z™️

[z™️ @hpncz2]

เป็นกุจะยอมรับดิ้ ละก็ไปตามที่ใจตัวเองเลือก

[Roan @RohOnChain]

this is the most DANGEROUS thing on internet today

REA (Reverse Engineer Anything) - this open source MCP lets your AI agent reverse engineer any app, down to the binary

i just reverse engineered TradingView, now I am using their premium indicators for FREE - software is cooked

here is how to use REA to reverse engineer TradingView:

1. point REA at TradingView's publicly observable interface and map every major feature, from chart interactions to indicators and alerts

2. trace how the interface behaves when you switch symbols, change timeframes, add indicators, draw levels, and update chart layouts

3. use REA's available MCP tools to investigate authorized software artifacts and trace application logic wherever the evidence allows

4. feed those findings into Claude Opus 5.5, which turns the investigation into a technical specification and an implementation plan

5. rebuild the charting engine independently, with real market data, candlesticks, technical indicators, drawing tools, and persistent watchlists

6. add a quant backtesting engine that tests strategies against historical data, accounting for fees, slippage, and drawdowns

7. test every component, compare its behavior against documented and observable results, fix failures, and keep iterating until the system actually works

8. you end up building your own TradingView-style quant research terminal from scratch, with source code you control and features you can keep extending

i won’t say anything more:

[GitHubDaily @GitHub_Daily]

App 改完一个功能，最后还得自己拿起手机，登录、填表、翻页一遍遍点，看哪里点不动、哪里闪退。

mobile-mcp 把手机交给了 AI Agent，iOS 和 Android 都支持，模拟器和 USB 连着的真机都能操作。

点击、滑动、长按、输入文字、装卸 App、按 Home 键、录屏这些动作都能做，说清楚要测哪个流程，它就自己在手机上跑一遍。

GitHub：https://t.co/XllpZIX9Xx

它优先读界面上的真实元素来找按钮，用不着视觉模型去看截图，速度快也更便宜，实在读不到才退回截图加坐标。

还能直接拉手机日志和崩溃报告，App 闪退了让 Agent 自己去翻原因，这一步我觉得比点点点还省���。

Claude Code、Codex、Cursor 等支持 MCP 的工具都能用，做移动端开发和测试的可以装上试试。

[brenz. @brenzhills]

joder, GitHub está lleno de cosas gratis que casi nadie está usando.

los 10 repos que están explotando este mes, de lo más fácil a lo más técnico:

lo que puede usar cualquiera

1. VoiceStudio: clona voces, dobla vídeos y transcribe en 646 idiomas, gratis y sin salir de tu ordenador (57K ⭐)
https://t.co/ZgWcckVNHD

2. ppt-master: le pasas un PDF o un Word y te devuelve un PowerPoint de verdad, editable y con animaciones (59K ⭐)
https://t.co/N1gnM1saSE

3. gods-eye-view de @bilawalsidhu: un simulador de satélite espía en tu navegador, con aviones, barcos y cámaras reales sobre un globo 3D (50K ⭐)
https://t.co/cNOweoMnjj

4. REA: le enseñas a tu IA una función de otra app y te explica cómo está hecha, sin tener el código (65K ⭐)
https://t.co/yUzlXS7eXQ

5. diagram-design de @cathrynlavery: pides un diagrama con palabras y te lo dibuja con tu marca, 44 tipos (49K ⭐)
https://t.co/IlIZvE8b1c

6. paperclip: como tener tu propia empresa de agentes autónomos trabajando para ti, la app open source para dirigirlos como si fueran tu plantilla (99K ⭐)
https://t.co/EAVcjNA8Fv

para que Claude Code trabaje mejor

7. skills de @mattpocockuk: las que usa a diario un ingeniero de verdad, pequeñas y fáciles de adaptar (284K ⭐)
https://t.co/9C9RyocWAs

8. ECC: skills, memoria y seguridad en un pack para Claude Code, Codex, Cursor y OpenCode (276K ⭐)
https://t.co/soGXE06aI6

9. andrej-karpathy-skills: un solo archivo con 4 reglas sacadas de lo que Karpathy dice que hacen mal los modelos programando (218K ⭐)
https://t.co/dfWkQ48rcM

10. claude-mem: guarda lo que hizo tu agente, lo resume y se lo pasa a la siguiente sesión, para que no empiece de cero (99K ⭐)
https://t.co/6UYMI9UjUL

compártelo si te ha parecido interesante ♻️

y guárdalo antes de perderlo 🔖

[مالك بن حمود المالك @cnemalek]

الرابط

https://t.co/I9U4Ry2ORU

[Muqsit 𝕏 @mqst_]

🎓 Breaking into Google's GFile for $100k

Writeup: https://t.co/iyPeluRnQt

Author: Arvin Shivram

[Christian B. @kimocoder]

Yesterday I was tired of the constant probing of those CIDR scanning bots so I setup a trap for the next one 😅 now I own a sourcecode to one of them; this is a Russian hosted server with a Norwegian IP.

It hooks on most AI services out there and has a interesting payload 👍

[Abdulkadir | Cybersecurity @cyber_razz]

Let me help you out

[Disclaimer: for educational purposes only]

[Ridgeline Cyber @RidgelineCyber]

MFA Passed. The Session Was Still Hijacked.

Conditional Access policies that require only traditional MFA do not reliably prevent Adversary-in-the-Middle (AiTM) phishing or session hijacking.

Microsoft Authenticator push notifications, SMS and OTP-based MFA remain vulnerable to real-time phishing proxies. These methods verify that an authentication challenge was completed, but they do not cryptographically bind the authentication to the legitimate website.

Attackers exploit this weakness using AiTM phishing frameworks such as Evilginx.

How the attack works

The victim visits a phishing site. The attacker-controlled reverse proxy relays authentication traffic between the victim and the legitimate Microsoft Entra ID sign-in service.

The victim authenticates; they enter their credentials and complete a genuine MFA challenge, such as an Authenticator push notification or OTP.

Entra ID authenticates the session. If the authentication satisfies applicable Conditional Access requirements, Entra ID establishes an authenticated session. The reverse proxy may intercept authentication cookies, including ESTSAUTH or ESTSAUTHPERSISTENT, and other relevant session artifacts.

The attacker attempts session replay. Depending on the captured artifacts, target application and applicable session protections, the attacker may reuse the authenticated session to access Microsoft 365 resources without completing MFA again.

The critical distinction: MFA was not necessarily defeated. The attacker exploited an authenticated session after MFA had succeeded.

What actually reduces the risk?

1. Phishing-resistant MFA
Require phishing-resistant authentication methods through Conditional Access authentication strengths.

FIDO2 security keys, appropriately configured passkeys and Windows Hello for Business use cryptographic mechanisms that bind authentication to the legitimate service.

This prevents the conventional reverse-proxy AiTM flow from successfully relaying phishing-resistant authentication.

However, phishing-resistant MFA alone does not prevent every form of session theft, particularly when an endpoint or existing authenticated session is compromised.

2. Device-based Conditional Access
Requiring Microsoft Entra hybrid-joined or Intune-compliant devices can substantially reduce access from unmanaged endpoints.

However, device compliance does not automatically bind every browser session cookie to the originating device.

An attacker may still attempt to replay stolen session artifacts where the application accepts them without a fresh device-compliance evaluation.

Device requirements are an important preventive layer, not a universal session-replay defence.

3. Microsoft Entra Token Protection
Token Protection uses cryptographic device binding to help prevent stolen sign-in session tokens from being replayed on another device.

Its effectiveness depends on supported platforms, applications, clients and resources.

Coverage for browser-based sessions remains more limited than for supported native applications. Token Protection should therefore not be treated as universal protection against browser-based AiTM attacks.

4. Continuous Access Evaluation (CAE)
CAE enables supported resources to respond to critical identity and access changes without waiting for normal token expiry.

Relevant events include account disablement, supported credential changes, session revocation and certain location-policy changes.

CAE can reduce the usable lifetime of compromised access, but it does not prevent initial session theft, and enforcement depends on resource and client capabilities.

5. Risk-based Conditional Access
Microsoft Entra ID Protection can identify suspicious authentication activity and session-related risks.

Conditional Access can use available user-risk and sign-in-risk signals to block access or require appropriate remediation.

These controls improve detection and response, but their effectiveness depends on the available signals, licensing and policy configuration.

Detection: Hunt the session, not just the sign-in

Successful session hijacking may not generate another interactive authentication event.

An attacker replaying an existing application session cookie may access resources without producing a new, easily correlated event in Entra ID SigninLogs.

Therefore, hunting exclusively for failed logins, repeated MFA challenges or unusual interactive sign-ins is insufficient.

Investigate across multiple telemetry sources:
Entra ID SigninLogs: Suspicious authentication context, unfamiliar IP addresses, device characteristics and sign-in patterns.
AADNonInteractiveUserSignInLogs: Unexpected token-related sign-in activity and changes in authentication context.
Entra ID Protection: Attacker in the Middle, Anomalous Token and other relevant risk detections.
Microsoft Defender for Cloud Apps: Suspicious cloud sessions, unusual access patterns and anomalous application activity.
Microsoft 365 audit logs: Unusual mailbox access, inbox-rule modifications, suspicious file downloads and other post-authentication activity.

Where telemetry supports it, correlate session identifiers, user identity, application, device context, IP address, ASN, geographic location and activity timestamps.

