Sid

CyberSec | Technical Writer Occasionally found lurking in the meme community. U_U

[Sid @illucist_]

Never been prouder of y'all and the grind you've put in through all the struggles. ;)

[Sid @illucist_]

What have you been up to these days?

[Sid @illucist_]

Things are starting to feel better. I think i will make it. ^^
Touchwood

[Sid @illucist_]

I am sure i will end this all with my own hands. I will.

[Sid @illucist_]

It's getting harder and harder for me. Unbearable.

[Sid @illucist_]

This life is just hard. I did everything possible and today, I stand at nothing.

[Sid @illucist_]

What the fuck is this gym pricing model?
Pay more if you want to try.
Pay less if you’re ready to make a completely irrational 1-year commitment while standing in slippers at reception.

[Sid @illucist_]

@zseano Surely gonna have fun in sometime with it. I interacted with a voice AI agent of a clothing brand in India and got their system prompt instantly.

[Sid @illucist_]

@InsiderPhD Are you really trying to avoid using hyphens or if those are em-dashes?

[Sid @illucist_]

One of the biggest mistakes in AI security is evaluating the model but ignoring the system around it.

The model is only one part.
The permissions, tools, memory, plugins, and data access matter just as much.

Exactly what's happening with Tryhackme's NoScope right now

[Sid @illucist_]

Oh trust me when I say this after comparing 3 largely used AI models for a security review of our applications:

The real challenge with AI in security is not capability.

> It is reliability, validation, and knowing when the model is confidently wrong. 👁️👁️

[Sid @illucist_]

Cybersecurity is one of the few fields where being paranoid is called professionalism. :D

[Sid @illucist_]

During Penetration tests, I have learned this the hard way:
- Try something
- Doesn’t work
- Try something dumber
- Works :/

The vuln is right there, and you’re out here doing PhD-level overthinking T_T

[Sid @illucist_]

Hope ya'll are smiling everyday 🩷

[Sid @illucist_]

Seasides Goa next week anyone?
Let’s exchange LinkedIns and unresolved anger towards devs. :p

[Enciphers @EnciphersLabs]

Ever wondered how attackers move beyond initial access and take control of an entire enterprise network? Now’s your chance to experience it firsthand.

Join @aman_notsogreat and @illucist_ from @EnciphersLabs on 21 February 2026, 9 AM, at @seasides_conf Goa for a live, hands-on Red Teaming workshop built around a realistic enterprise environment ZenithCorp.

Operate inside a simulated corporate network and practice real-world attack paths, lateral movement, and privilege escalation, just as they unfold in real breaches.

Training environment powered by @vantag3point .

🔍 Real-world Attack Paths | Lateral Movement | Adversary Mindset
🔓 Attack. Learn. Defend.

🔗 Workshop details: https://t.co/GCKTl2tGgA

Excited to meet fellow security practitioners!

#RedTeaming #CyberSecurity #OffensiveSecurity #VantagePoint #SeasidesGoa #Infosec

[Sid @illucist_]

@Ox4d5a Good one Nikhil, good one

[Sid @illucist_]

@infosec_fox iptables

[the_IDORminator @the_IDORminator]

Classic IDOR, but lets talk SSRF:
/pdfEngine/v2/prepaidStatement?consNo={consumer}&month=April&year=2025

One of the things I've been seeing more (not less) of, is developers passing parameter values like this {consumer} into back end paths. So lets assume this, on the back end, is hitting something like:

internal[.]thing[.]place[.]com/api/v1/statements/{consumer}

If you enter something like "../12345" as the consNo= value, and you get an error or 404 back, but you dork around with it and send "../statements/12345" and you get the statement back, you have SSRF. At this point, depending on how back end services are implemented, you may be able to hit a lot of other things (you shouldn't have access to) on that API.

This is of course basic, classic SSRF -- I just wanted to remind everyone to test for it. Many places you will find IDORs, you find IDORs AND this.

#bugbounty

[Sid @illucist_]

@tryhackme Ahr, I think you guys need to check the Top 10 - 2025 again.
The list that you guys have shared is of 2021 edition. ;)