Mr. Mime

#Information#Security#Researcher
just sharing the tweets, it's not reflecting my own personal opinion & it's just for education n awareness purpose

[Muqsit 𝕏 @mqst_]

🪩 ALL IN ONE: A list of open-source web security scanners!

Github: https://t.co/4ogmWL8tw0

#infosec

[Brut 🇮🇳 @wtf_yodhha]

☠️ Malicious PDF Generator: Generate malicious PDF test files for testing SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications.

🔗 https://t.co/n3HAu9mCwc

#cybersecurity #pentesting #bugbounty #RedTeam #AppSec #WebSecurity

[Tom Dörr @tom_doerr]

80+ practical examples for building AI agents and RAG apps

https://t.co/6hbLTD2OoG

[Tom Dörr @tom_doerr]

Open-source Burp Suite alternative for security research

https://t.co/ykiSfMtFkV

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

CSRF is the bug everyone "knows" and almost nobody tests properly. Here's the do-this-today playbook:

1. Find the requests that change state. Change email, change password, add a user, transfer money, update settings. POST/PUT/DELETE. The ones that matter.

2. Look at what protects each one. CSRF token? SameSite cookie? Custom header? Origin/Referer check? Nothing but a session cookie = your bug.

3. Attack the token (this is where money lives):
- Delete the token param. Still works? CSRF.
- Swap in another user's token. Accepted? Not tied to session.
- Reuse an old token. Works forever? Same problem.
A token that exists but isn't validated is worth nothing.

4. Method swap. Change POST to GET. Still works? Fire it from an img tag. No form needed.

5. The Content-Type trick. "It's JSON, it's safe." No. Try text/plain or form-encoded. Browsers send those cross-site with no preflight, and tons of JSON endpoints accept them.

6. SameSite reality check. Lax (the default) blocks cross-site POST but ALLOWS top-level GET navigation. State change on a GET? Still exploitable.

7. Build the PoC. Auto-submitting HTML form. Victim lands on your page, their email silently changes, you own the password reset, full account takeover.

The trap: hunters report "missing CSRF token" and get closed as low. Don't. Chain it to one-click account takeover and it's high/critical. Always report on IMPACT.

What should I break down next?

[AISecHub @AISecHub]

https://t.co/v7yrb14nsu

[Alok Pathak @1005Alok85200]

Stop wasting hours trying to learn AI. 📘📚

I have already done it for you.

With one list. Zero confusion. And no fluff

📹 Videos:

1. LLM Introduction: https://t.co/TySCm0xG3b

2. LLMs from Scratch: https://t.co/qBBJmP6ZDg

3. Agentic AI Overview (Stanford): https://t.co/R7oH9i0aMK

4. Building and Evaluating Agents: https://t.co/1Sy1OjsckS

5. Building Effective Agents: https://t.co/AdIzlFT77w

6. Building Agents with MCP: https://t.co/oEeUOpUHU5

7. Building an Agent from Scratch: https://t.co/1cZWMX8hLp

8. Philo Agents: https://t.co/9rDXme39yA

🗂️ Repos

1. GenAI Agents: https://t.co/mjvPZVRa9j

2. Microsoft's AI Agents for Beginners: https://t.co/4VwE6bmi2s

3. Prompt Engineering Guide: https://t.co/VGWnZSqnfQ

4. Hands-On Large Language Models: https://t.co/J2nJaTAEOe

5. AI Agents for Beginners: https://t.co/4VwE6bmi2s

6. GenAI Agentshttps://lnkd.in/dEt72MEy

7. Made with ML: https://t.co/9pbvT8CxAN

8. Hands-On AI Engineering:https://t.co/sT1HceCNZr

9. Awesome Generative AI Guide: https://t.co/IkARsanL1O

10. Designing Machine Learning Systems: https://t.co/1e0NqbFQNi

11. Machine Learning for Beginners from Microsoft: https://t.co/q354N2vfyp

12. LLM Course: https://t.co/xMv0jwrqv4

🗺️ Guides

1. Google's Agent Whitepaper: https://t.co/KCJDAKpfEn

2. Google's Agent Companion: https://t.co/VsDPZCb6N9

3. Building Effective Agents by Anthropic: https://t.co/l0xQsiDEuG.

4. Claude Code Best Agentic Coding practices: https://t.co/SF3kQRTaP3

5. OpenAI's Practical Guide to Building Agents: https://t.co/qwmfdGvpgV

📚Books:

1. Understanding Deep Learning: https://t.co/Tu2ci6oNHv

2. Building an LLM from Scratch: https://t.co/Tq1OwdVmC9

3. The LLM Engineering Handbook: https://t.co/JUNfzmjDkr

4. AI Agents: The Definitive Guide - Nicole Koenigstein: https://t.co/ke8uFinTOp

5. Building Applications with AI Agents - Michael Albada: https://t.co/xNSwPWfVqH

6. AI Agents with MCP - Kyle Stratis: https://t.co/kdetx0lc5r

7. AI Engineering: https://t.co/137JdXS0K6

📜 Papers

1. ReAct: https://t.co/oKJUOuWLEO

2. Generative Agents: https://t.co/fcCcxctvaN.

3. Toolformer: https://t.co/uBn0MagPIj

4. Chain-of-Thought Prompting: https://t.co/j2IJZrXGWa.

🧑🏫 Courses:

1. HuggingFace's Agent Course: https://t.co/GssfjmkAJU

2. MCP with Anthropic: https://t.co/JvOtB8aL2e

3. Building Vector Databases with Pinecone: https://t.co/v7D2QJLA4N

4. Vector Databases from Embeddings to Apps: https://t.co/OgSIBrKtIl

5. Agent Memory: https://t.co/80PygTlybI

Repost for your network ♻️

[SIFF - Save Indian Family Foundation @realsiff]

2500 husbands are killed by wives in every 30 days. Because suicides are murders.

