LuisFer Lopera G 

Gomoso, feliz, emprendedor, hiperactivo dinamico. Ese soy yo!! Aprendiendo Fotografía, capturando momentos. CEH en formación SYSADMIN

[PortSwigger @PortSwigger]

2025’s web hacking shift: side-channels became a core exploitation primitive.

Which technique are you going to use in your next test?

See the #1 web hacking technique of 2025 below ⬇️

https://t.co/hbcqDaK9eN

[LuisFer Lopera G  @loperalf]

@ArenaAlfaUS Sebastián, quisiera saber cuál es tu opinión sobre las valoraciones que hace investing pro, si las valoraciones y fair value que pone la herramienta son parecidos a los cálculos que tú haces?... sería una buena idea hacer un vídeo sobre tu análisis... Muchas gracias.

[Guillermo Rauch @rauchg]

https://t.co/b8rKtYZlB3

[Lupin @0xLupin]

Apparently the maintainer ~qix has been compromised affecting billions of installations on @npmjs

Here are the top 20 packages that qix contributed to with the number of installations per months:

1.6B --> ansi-styles
1.5B --> debug
1.3B --> chalk
1.2B --> supports-color
1.1B --> strip-ansi
1.0B --> ansi-regex
828.4M --> color-convert
823.1M --> wrap-ansi
820.8M --> color-name
310.9M --> is-arrayish
245.6M --> slice-ansi
202.5M --> error-ex
133.7M --> color
118.9M --> color-string
111.5M --> simple-swizzle
50.9M --> has-ansi
17.2M --> chalk-template
1.1M --> backslash
408.2K --> handler-agent
25.1K --> strip-ansi-stream

Source of claim: https://t.co/shwEmz4EBn

[Miles Brundage @Miles_Brundage]

Context: https://t.co/jQjeKOUO4M

For more language model risk humor, read to the end here https://t.co/DYakb8Xsfb

[Group-IB Global @GroupIB]

🕵️‍♀️ What if #cybercriminals could steal your face?

A stolen password can be changed.
A stolen face? There’s no reset button.

Meet #GoldFactory, a Chinese-speaking cybercrime group behind the world’s first iOS Trojan targeting facial recognition. Their arsenal of Trojans (GoldDigger, GoldPickaxe, Gigabud) harvests faces, clones IDs, and bypasses #bankingsecurity to drain victims’ accounts across Asia-Pacific.

They don’t just exploit systems.
They exploit trust.

🎧 Dive into our podcast Masked Actors to uncover how #biometricsecurity itself became the target:
Spotify: https://t.co/3M4Ur3rhWh
Apple Podcasts: https://t.co/OWiQutv8ec

Download our HTCT report here: https://t.co/1VyryVZGpE

[YesWeHack ⠵ @yeswehack]

Want to hack mobile applications? 📱

We’ve just published the ultimate guide to building an Android #BugBounty lab with emulators, real devices and proxies (featuring Genymotion, Android emulator, Magisk, Burp, Frida & Medusa) 👇

#BugBountyTips

https://t.co/bvLCPhwXzM

[LuisFer Lopera G  @loperalf]

@ArenaAlfaUS Profe, no conocía esa faceta de operar con opciones, como combina el value investing con los vencimientos? Tenes alguna estrategia de combinar opciones o vas en tradicional call y puts sencillo?

[Quant Science @quantscience_]

Financial Statement Analysis with Large Language Models (LLMs)

A 54-page PDF:

[Harshleen @0xharshleen]

In case you missed Black Hat USA 2025?
Here are all the slides🫡
🔗https://t.co/SBX71BxUwo

[Matt Dancho (Business Science) @mdancho84]

RIP Tableau and PowerBI.

Enter Julius AI.

This is what Julius can do:

[NOAH PEREZ | X @NoahPerezX]

Cómo manipular a un manipulador.

10 trucos psicológicos que funcionan:

- Hilo -

[OpenAI @OpenAI]

As ChatGPT becomes a go-to tool for students, we’re committed to ensuring it fosters deeper understanding and learning.

Introducing study mode in ChatGPT — a learning experience that helps you work through problems step-by-step instead of just getting an answer.

[Espabila e Invierte @espabilaeinv]

🚨🚨Para la persona que está empezando a analizar empresas, está perdido y no sabe cómo se hace.

Te enseño en 5⃣ pasos cómo calcular el precio justo de una acción a 2 años vista en función de las previsiones de los analistas.

Ejemplo de Alphabet $GOOG

[Oscar Arias @OACerebro]

El #MIT te simplifica la vida con su guía para leer artículos científicos.

📖🔍 ¡Ciencia fácil y divertida! 😄 #GuíaMIT

[Nicolas Krassas @Dinosn]

Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages https://t.co/UOU9KJyozc

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

#Bugbountytip #bugbountytips

Install JS Miner extension over Burp
After crawling all endpoints
Click on the target ==> Extensions > Js Miner > Run All Passive scans

I got a result [Js Miner] Dependency Confusion

The package is unclaimed over NPM
Next step

Create an account on NPM
Then install the NPM in Linux

~ npm login
~ mkdir (Package Name)
~ cd package name
~ npm init -y
~ npm publish --access public

And I claimed the package

Next Step: I edit the package.json file to the RCE
POC https://t.co/vfFinyoUaM

And in the end, I got a nice P1 😍

This amazing man @m359ah , taught me 6 months ago about understanding and exploiting the Dependency Confusion, so big thanks to him ♥

#bugbounty
Happy Hunting ♥

[PyQuant News 🐍 @pyquantnews]

OpenAI, Google, and Anthropic just published guides on:

• Prompt engineering
• Building agents
• AI in business
• 601 AI use cases

9 of the best guides you can't miss:

[A D H A M 🇵🇸 @m4kr0]

How to intercept HTTPS traffic in Flutter apps and bypass SSL verification when all Frida scripts fail

➡️ Full Article:
🔗 https://t.co/NBwBJeJche

#Android #MobileSecurity #Pentesting #flutter #frida #CyberSecurity #bugbountytip

[Inedo @Inedo]

How to deal with #Nuget vulnerabilities without manually scan every package: