JOEL JAISON

noob bug bounty | soc analyst | learning offensive security

[nyutrino @nyutrino]

ഇതൊരു serious allegation ആണ് … കേരളത്തിൽ ഉത്തരവാദിത്വമുള്ള ആരെങ്കിലും ഉണ്ടോ ഇതു ഏറ്റെടുത്തു ഒരു അന്വേഷണം നടത്താൻ?

[Srikanth.CashlessConsumer | ஸ்‌ரீகாந்த் @logic]

Your browser's padlock is a promise: "this is really your bank."

Last week an Indian company broke that promise 8 times.

One of the secret keys was the number 4.

A thread for anyone who has never once thought about how HTTPS works. 🧵

[Rajat @rajatsandeepsen]

Palantir for Kerala 😭🔥

[Harsh Savergaonkar @harshsaver]

leaving mom for work was the hardest this time

so i set up an old linux laptop with a big screen on our dining table that stays on a video call 24x7

got claude to write scripts so that if the laptop / browser crashes it rejoins, if the wifi breaks it fixes itself and rejoins, and if it gets switched off she just presses the power button and i'm back

right now i'm somewhere over iceland working and eating, and she's at home doing her work

we're not even talking, but every now and then she looks up and i'm there, and i look up and she's there

and when she gets up at 3am for water, i'll be on the screen working and she can just say hi before going back to bed

thank you technology ❤️

[Brie Wolfson @zebriez]

this is so lovely by @jxnlco

read it all. twice.

https://t.co/SDxhF6SfAC

[Rohit Ghumare @ghumare64]

Don't just learn by watching, learn by doing:

https://t.co/Kyh96Sxatu

[JOEL JAISON @joelmjaison007]

@nikkithashanker @SuperBryn_AI You can't connect the dots looking forward; you can only connect them looking backwards."

[JOEL JAISON @joelmjaison007]

@phishfinding @certtap Security+ for the win

[Enno Rey @Enno_Insinuator]

Good series on Pwning AI Agents
Part 1: Exploiting AI Coding Agents https://t.co/XKy0WjqHFl
Part 2: RCE and Data Exfiltration https://t.co/ineERmxlFg
Part 3: Read Only Bypass https://t.co/jLfshrnrBh
Part 4: Exploiting MCP Hosts with a Malicious MCP Server https://t.co/RD4rRjiHB0

[JOEL JAISON @joelmjaison007]

@cherry4akuma @AbhiShek828389 @TheElixirTech @Hacker0x01 @Bugcrowd @GoogleVRP Congrats bro!! 👊 teach me your way sensei

[Mohsin Khan @tabaahi_]

Thank you @Bugcrowd @inspectiv @Hacker0x01 ❤️‍🔥

This video is for those who think their life can’t change from where they are.

[JOEL JAISON @joelmjaison007]

been doing a 14 day networking thing, one lesson a day, free. you play a helpdesk tech working up to network engineer. it's decent #pingmynetwork #Networking #Giveaway https://t.co/TWhJVxIm3I

[Nitin Gavhane @NitinGavhane_]

BURP SUITE BUG BOUNTY CHECKLIST

A practical checklist for web and API security testing.

1. Proxy

- Capture normal application traffic
- Identify domains and API hosts
- Review request/response headers
- Check cookies and authentication tokens
- Map interesting endpoints

2. Repeater

Test requests manually:

Parameters → Headers → Cookies → Methods → IDs → API versions

Compare the baseline response after every controlled change.

3. Access Control

- Test two accounts you control
- Change object IDs
- Test horizontal access
- Test vertical privileges
- Test hidden endpoints
- Test different HTTP methods
- Check authorization on APIs

4. Authentication

- Login/logout behavior
- Session expiration
- Password reset flow
- MFA enforcement
- Session/token reuse
- Account recovery
- JWT validation

5. Input Validation

Check authorized test inputs for:

XSS
SQL Injection
SSTI
XXE
Path Traversal
Command Injection
Open Redirect

6. API Testing

- REST endpoints
- GraphQL
- API versioning
- Hidden parameters
- Mass assignment
- Rate limits
- CORS
- Sensitive data exposure

7. Repeater → Compare

Original Request
↓
Controlled Modification
↓
Replay
↓
Compare Status / Length / Body
↓
Investigate Difference

8. Intruder

Use carefully for:

- Small parameter lists
- Controlled fuzzing
- Authorization comparisons
- Known test payloads

Avoid unnecessary high-volume requests.

