Kostis Kosmidis

Interested in web security.

[Kostis Kosmidis @kroemvil]

I just completed @Pentesterlab's introduction badge!!!

[Kostis Kosmidis @kroemvil]

https://t.co/lYXzl7x9ri

[Kostis Kosmidis @kroemvil]

Λόγος Τιμής - Τα Σκυλιά https://t.co/ieepiDH4wi

[Kostis Kosmidis @kroemvil]

Νέγρος Του Μοριά - Είναι Ελληνοwest (Official Music Video) https://t.co/XZII3B4qtA

[Kostis Kosmidis @kroemvil]

https://t.co/gfjv9Sf5k7

[Kostis Kosmidis @kroemvil]

https://t.co/yK3bDoxeRs

[Arsen @arsen_bt]

Best GitHub Repos to learn Web3 Security From Scratch in 2026:

1. Awesome Solana Security
GitHub: https://t.co/WpiZXujRKh

2. Web3 Bounties & Exploits
GitHub: https://t.co/KZdupywlhg

3. Awesome Move Security
GitHub: https://t.co/AdBATeaaMF

4. DefiHack Labs
GitHub: https://t.co/e0hx7eZmCF

5. Awesome Smart Contracts
GitHub: https://t.co/W1Dqa06ewv

6. Blockchain Attack Vectors
GitHub: https://t.co/cxotMjdnO7

7. Smart Contract Vulnerabilities
GitHub: https://t.co/YFu6JdGg8e

[Kostis Kosmidis @kroemvil]

11 ΧΡΟΝΙΑ ΛΤ @ΘΕΣΣΑΛΟΝΙΚΗ 21/09/2024 - AFTERMOVIE https://t.co/zSqOlp42IC

[Kostis Kosmidis @kroemvil]

Anser - Μια Συγγνώμη Στον Εαυτό Μου | Prod. by Eversor https://t.co/TtE7v48MFV

[Marka2‼️ @Marka2free]

Ο Τζέικ Λανγκ,οπαδός του Τραμπ,ο οποίος ήταν μεταξύ των αμνηστευμένων διαδηλωτών της 6ης Ιανουαρίου, ηγήθηκε διαδήλωσης κατά της μετανάστευσης στη Μινεάπολη,φωνάζοντας ρατσιστικά και εμπρηστικά συνθήματα.
Οι διαδηλωτές τον «συνέθλιψαν»

[Perly 🦈 @_Shark_byte]

Recently made a list on places to learn cybersecurity

Posting here in case it helps anyone out

> @Google CTF
good for hands on, and will look cool on a resume :)

> @hackinghub_io
pretty cool labs, good to apply skills in practice

> @owasp Juice Shop
vulnerable web app to test tings you learn legally!

> @JustHackingHQ
by the 🐐 @_JohnHammond , need I say more?

> @Cisco networking academy
pretty cool imo, and good foundation

> @SubvertedSec
Just tried this one, pretty cool

> @blackperl_dfir
pretty cool, but haven't gone in depth (YET)

> @edXOnline
not security specific, but they have good foundational courses

> @rootme_org
Also pretty cool, but haven't gone in depth

> @PentesterLab
ditto lol ( my goals for 2026 are to try out more of these 😅 )

> @PortSwigger web academy
honestly my fave (and its free)

> @Codecademy
more general coding and fundamentals

> @Hacker0x01 Hacker101
good for practice, and its a bit CTF style

> @picoctf
love working on the old challenges

> @yeswehack dojo
haven't used this in depth yet, but pretty cool form what ive seen so far

> @tryhackme
love this platform sm

> @hackthebox_eu
also really awesome, tbh struggled a bit with this one at the very start of learning cybersecurity, so I recommend if you already know some stuff

> pwn college
haven't used in depth either, but hear very good things

> APIsec University
more specific to APIs but honestly another one of my favs

> @MetaCTF
love the challenges and flash CTFs

> National Cyber League
never competed (ikr???) but have done gymnasium challenged as its great for beginners

> @codepath cybersecurity course
For students, super comprehensive

> @CryptoHack__
love crypto omggg another one of my favorites esp for cryptography (my specialty lol - any CTF teams looking for a crypto expert 👀 )

> @TCMSecurity
never tried it out yet, but again I hear good things!