(If dowry deaths are murders, then male suicides due to harassment by wives are also murders.)

Counter this fake statistics propaganda by toxic feminists.

[Asura/असुरा/شيطان @human56523]

This poor elderly lady, a war widow is paying the price for her foolish son’s asininity of marrying a cynically overindulged 33yrs old woman from a dating site with skeptical past & 0 brink.

In this hoefied era of cucked misandry it's a blessing to have a strong mom like her 💔.

[Aircorridor @_aircorridor]

Gathering data with free OSINT tools is easy; mastering the methodology of a real investigation is the hard part. Without structured tradecraft, raw information is just noise.

If you want to move past basic tool-running and learn true asset tracing and intelligence gathering, look into the OSINT training program by Hackers-Arise.
https://t.co/StE7sdnLgd

@three_cube @DI0256 @IamSmouk @co11ateral

[Bindu Reddy @bindureddy]

🚨 Agent Swarms Can Build Complex Software Systems

- Opus 4.7
- GPT 5.5 Thinking and
- Gemini 3.2 (shortly)

combined into an Agent Swarm to build complex full-stack software products

Stop paying for CRMs and SaaS, Just create custom software tailored for your organization

[Anastasis Vasileiadis @Anastasis_King]

⚔️Top 22 Web Application Hacking Tools

[ShoneeKapoor @ShoneeKapoor]

Three Years In Jail For Not Talking To His Wife?
Supreme Court Exposes Another 498A Miscarriage Of Justice.

A man was branded cruel, convicted under Section 498A IPC, and sentenced to three years in prison despite no proven dowry demand, no proven harassment, and no proven abetment of suicide.

The entire conviction ultimately rested on the allegation that he did not speak to his wife for a few days. The Supreme Court found that even this allegation was unsupported by evidence.

How many men lose years of their lives before courts finally conclude that allegations are not proof and suspicion is not guilt?

TO READ EXACTLY WHAT THE SUPREME COURT SAID AND DOWNLOAD THE ORDER COPY, CLICK HERE:👇
https://t.co/agNYexHZRu

#498A #False498A #SupremeCourtOfIndia #FalseCases #JusticeForMen #MensRights #LegalNews

[ShoneeKapoor @ShoneeKapoor]

Can Employer Fire You For 498A Or DV Case? Indian Law Explained

A wife files a 498A or Domestic Violence case.

Can that single allegation cost a man his livelihood before any court finds him guilty?

The answer may surprise both employees and employers—and could determine whether a pending matrimonial dispute becomes a career-ending punishment.

A criminal trial takes years, yet many men begin facing professional consequences the moment a matrimonial complaint is filed.

Indian law draws a clear line between accusation and guilt—but that line is often forgotten when careers, reputations and livelihoods are at stake.

This is where legal rights become more important than public perception.

CLICK HERE TO READ THE FULL LEGAL GUIDE FOR FREE:👇
https://t.co/WMl9suwgZ3

#498A #DomesticViolenceAct #EmployeeRights #EmploymentLaw #IndianLaw #LegalAwareness #MensRights

[Anastasis Vasileiadis @Anastasis_King]

⚡Best of Cyber Security Tools

[Your Sophia Ai @NextShopiaAi]

LIST OF 40 WEBSITES TO FIND REMOTE JOBS

1. Linkedin. com

2. Indeed. com

3. Glassdoor. com

4. FlexJobs. com

5. weworkremotely. com

6. Remote. com

7. Upwork. com

8. Freelancer. com

9. Fiverr. com

10. Guru. com

11. Toptal. com

12. AngelList. com

13. Hubstafftalent. com

14. Simplyhired. com

15. Remotive. com

16. Virtualvocations. com

17. workingnomads. com

18. Hired. com

19. cloudpeeps. com

20. taskrabbit. com

21. talent. com

22. Remote OK - remoteok. io

23. DRemote - dremote. io

24. Jooble - jooble. org

25. stackoverflow. com/jobs

26. jobspresso. com

27. onlinejobs. ph

28. simplyhired. com

29. themuse. com

30. skipthedrive. com

31. zirtual. com

32. justremote. com

33. hireable. com

34. remoteworkhub. com

35. jobbatical. com

36. freelancewritinggigs. com

37. contentwritingjobs. com

38. problogger. com/jobs

39. behance. net

40. designhill. com

Don't forget to follow @NextShopiaAi to get more insightful Ai related tools and update.

[Avinash Singh @AvinashSingh_20]

AI/ML/Data Science Complete Collection: https://t.co/gGK7ROWjgB

Bookmark it!

[obscaries ❘ AppSec @obscaries]

An excellent guide on WebSocket security testing.

It covers everything from intercepting and analyzing WebSocket traffic to hunting for issues like CSWSH, IDORs, injections, race conditions, and authorization flaws.

If you're into web security or bug bounty hunting, this is worth a read.

Source: https://t.co/DBXjzXdkoJ

#BugBounty #WebSecurity #CyberSecurity #AppSec #WebSockets #Pentesting

[Co11ateral @co11ateral]

Telegram OSINT

Multiple ways to find and extract information

https://t.co/GHgrU2CfWy

@three_cube @_aircorridor