Siva krishna

 ¯\_(ツ)_/¯

tweets and opinions expressed are own.

[deaguiarza @deaguiarza]

@claudeai

[Siva krishna @le4rner]

Technical skills will be depreciated and removed in the next versions. 😬

[spaceraccoon | Eugene Lim @spaceraccoonsec]

ICYMI: I created an LLM-powered tool to detect CVEs before they're even published - and it's now powering https://t.co/Tom5BRqpKA.

This is a simple GitHub page statically generated using vulnerability-spoiler-alert-action. Check out the backtest findings at https://t.co/VZ8WTWTGGF and let me know what you think the hit rate is!

I'm running this open-source vulnerability intelligence project using a personal API token, but maybe @AnthropicAI... or @OpenAI might want to support this? 👀

[Siva krishna @le4rner]

“Breaking malicious tasks into innocent-looking ones — that works. I naturally start a new chat whenever I want something done, and I also disable memory to keep previous context from slipping into the current conversation.”

[Anthropic @AnthropicAI]

We believe this is the first documented case of a large-scale AI cyberattack executed without substantial human intervention. It has significant implications for cybersecurity in the age of AI agents.

Read more: https://t.co/VxqERnPQRJ

[James Kettle @albinowax]

Concerned about LLMs replacing pentesters? We've made enhancing your own workflow with AI easier than ever - you can now build your own AI features directly inside Repeater with Custom Actions. Here's one I built for myself which guesses param meanings:

[shubs @infosec_au]

IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: https://t.co/X3dkMz9gwK

[Siva krishna @le4rner]

@akhilreni_hs he must be gawddd

[Sergey Bobrov @Black2Fan]

I have published a tool based on jadx that helps analyze Java applications.

https://t.co/jVTKEM9fIc

BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations.
It also searches strings that look like URIs, paths, or secrets.

[James Kettle @albinowax]

This is a great infoleak exploit chain targeting YouTube by @brutecat. Love the use of a DoS flaw to make the attack stealthier!
https://t.co/aIqLDq9T9z

[Siva krishna @le4rner]

Curious to know how diverse the bug bounty community is! 🤔

Are you doing bug bounty hunting from an IT background or a non-IT background?

I honestly feel a lot of non-IT folks are doing really good. 🔥

Here's a poll to settle this.
#BugBounty #cybersecurity

[Siva krishna @le4rner]

More thoughts:

- takeover expired domains of companies and setup catch all emails to see if it's receiving any emails purely by chance.

[Siva krishna @le4rner]

When users register with a mobile number, but the payment gateway requires an email, companies often use dummy emails like @dummylegitdomain.com and submit to pg. These domains can be taken over by setting up a catch-all email, allowing access to payment information.

[Siva krishna @le4rner]

Developers often hardcode test or random Gmail addresses in GitHub repositories or elsewhere. If these Gmail accounts are available for takeover, they could potentially receive sensitive information.

[Siva krishna @le4rner]

This could be a common category of bug for bug bounty hunters.

More details in thread ⬇️

https://t.co/IwbnHyatzG

[Siva krishna @le4rner]

this is beta & still a lot of bugs - always open for feedback

[Siva krishna @le4rner]

check out my new tool everythingjs
https://t.co/EncGdOPsYO

- suports jsonl output
- extract endpoints, bucket links, secrets, dom sinks, beautified file js store & key search
- provides web UI
- support monitor mode (2s, 1d etc)
- support slack alerts
- pip install everythingjs

[Siva krishna @le4rner]

CVE-2024-51479: Next.js authorization bypass vulnerability
poc?
localhost:3000/admin?__nextLocale=anything

[Daily CyberSecurity @the_yellow_fall]

CVE-2024-51479: Next.js Authorization Bypass Vulnerability Affects Millions of Developers

Find out about the Next.js vulnerability CVE-2024-51479 that could have exposed sensitive data. Take the necessary measures to secure your Next.js application.
https://t.co/aD1aGZhS9b

[Siva krishna @le4rner]

CAPTCHAs like "I'm not a robot" might vanish as AI agents rise, replaced by biometrics or behavior-based authentication for smoother human-AI internet use.

[Bug Bounty Reports Explained @gregxsunday]

Cross-Site POST Requests Without a Content-Type Header by @lukejahnke
https://t.co/n7p3jJmqmj
#BBRENewsletter85