> YT channels like John Hammond, nahamsec, cyb3rmaddy (Maddy -.), Tib3rius, computerphile

Lemme know if I missed one

[Jopraveen @jopraveen18]

Here you go, a small collection of browser security talks I’m watching lately.
If you know any other good YouTube talks on browser internals / exploitation, drop them below (I’ll update it in the playlist)👇

https://t.co/WownWDlwOu

[dawgyg - WoH @thedawgyg]

Alright so to end 2025 I am going to post something that people have been requesting for quite some time.. As alot know, I have made over $1 million dollars from SSRF vulnerabilities alone. #ssrftips Below I will provide some information on some of the ways that I beat the blacklists/deny lists and cashed in. Any method I post below has worked for me personally in the past. I am not claiming that any of these ways are 'my' discoveries, and in no way am I trying to claim other's work as my own. Simply answering a question that gets asked of me almost daily. #bugbounty #bugbountytips #togetherwehitharder #ittakesacrowd #hackers #hacking #NewYearsEveBountyTips

So lets get into it:

Encoding:
Everyone knows (or should know) about the ability to encode IP addresses. What alot of people dont know is that you can combine encoding types on a single IP. SO instead of encoding the entire IP, encode single octets etc.
Example: Changing the Metadata IP to: 0251.254.169.254 this octal encodes the 1st octet only, leaving the rest of the IP the same. This is the exact method that allowed for my $180,000 from the Yahoo Bug Bounty Program in Oct 2018

Redirects:
Alot of SSRF vulnerable functionality will follow redirects. What many people dont consider is multiple redirects. Never stop at just one. I have found many instances where an SSRF followed all redirects, and would properly block the final redirect to the target internal service (internal ip/metadata server). DO NOT STOP AT 1 REDIRECT! Instead of a single redirect, setup a simple php redirect script that will redirect the request back to the same end point multiple times before finally sending to the target IP/host. I have had many instances in the past where the target properly checks the response of the first 1,2, 3 ....6 redirects then magically on the 7th it no longer performs any valdiation and allows you to hit the metadata. I can't explain why this happens, but its happened enough that this is one of the very first things i test for when it comes to SSRF testing.

TOCTOU:
This is one of my fav's because it almost always can be used to bypass the initial fixes for an SSRF vulnerability. TOCTOU stands for: Time of Check Time of Use. When you pass a url to an SSRF vuln end point, the backend will take the host of this, resolve it (if its not already an IP), check against the allow/block list, then take action. Many frameworks will not cache the DNS lookup response that happens during the initial validation phase. When they forget to do this, having a subdomain properly setup for a TOCTOU check can allow for tricking their checks to allow for hitting banned resources.
How it works: Server resolves https://t.co/aKo0eb63ft to 1.1.1.1 and does their checks to make sure its not a blocked IP. After passing these checks the domain is passed to the function that will actually make the call. If the server did not cache the previous response, it will then resolve the host again as part of the flow to make the request. If you have a properly setup nameserver for this attack, then the instance they make the 1st DNS call, your server quickly changes the DNS entry and points it to the target IP (Metadata/Internal), so that when it gets to the function that makes the request, it resolves the host again and makes the request.

HTTP 2 vs HTTP/1.1 vs HTTP/1.0 vs HTTP/0.9
Several have had success with this in the past. And again, I am not sure why this works sometimes. But if the request is using HTTP/2 and blocks your attempt, try and change it to an older version. I have had success with each of the above at least once (most of the time on Yahoo, but others as well).

Simple/more common things:
dns rebinding, create a hostname on your domain pointing to localhost or an internal IP.

simplify the IP. example: 127.0.0.1 is blocked, so try 127.1, or 0.0.0.0, 0 etc.

Theres tons of other ways that you can get creative and do things like this. This post is just sharing some of the more fun/more unique ways that I have had success in the past. This is not ment to be an exhaustive list of things to try, and is only ment to start your brain working to come up with weird/random/fun ways to beat the black lists.

If you like the information, drop a like/comment/follow and let me know which of the above you have tried in the past, or are looking forward to trying out in 2026. If you end up having success with these, let me know as well!

[X @TheMsterDoctor1]

🧵 + Browser Extensions Every Bug Bounty Hunter Should Know

These tools help with recon, XSS, IDOR, secrets discovery, JS analysis, and productivity. Bookmark this 🫡

⸻

🔐 Secrets & Recon

1️⃣ TruffleHog
Finds exposed API keys & secrets directly in websites
🔗 https://t.co/k0mVfuo4eY

2️⃣ Wappalyzer
Detects CMS, frameworks, analytics, cloud providers
🔗 https://t.co/E9WoW0x5rB

3️⃣ https://t.co/mwQoKuNeq4
Finds company email patterns (useful for reporting & OSINT)
🔗 https://t.co/8ZxEJNz6JV

4️⃣ FindSomething
Discovers hidden parameters & potential keys
🔗 https://t.co/OVV5N0wqGK