9. Extensions

Useful categories:

Authorization
JWT
JavaScript analysis
CORS
Passive scanning
Request comparison

10. Reporting

Before submitting:

- Clear title
- Affected endpoint
- Preconditions
- Reproduction steps
- Request/response evidence
- Security impact
- Minimal PoC
- Remediation
- Scope confirmation

FINAL WORKFLOW

Recon
↓
Proxy
↓
Target Mapping
↓
Repeater
↓
Access Control
↓
Authentication
↓
Input Validation
↓
API Testing
↓
Impact Validation
↓
Report

Burp Suite is not about sending more requests.

It's about making controlled changes, observing differences, and proving security impact.

Only test systems explicitly authorized for security research.

#BurpSuite #BugBounty #InfoSec #CyberSecurity #WebSecurity #AppSec #EthicalHacking #Pentesting #SecurityResearch #APISecurity

[Jacob Coxon @hilbertspaess]

I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.

[Mosh @moshhamedani]

Everyone is looking for a shortcut these days.

A shortcut to get rich.
A shortcut to lose weight.
A shortcut to learn an instrument.
A shortcut to build an app.

I’m telling you: there is NO shortcut.

You can’t build a great body after a week at the gym. You can’t play an instrument after watching a few YouTube videos.

Building software is no different. It requires many different skills. And you can’t develop those skills overnight or by learning bits and pieces while talking to AI. You won’t have a clear mental map of how things fit together or when to use what.

AI gives rookies the impression that they can build an app in a day and make thousands of dollars every month.

And yes, that may actually happen for a few lucky ones. But it doesn’t apply to the other 99.9%.

If you’re one of the lucky ones, remember: you’re not always going to stay lucky. Sooner or later, someone will come along and build a better version of what you built. Better UX. Better architecture. Fewer bugs. Faster execution. That’s when competition starts eating your lunch.

We’ve seen this before. Yahoo was once a giant in search. Then Google came along with a better search engine and eventually took over the market. Then ChatGPT came along and changed how we search for information, disrupting Google and countless businesses that depended on its traffic.

That’s what happens when strong engineering, great UX, and a better solution to a real problem come together.

That’s why fundamentals still matter, even if AI eventually writes every line of code for us.

Learn a programming language. Build small projects. Build front ends and back ends. Learn SQL and data modeling. Design a few databases. Learn about code organization, complexity, APIs, testing, security, and UX.

Not because you need to memorize syntax.

Because that’s how you develop engineering judgment. You start with small problems and, over time, develop the mental models you need to solve bigger ones.

Then you can let AI handle more of the implementation while you focus on higher-level problems and decisions.

Remember, when you don’t know what you’re doing and you’re just prompting, everything AI generates can look perfect. To an inexperienced developer, it all looks right. AI is incredibly good at convincing you that its solution is solid.

If you don’t know enough to challenge it, you’ll accept the first answer and move on. But with a solid foundation, you can see the cracks and challenge AI. That’s when it starts to say:

“You’re absolutely right. That’s a better design than what I built.”

“You’re right on both counts. I didn’t consider that scenario.”

Building that foundation takes time. You can’t build it overnight by watching a YouTube video or even taking a single course. You need to spend several months taking courses, reading books, and, more importantly, building things yourself without AI’s help so you can learn to identify problems and solve them yourself.

Once you’re equipped with that knowledge and start using AI, you’ll act more like a tech lead. You won’t manually type every line of code. You’ll give AI the right instructions, review what it does, challenge its decisions, and guide it in the right direction.

[JOEL JAISON @joelmjaison007]

@iliyadindar @voorivex Is the course in english or arabic?

[Mba.tech🦀 @_justmba]

https://t.co/lpW0VLYKn9 please i'm not gatekeeping for those asking this is the link to the repo

[JOEL JAISON @joelmjaison007]

I have a problem which is i want to study everything pentesting dfir soc how do i escape this half bake knowledge era 😭😭😭🙏🙏🙏

[nisarga @ni5arga]

got to meet apar yesterday, founder/director of @internetfreedom. he helped me a lot during the cbse hack situation and i don’t think i’ve properly said how grateful i am for that.

IFF is one of the very few organizations in india actually fighting for digital rights, privacy, free speech & holding power accountable when it matters. doesn’t matter where you stand politically, work like this matters.

if you can, support them. genuinely one of the most important orgs doing this work in the country right now.

[ArtSec @_ArtSec_]

Finally got to post some writeups. Here is a $3,000 super admin IDOR and a $500 admin panel self signup.

https://t.co/N4n9kWKXO5