Jonaski

Hooked on tech, I've been hacking away since '09! 🏳️☠️🇵🇭

[Jonaski @jonaskilucaski]

🚀 Excited to share my new tool: NullSec Framework! 🐛🔍

​A complete 12-phase bug bounty reconnaissance & automation pipeline written in Bash and built for real engagements. Automate everything from passive discovery to active vulnerability confirmation!

​🔥 Key Features:
⚙️ 3 Scan Modes: Fast, Normal & Deep
💾 Checkpoint & Resume (never lose scan progress!)
🎯 Smart Asset Scoring (focus on targets with the highest attack potential)
☁️ Cloud Storage Enumeration (AWS, GCS, Azure)
🔑 JS Secret Extraction & Telegram Alerts

​Whether you need quick hourly scans or thorough weekly audits, NullSec has you covered.

​Check out the repo, drop a ⭐️, and let me know what you think! 👇
🔗 https://t.co/Lmo2WIfm8z

​#BugBounty #InfoSec #CyberSecurity #Recon #OffensiveSecurity #NullSec

[Jonaski @jonaskilucaski]

@droidbuilds Apparently, Claude just got caught red-handed... or so they say.

[Jonaski @jonaskilucaski]

@ateneodemanilau Go back to your country, don't act like you know it all. It's your job to take care of your players, but you just let them sail out there when you damn well knew those waves were gonna be rough.

[ClaudeDevs @ClaudeDevs]

As a result of a US government directive, we are suspending access to Claude Fable 5 for all users. You can continue to use all other Claude models.

Here’s what this means for you:

Across Claude products, new sessions will run on your selected default model or Opus 4.8, and existing Fable 5 sessions will end with an error.

On the Claude Platform, requests to Fable 5 will also return an error. Please update your integrations to other Claude models.

We know this is a disruption to your workflows; we appreciate your patience and support.

[Jonaski @jonaskilucaski]

I'm going to figure out if this directive is even enforceable without some shady backdoors or telemetry that Anthropic is hiding. That whole "misunderstanding" bullshit makes it seem like their legal team was totally caught off guard.

This shit's a disaster for security, a mess for industry, and ruins due process. Buckle up for some lawsuits or an emergency stay coming in the next 48 hours. 🤡

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[mRr3b00t @UK_Daniel_Card]

Stealthy /s

[Jonaski @jonaskilucaski]

@UK_Daniel_Card Run scan first, but make sure it's from an air-gapped Raspberry Pi stuffed in a Faraday bag. 😉

[Jonaski @jonaskilucaski]

@UK_Daniel_Card 😍😍😍

[Jonaski @jonaskilucaski]

Attack plan:

1. Configure Burp
2. Map staging
3. Read auth configs
4. Test BOLA
5. Verify SQLi
6. Probe XSS
7. Chain redirects
8. Ping SSRF via collaborator

[Jonaski @jonaskilucaski]

Let's get those shit mapped out.

[Jonaski @jonaskilucaski]

It's 10:54 and I just stuffed my face with breakfast. I'm about to brush my teeth and hit the sack since tonight's session is gonna be a long one. 🐛🏦

[Jonaski @jonaskilucaski]

You should think about staying independent, because that "consistent relationship" crap usually just means they want reliable, budget-friendly access to your talents.

[Sujan Thapa Magar @suzan_mgr]

Bug hunters i got this message after reporting 100 plus bugs in this program. You guys also can try this bug bounty target. Magic of 100 plus reports.

[Jonaski @jonaskilucaski]

Pattern locks are meant for keeping shit convenient, not for making you rich.

[Haberin Var Mı? @HVMHaber]

Bir adam, 2013 yılında telefonunun şifresini unuttu. Telefonun içinde 150 adet Bitcoin vardı.

Telefonun sahibi, 2013'den bu yana belirlediği desen şifreyi hatırlamaya çalışıyor...

[mRr3b00t @UK_Daniel_Card]

"GreatXML
GreatXML bitlocker bypass vulnerability

Steps to reproduce,

If defender offline scan was initiated in the victim machine at any point then there is no need to login, the machine is automatically vulnerable. You will have to copy "unattend.xml" and "Recovery" directory to the root of the recovery partition then reboot to WinRE using shift + click on restart button, if everything was done correctly, a shell with unrestricted access to the bitlocker volume will spawn.
If defender offline scan was never initiated then you have to either login and initiate it yourself or figure out a way to boot into WinRE in offline scan state (I believe it should be very possible to do so without logging in) and follow steps above
If everything is done properly, this should be the result"

#bitlocker #hacks

[mRr3b00t @UK_Daniel_Card]

A Shodan query to find UnifiOS Devices
(Unifi/Ubiquiti)

https://t.co/quleZFhUtj

[mRr3b00t @UK_Daniel_Card]

🫡❤️🇬🇧🛡️🇺🇦

[Jonaski @jonaskilucaski]

The classic OAuth token theft through open redirect, which could result in a shitload of account takeovers. It's a theoretical problem, but it's based on real vulnerabilities that have been exploited way too many times.

[Jonaski @jonaskilucaski]

Never trust IDs, account numbers, user IDs, and member IDs provided by the client. Always verify on the server.

[Jonaski @jonaskilucaski]

@droidbuilds Azure.

[Jonaski @jonaskilucaski]

@SuperSisi What's the dress code?

[mRr3b00t @UK_Daniel_Card]

who needs mythos anyway right!
(made with Claude, I haven't tested this/proven this with packets, I'm kind of tired and this was FOR SCIENCE)