⸻

🧪 Exploitation & Testing

5️⃣ HackTools
Payloads, encoders, wordlists, one-click utilities
🔗 https://t.co/b44seFtGlP

6️⃣ Edit Cookie
Modify cookies, inspect flags (Secure, HttpOnly, SameSite)
🔗 https://t.co/lNQhBO9Uk6

7️⃣ Edit Hidden Fields
View & edit hidden form inputs
🔗 https://t.co/wa3BsPg58U

8️⃣ DOMLogger++
Logs DOM changes in real time (🔥 for XSS & JS sinks)

⸻

🕵️‍♂️ Enumeration & Discovery

9️⃣ Link Gopher
Extracts all links & domains from pages and SERPs
🔗 https://t.co/yRCTLZ9IGV

🔟 DotGit
Detects exposed .git repositories
🔗 https://t.co/CLo3sZ1570

1️⃣1️⃣ WaybackURL
Pulls archived endpoints from Wayback Machine
🔗 https://t.co/nVKHYK6Jwv

1️⃣2️⃣ JS Recon Buddy
Identify, collect & analyze JS files quickly

⸻

🌐 Privacy, Infra & Fingerprinting

1️⃣3️⃣ Disable WebRTC
Prevents IP leaks during testing
🔗 https://t.co/KMJRgAiI4n

1️⃣4️⃣ User-Agent Switcher
Test UA-based logic & bypasses
🔗 https://t.co/lHscSE5Mh5

1️⃣5️⃣ Shodan Addon
Instant IP, ports, ASN & hosting info
🔗 https://t.co/mhXxdGCY9p

1️⃣6️⃣ FancyTracker
Detects analytics, trackers & marketing tech

⸻

🧠 JS & Dependency Security

1️⃣7️⃣ Retire.js
Detects vulnerable JS libraries
🔗 https://t.co/SV2DttJzb2

1️⃣8️⃣ Hidden Eye
Highlights hidden DOM elements & risky behaviors
🔗 https://t.co/9yfTNGaGaf

⸻

⚡ Productivity & Quality of Life

1️⃣9️⃣ Temp Mail
Disposable emails for testing flows
🔗 https://t.co/NxKECGjVSc

2️⃣0️⃣ Open Multiple URLs
Open endpoint lists instantly
🔗 https://t.co/w5zQXkNlD0

2️⃣1️⃣ Fake Filler
Auto-fill forms with fake data
🔗 https://t.co/iCyPCGv69D

2️⃣2️⃣ uBlock Origin
Blocks noise → cleaner JS & requests
🔗 https://t.co/YIlhlNqSnR

2️⃣3️⃣ Dark Reader
Save your eyes during long hunts 🌙
🔗 https://t.co/ejxC8AHGxR

2️⃣4️⃣ SponsorBlock
Skip sponsor sections in security talks
🔗 https://t.co/8nhNuMuD8S

⸻

🔥 4 Advanced Extensions I Recommend Adding

2️⃣5️⃣ Requestly
Modify headers, redirect requests, inject payloads
🧠 Great for auth logic & XSS testing

2️⃣6️⃣ Header Editor
Craft custom headers (Host, Origin, X-Forwarded-For)
💥 Useful for bypasses

2️⃣7️⃣ JSON Formatter
Readable API responses = faster IDOR detection

2️⃣8️⃣ Burp Suite Browser Extension
Seamless browser → Burp integration
⚡ Faster interception & testing

⸻

💡 Final Tip
Extensions don’t replace Burp, ffuf, or nuclei —
they shorten time-to-bug.

Small tooling upgrades = faster critical findings 🧠💥
🫡

[Kostis Kosmidis @kroemvil]

I just completed TryHackme's Advent of Cyber 2025. I learned a lot regarding Web Security and Digital Forensics in general.This is my first certificate regarding cybersecurity and I plan to work harder and smarter to earn more certificates in 2026!

[Kostis Kosmidis @kroemvil]

Nelly Furtado, Williane 108, Taborah Johnson, Tynomi Banks, Charmie - Sa... https://t.co/hWzwAxYV4k

[Kostis Kosmidis @kroemvil]

@ETHGreeceHQ Καμια δραση για εμας απο Θεσσαλονικη?

[PinkDraconian @PinkDraconian]

As promised, here's my video reviewing the Burp Suite Certified Practitioner (BSCP) exam from PortSwigger 🟠

🔗 https://t.co/HdBKEjvTBW

[Kostis Kosmidis @kroemvil]

Configuring the two-proxy solution using mitmproxy for Facebook mobile research
https://t.co/YgESCbOYPe

[Kostis Kosmidis @kroemvil]

Best DevSecOps Books 2025 https://t.co/ZMaFkZOkcO