JarPhish

Pentester | Hacker | Bug Bounty Hunter

[JarPhish @jarphish]

Never try to control the outcomes, we simply can’t do it. And the harder we try, the worse it gets.

Instead, learned to focus on the process. On the things we can control. That means planning well, training well, and organizing our surroundings.

That’s all we can do.

[JarPhish @jarphish]

@chesscom Mikhail Tal

[JarPhish @jarphish]

“If more information was the answer, then we’d all be billionaires with perfect abs.” Derek Sivers

[Leandro Barragan @lean0x2f]

I'm not sure the community will like this. @Hacker0x01 will now reuse your novel techniques / exploits / old reports to look for vulns on the rest of the customer's infra. I guess they will add you as collab and give you a bounty, right? right?!

[JarPhish @jarphish]

@CommandCodeAI I buy $1 subscription. If my deepseek tokens reach the limit and I do top up, did I get the same amount of tokens if I pay for another $1?

[JarPhish @jarphish]

@MrAhmadAwais Eid Mubarak!

[Ahmad Awais @MrAhmadAwais]

I'm close to hitting 50K on X. Should celebrate.

Giving away 3 Pro subs to @CommandCodeAI

STEPS
1. Follow @MrAhmadAwais
2. Follow @CommandCodeAI
3. Repost this post

And reply with what you're your building with Command Code.

Will pick randomly soon as I hit 50K. LFG!

[JarPhish @jarphish]

@CommandCodeAI Can I use Command code for Pentesting? I do security code review and testing some blackbox vulnerabilities? Or I have to do custom setup for it?

[Angelo Giuliano 🇨🇭🇮🇹 @angeloinchina]

WATCH OUT INDONESIA.

The US is putting massive pressure on Indonesia right now as part of its desperate plan to contain China.
The goal?

Turn Indonesia into a US client state that helps enforce an extended blockade around the Malacca Strait >> choking off China’s main energy lifeline.

We’re already seeing the signs: a flood of new hit pieces on the Prabowo government popping up everywhere.

Polymarket (that classic US psyop betting tool) is suddenly running projections on regime change.

Western-controlled media outlets are sliding into DMs with Brian Berletic and myself, fishing for angles >> because we were among the few who called out the last color revolution attempt and exposed the Soros/NED funding networks behind the 2025 unrests.

This is coordinated.
There’s a clear plan to destabilize Indonesia and flip it fully into the Western camp.
Don’t be surprised when your feeds (including X) get flooded with more and more negative coverage of the Indonesian government >> “authoritarian,” “corrupt,” “unstable,” the usual script.
Indonesia is too important: biggest Muslim country, strategic geography, resources, and balancing act between powers. The US doesn’t like that independence.
They want control over those sea lanes for any future Taiwan or South China Sea showdown.

Stay vigilant, Indonesia.
Separate real domestic issues from foreign-funded chaos.

The hybrid war playbook is in full swing >> info ops, NGOs, media smears, and political pressure.

Don’t let them turn your country into the next pawn.

[Mike Takahashi @TakSec]

5 Ways to Obfuscate Prompt Injection + Jailbreaks

In my experience, these have the highest % success rates:

1. camelCase
Turns natural language into token soup that can bypass filtering.

2. Hex encoding
Simple, old-school, hides dangerous keywords from pattern matching.

3. Negative Squared Unicode
Unicode variants like 🅰 🅱 🅲 can alter tokenization while still being human-readable.

4. Reverse Text
Reversing prompts can confuse detection logic while remaining recoverable by models.

5. Braille
uncommon Unicode range with weak moderation coverage.

One of the best tools for experimenting with these transformations is:

P4RS3LT0NGV by @elder_plinius (link in comments)

It supports ciphers, encoding, Elvish, NATO Alphabet, and much more.

Prompt injections do not always look like prompts 👾

[JarPhish @jarphish]

@MrAhmadAwais @deepseek_ai @CommandCodeAI Can I use command code for vibe hacking?

[DeepSeek @deepseek_ai]

We are making our discount permanent! 🎉

Enjoy building with DeepSeek-V4-Pro and bring your innovative ideas to life! 🚀

[JarPhish @jarphish]

@aituglo I always love read your articles, tips and tricks, Alhamdulillah. can wait for next article.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[JarPhish @jarphish]

@rez0__ When AI intelligent enough to control and can create everything. And no need human anymore.

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[the_IDORminator @the_IDORminator]

🚨
As of tomorrow I am permanently reducing my course cost by 50% to $100 so more people have access to it and can get those bounties while they are still hot. And yes, they are still hot. The internet is still full of stupid problems waiting to be found for those looking, at least for now...

https://t.co/ZQDJvWYVZb

I suspect we have about 2 years of decent #bugbounty hunting left before most companies have access to and properly leverage the tools like Mythos that effectively replace "most" hackers.

Using the EXACT methods in this course, I found 20+ critical bugs on a target in a matter of hours the other day. Nothing fancy. The internet is just too dang big to fix and patch in a small amount of time, even if AI is finding the bugs. Internal legacy human processes with 500 steps are still bottle-necking remediation.

What the bug bounty world becomes next is anyone's guess. My suspicions, hackers will be paid flat rates for hacking and/or patching targets any way they can (be it AI, manually, or both). So, here's to the next evolution of hacking, which is hopefully round-table LHE's where we all work together on targets to harden them as best as possible, instead of working against each other to try to "be the best hacker".

Re-post for a chance to win 1 of 5 course coupons for a give away on May 14th. I'll have Grok pick the winners.

[zseano @zseano]

i'm taking a pause from hacking to resume building https://t.co/H7tDJivomZ. i regret closing it down and I shouldn't of done it. everything will be back online EXACTLY as it was very soon and i've got some big plans for the future. and yes, that includes zseano methodology v2 ;)

[Ahmad Awais @MrAhmadAwais]

Giving away @CommandCodeAI Max subscription to someone at random who follows me and Command. RT.

That’s more than 5 billion tokens of DeepSeek v4 pro.

In 24hrs. LFG!!

Read the eng deep dives below, good for all not just us.

[JarPhish @jarphish]

@nnwakelam Sorry to hear that, hope you have a save trip.. Jakarta is tough mate. Lot of poor people and criminals. Most people visit Jakarta only for working, but they live in suburbs. That's why I'm moving from Jakarta to Sawangan.