A sudden change in session context is an investigation lead, not automatic proof of compromise. Legitimate VPN use, mobile networks and device roaming can produce similar indicators.

The takeaway

Passing MFA does not guarantee that the resulting session remains under the legitimate user's control.

Effective defence against AiTM phishing and session hijacking requires layered protection:
Phishing-resistant authentication
Device-based access requirements
Device-bound token protection where supported
Risk-based Conditional Access
Continuous Access Evaluation
Cross-platform session and post-authentication monitoring

Authentication establishes identity at a point in time. Security teams must also protect and monitor what happens after authentication succeeds.

Is your Conditional Access strategy focused primarily on enforcing MFA, or does it also address session theft and token replay?

For investigations where SessionId is populated, the following query provides focused hunting for user-and-time correlation:

Check the comment section for the raw KQL

[Co11ateral @co11ateral]

Extracting Credentials with DeadMatter

Dumping memory and extracting NTLM and other credentials from the dump locally

https://t.co/K4wbE6tIXn

@three_cube @_aircorridor

[Andrew @andrew1x_]

klip 2.0.1 is live — a lightweight windows clipping app powered by OBS’s capture engine.

fixed short replays cutting off before 30 seconds + improved frame pacing.

18.3mb installer. public beta.
already using klip? redownload to update.
test it on your pc ↓

https://t.co/EwJAGEEG1F

[Osirisai.live @soulsimplifai]

You can now prompt AI to scan the Whole City CCTV Feed 🤯🤯🤯

Model choice determines your speed:

📹 Clip 1: High-speed inference (GPT-5-Mini)

📹 Clip 2: Heavy reasoning (GPT-6-Sol)

100% Free & Keyless Streaming — just plug in your own API key when you're ready to run automated vision analysis.

Available on GitHub. Soon on the live site.

Terminal: https://t.co/CAFiwvtYN0

Repo: https://t.co/vsj2tAlfpl

CA: solana:2nZNHm3Lr9umG3DVrzYwHgktwkuKuJRXqqRqs3ewpump

[T4T5 @t4t5]

we can fix everything

[Co11ateral @co11ateral]

Abusing Printers to Compromise Active Directory

Office printers can be abused to capture LDAP credentials and help you compromise the domain.

https://t.co/wkUNyFda5k

@three_cube @_aircorridor

[blindma1den @blindma1den]

Estaba muy bloqueada en un pentest a un entorno Active Directory de 478 usuarios y 5 DC’s todo montado en Azure. Te comparto las 2 herramientas que me han salvado 🙏

1. Group3r: https://t.co/WuFA1eVJB8
2. LaZagne: https://t.co/uYtbQTpsag

[보안재테크 @ngnicky]

ThreatBook이 오픈 소스 AI 침투 테스트 플랫폼인 CyberStrikeAI를 인수

가장 널리 사용되는 AI 침투 테스트 도구 중 하나
이제 AI 침투 진단 시대로~~
https://t.co/k7fJ7ZLR6W

[CyberSudo @Cyber_Sudo]

👁️ How I Track Instagram Posts for Event Monitoring

Most people know how to search Instagram by hashtag.

The problem is Instagram removed the old "recent posts" hashtag feed.

Now hashtags mostly surface popular posts, which doesn't help much when you need to see what was posted minutes ago.

That matters when you're looking into something time-sensitive:
- Protest
- Disaster
- Demonstration
or anything unfolding in a specific place.

When I need to monitor a location instead of a hashtag, I use a free tool from Bellingcat called Instagram Location Search.

The process is simple:
1. Get the coordinates of a location from Google Maps.
2. Enter those coordinates into the tool, along with your Instagram session cookies.
3. Use a separate OSINT account for this, not your personal one.

The tool then creates an interactive map of the area.

Click any point on the map, and it shows recent public Instagram posts made from that spot.

🔗 Tool: https://t.co/n5mGKsNiGZ

P.S. ♻️ Repost if you found this useful.

[The Hacker @theprocracker]

Strace 👀 Inspect System Calls, Investigate File Access and Analyze Program behavior in Kali Linux

[Cyber Security News @The_Cyber_News]

🚨 Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access

Source: https://t.co/TpB3mJekdT

Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access.

@ReliaQuestTR reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services.

The activity presents a serious detection challenge because attackers connect through an organization’s own VPN.

Their traffic can look like normal remote work, giving them time to steal credentials, move between systems, collect sensitive data, or prepare ransomware before security teams recognize the intrusion.

#cybersecuritynews

[7h3h4ckv157 @7h3h4ckv157]

YesWeHack Claude Kit

A Claude Code plugin that helps bug bounty hunters write clear, well-evidenced reports - the kind a triager can validate quickly.

Source: https://t.co/z26WHC19Aw