

One clean integration that works with any model, Even small ones suddenly have deep, up-to-date WAF evasion context.

Huge for anyone building autonomous pentesting agents.

[dog @Hadra_]

@0x0SojalSec what program do you use in video? burp?

[Het Mehta @hetmehtaa]

two XSS vulnerabilities.
individually, each was practically useless.

together, they stole your session, hijacked your OAuth token, and silently turned on your webcam.

here's the chain.

Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact."

but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account.

the trick: "OAuth dirty dancing."

when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker.

the attacker now has a valid auth code. they exchange it. full session.

Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see.

also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up.

two "useless" XSS bugs. one $15,000 bounty. three attack chains.

Blog: https://t.co/w2m7rvvzhS

[the_OSINT_rack @the_OSINT_rack]

RedMorph

Free & open-source tool for website data gathering. Analyze websites by entering a URL & initiating a scan.

https://t.co/RTLGINAkJi

All tools available at https://t.co/7YGpU9Rxsn

#OSINT #WEB #RECON

[dog @Hadra_]

@eurich_darius @KatanaGenos sir qui https://t.co/4CunN4Frdc

[The Hacker's Choice (@[email protected]) @hackerschoice]

7,000+ hackers are using @extencil anonymous email forward. 🥳

Most used domain:

<YOUR NAME>@reads[dot]https://t.co/ISPMXpj8p1

We donated https://t.co/8LzYxy0VVq and https://t.co/gICepoLttD ❤️

Thanks #community to make this fun 🤙

[Md Ismail Šojal 🕷️ @0x0SojalSec]

AI/ML Pentesting Roadmap (2026 Edition) takes you from zero to practitioner foundations, OWASP LLM Top 10

- LLM fundamentals to Advanced prompt injection, jailbreaks & agentic AI attacks & indirect injection
- MCP exploitation & Agentic AI security (the new frontier) RAG exploitation
- Real tools, CTFs, papers & bug bounty programs

Updated with latest OWASP, MITRE ATLAS, real-world research & offensive tools.

Ideal for bug bounty hunters, pentesters and cybersecurity pros

[0xrudra @0xrudrapratap]

The best hackers I know aren't smarter than me.

They've just read more than me. Somewhere in their memory is the one obscure writeup that turns a dead end into a finding. Preview is that memory, on tap. For you, and for your agent.

-> https://t.co/JQKjIQGWFA

[dog @Hadra_]

Ricordi il tuo primo giorno su X? Io sì! #IlMioAnniversarioDiX

[Anastasis Vasileiadis @Anastasis_King]

🚀 Kali GPT: The AI Assistant That’s Revolutionizing Pentesting on Kali Linux 🤖🐉

🔍 What is Kali GPT?
Kali GPT is a specialized AI model built on GPT-4 and designed to work seamlessly with Kali Linux. It’s transforming the way ethical hackers, students, and security teams approach offensive security 🛡💡.

Cybersecurity is not just a necessity — it's an art. Kali GPT is the smart assistant every digital artist needs. 🎨

🎯 Who is it for?

✅ Pentesters – Instantly generate payloads, explain tools like Metasploit/Nmap, and recommend exploits
✅ Beginners – Understand complex topics in simple terms, like having a digital mentor 🧑‍🏫
✅ Companies – Automate scans and discover vulnerabilities efficiently in internal networks 🏢📡

⚡️ What Can You Do With It?

💼 Professionals – Get advanced pentest guidance without endless manual lookups
🎓 Educators & Students – Teach and learn ethical hacking with real-time examples
🏢 Enterprises – Protect infrastructure through intelligent automation and faster analysis

✨ Why It Stands Out

⚡️ Real-time responses to terminal-based queries
🛠 Adapts to your experience level (basic ➡️ advanced)
⏱️ Saves hours of Googling and reading manuals
🌐 Makes offensive security more accessible and inclusive

Kali GPT isn’t just a tool — it’s your technical sidekick.

⚠️ Know the Limitations

❌ Doesn’t run commands — only suggests
⚠️ Outputs require human verification
📚 Not a replacement for real cybersecurity expertise

🚀 Ready to explore it?
Get started: https://t.co/bjvPhvfNJS

🧠 Empower your pentesting with AI — and master Kali like never before.

⚠️ Disclaimer: This content is provided for educational and awareness purposes only. Kali GPT is a research assistant and should not be used for unauthorized testing or activity.

#KaliLinux #KaliGPT #CyberSecurity #EthicalHacking #Pentesting #OffensiveSecurity #AIinCybersecurity #LinuxTools #InfoSec #EducationOnly #RedTeamTools

[Kali Linux @kalilinux]

Kali Linux 2026.2 Release (GNOME 50, KDE 6.6, Helper Scripts, APT Formats & VM Boot Tweaking): It’s the final week of Q2, and Kali Linux 2026.2 is here - right on schedule ;) We have been heads down since our last release, and we are ready to share what… https://t.co/kv4knEBCQs

[Arcane Ai @Arcane_Aii]

🚨 SOMEONE JUST BUILT TORLINK — A SLEEK TERMINAL-NATIVE TORRENT CLIENT THAT SEARCHES EVERY TRUSTED SOURCE AT ONCE AND DOWNLOADS STRAIGHT TO YOUR DISK.

Tired of sketchy torrent sites packed with fake buttons, popups, and dead links? torlink fixes that.

Type a query (or paste a magnet), and it hits a curated list of trusted sources in parallel — FitGirl (games), YTS, 1337x, EZTV, Nyaa, SubsPlease & more. Results stream in live with sizes and seed counts. Arrow + d to download.

Highlights:

• One command: npx torlnk (just needs Node)

• Background queuing + resume support

• Auto-seeds by default (easy toggle)

• Clean keyboard TUI — nothing leaves your machine except torrent traffic

Perfect for grabbing games, movies, TV, or anime without the usual headache. MIT open source, zero setup, and stupidly simple.

This is the terminal tool power users have been waiting for.

Who’s trying this on their next download? 🔥

[Dark Web Informer @DarkWebInformer]

‼️ CVE-2026-48907: Joomla! JCE extension 2.9.99.5 - unauthenticated Remote Code Execution

Video Credit: @0xgh057r3c0n

[Brute @BRuteLogic]

OAuth Bypass Testbed

https://t.co/8WHf78YqCz

Test your skills against a LOGIN (randomly vulnerable) and/or 17 AUTHENTICATION SERVER endpoints.

Like with JWT, a fully automated OAuth tool with complete FFF (Find, Forge, Fire) PoCs is on the way, exclusively for Brute One.

[Muqsit 𝕏 @mqst_]

🎰 Google Dorking for Penetration Testers — A Practical Tutorial

Blog: https://t.co/DOR6vRpj6B

#infosec

[Wolfahontas 🇮🇱 @Wolfahontas]

Hamas beating, torturing and executing Palestinians

Would you ever see a Pro-Palestine account show this to the world? Why not ?