Jay ツ 🇮🇳

DevOps | Security Analyst | @nullahm

[HAHWUL @hahwul]

Dalfox v3 has been released🔥

I've been rewriting it in Rust since August last year, and it's finally done.

The biggest change is the engine. v3 no longer depends on a headless browser like v2 did. Instead, it uses DOM/AST analysis to check whether an XSS finding is actually valid.

Tested on xssmaze, various challenge sites, and real-world targets, it reduces false negatives and false positives more effectively while scanning faster than v2.

https://t.co/maZDqTQPqs

[Dr. Julie Gurner @drgurner]

Seneca hits you with a brick.
Pay attention to your life.

[Patrik Grobshäuser @ITSecurityguard]

Stop blaming AI slop for what bug bounty platforms did to themselves.

👇 wrote down some thoughts about the state of triage

https://t.co/0dq1I61YGd

[null Ahmedabad (n|u Ahmedabad) @NullAhm]

AI pentesting is moving from hype to hands-on.

Join us at NULL Ahmedabad for a session on setting up your first AI Pentest Assistant with @jay_yaml & @moxxitt.

📅 30 May | 10 AM
RSVP 👉 https://t.co/uOHWXCp7xc

@null0x00
#nullAhm #Cybersecurity #Infosec

[Synack Red Team @SynackRedTeam]

When the frontend is doing the auth check, the frontend is the attack surface.

In our latest Exploits Explained, SRT Researcher @kuldeepdotexe breaks down three client-side authentication bypasses he found on real assessments:

1) Forging a JWT and expiry into localStorage after spotting an authRequired: !0 route guard

2) Flipping a sessionStorage loggedIn flag and setting userInfo to {} to satisfy a truthy check

3) Toggling is_active from false to true in an API response to unlock a hidden webhook flow for an inactive user

https://t.co/GMXehXStqU

[Joseph Thacker @rez0__]

Here’s the sauce:
- agent md file with lots of disclaimers about how it’s approved testing
- a bunch of hacking skills
- /goal find a crit on target . com

That’s literally 90% of the way there and enough to blow anyone’s mind who hasn’t been convinced yet.

[s1r1us (mohan) @S1r1u5_]

when react2shell hit last year, i think vercel handled it brilliantly.

to protect their users, they paid $50,000 for every bypass researchers could find. we decided to participate, and ended up earning $170,000.

read how we did it here: https://t.co/2dM6Mf9PHU

[shubs @infosec_au]

Earlier this year @SLCyberSec’s research team disclosed a vulnerability that allowed us to leak PII and emails stored inside Salesforce Marketing Cloud instances, for any customer, without authentication. You can read more about our research here: https://t.co/Og4HoMPAFM

[Bipin Jitiya @win3zz]

I developed this to save my time and stay updated with the latest in cyber security. It collect resources live through AI daily. I know it still has room for improvement, but I am sharing it with you all.
Have a wonderful Sunday!
https://t.co/7cGIl4bstf

[Jay ツ 🇮🇳 @jay_yaml]

@win3zz Nostalgic 😄

[s1r1us (mohan) @S1r1u5_]

I pointed claude opus at chrome and told it to build a full v8 exploit for discord.

A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell.

https://t.co/vwj9d33Bvq

[Chaofan Shou @Fried_rice]

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.

We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.

Check our paper: https://t.co/zyWz25CDpl

[Barracks @BarracksArmy]

Security Researcher in your bio?
Time to prove it.
Barracks Live Hacking Event [WarGames] × @BsidesMussoorie.
April 4–7. Mussoorie. 🏔️

[Jay ツ 🇮🇳 @jay_yaml]

@avishiiiiiii Try Gidima for their Benne and even Gujju classic GHOTALO, one of the best in town.

[Patrickbatman @hamidonsolo]

https://t.co/VyI219VEmd

[Barracks @BarracksArmy]

CTF khel ke khud ko hacker bolta hai?
WarZone try kar… sach samajh aa jayega.

Enter the arena:

#barracks #cybersecurity

[null Ahmedabad (n|u Ahmedabad) @NullAhm]

🔥Happening this Saturday at NULL Ahmedabad.

How to actually find and report your first bug. Security of AI agents. P2P systems with live tools and demos.

📅 28 March | 10 AM

RSVP now 👉 https://t.co/M6fmUTG8P8

@null0x00 @OreoB1scuit @imhardikrathod @amanverasia
#nullAhm

[God of Prompt @godofprompt]

🚨 BREAKING: Someone just open-sourced a full offline survival computer with AI, Wikipedia, and maps built in.

Project N.O.M.A.D. is an open-source offline survival computer.

Self-contained.
Zero internet required after install.
Zero telemetry. Everything runs locally on your hardware.

What it includes:
→ Full Wikipedia archives via Kiwix
→ Offline maps via OpenStreetMap
→ Local AI models via Ollama + Open WebUI
→ Calculators, reference tools, resource libraries
→ A management UI to control
everything from a browser

One curl command installs the entire system on any Debian-based machine.

Runs headless as a server so any device on your local network can access it.
Minimum specs to run the base system: dual-core processor, 4GB RAM, 5GB storage.

To run local LLMs offline, you want 32GB RAM and an NVIDIA RTX 3060 or better.

No accounts.
No authentication by default.
No cloud dependency.
No phone-home behavior.

Built to function when nothing else does.

The grid, the cloud, the API you depend on. None of it is guaranteed.

The people building local-first systems right now are the ones who won’t be asking for help when access disappears.

[sin99xx @sin99xx]

Most JWT content is stuck in 2015.
alg=none, weak secrets, basic misconfig screenshots.

That’s not where the interesting bugs are.
I usually keep this stuff private.

This time I’m dropping it publicly ↓
https://t.co/Sm0oiwjyxV

[André Baptista @0xacb]

Super cool work by @s3bsrt

HTTP trailers can be a blind spot. Proxies usually ignore them, but backend servers will happily merge them into the main headers, letting you sneak payloads right past security filters.

Blog link 👇
https://t.co/gpLb4G2Ksm