Mandeep Singh Kapoor

Software/CyberSecurity Engineer

[Mandeep Singh Kapoor @mandeeps13k]

Leveled up to 0x04! via @SynackRedTeam

[Mandeep Singh Kapoor @mandeeps13k]

@Wise Dear Team, I've sent you a DM regarding issue with one of my recent transactions. Can you please check them right now?

[Mandeep Singh Kapoor @mandeeps13k]

Do you remember when you joined X? I do! #MyXAnniversary

[Google VRP (Google Bug Hunters) @GoogleVRP]

Interested in the security of AI Agents 💁🛡️?

Then you've likely heard of "prompt injection", but do you know what "task injection" is? If you're curious, check out our latest post for a description and some real-world examples we discovered.

https://t.co/pWdDGX6M0W https://t.co/P8ndgCXtH1

[Sundar Pichai @sundarpichai]

New from our security teams: Our AI agent Big Sleep helped us detect and foil an imminent exploit. We believe this is a first for an AI agent - definitely not the last - giving cybersecurity defenders new tools to stop threats before they’re widespread.

[s1r1us (mohan) @S1r1u5_]

Hacking Windsurf: I asked the AI for the shell, it said yes.

new video’s out. I show how I could’ve hacked you… just by getting you to click my link.

Link posted below.

[Mandeep Singh Kapoor @mandeeps13k]

@UC_Assist @urbancompany_UC There was a booking that I did on your app and the work was completed but the booking is still showing as paused in the app. Can you fix this because it keeps showing me as in progress ?

[Synack Red Team @SynackRedTeam]

👀 AI chatbots are on the rise, and securing them properly has never been more important. Synack Red Team member Kuldeep Pandya (@kuldeepdotexe) details a vuln he found that allowed full access to the database and the underlying filesystem. Read on → https://t.co/FWliwa8JlS

[Hussein Daher @HusseiN98D]

Easy way to reveal server's full path:

[Mike Takahashi @TakSec]

Google Dork - API Endpoints ⚙️

site:example[.]com inurl:api | site:*/rest | site:*/v1 | site:*/v2 | site:*/v3

Find juicy API Endpoints for further testing 🎯

[Mandeep Singh Kapoor @mandeeps13k]

Do you remember when you joined X? I do! #MyXAnniversary

[Mandeep Singh Kapoor @mandeeps13k]

@official_dda @MoHUA_India @HardeepSPuri @LtGovDelhi @Spanda3000 @PIB_India @MIB_India @RajNiwasDelhi @mp_kaushal @DDNewslive @airnewsalerts @official_dda Any idea when next round of e-auction will take place ?

[Mandeep Singh Kapoor @mandeeps13k]

@ArloSmartHome Do you ship your products to India ? I Really liked the Arlo Go 2 Camera. Any chance I can get it delivered to New Delhi, India ?

[Mandeep Singh Kapoor @mandeeps13k]

@WalterJLindner Good to hear that. Time difference of 3.5 hours instead of 4.5 hours makes easier for us to work with our friends and colleagues in Berlin and across Europe. 3.5 hours seems not too much while 4.5 hours sometimes feels to be long.

[🇷🇴 cristi @CristiVlad25]

SSRF via PDF? Now made easy.

(thread)

[ProjectDiscovery @pdiscoveryio]

A remote source disclosure vulnerability was discovered in "PHP Development Server versions <= 7.4.21" by @rootxharsh @iamnoooob

Check out the blog for details ––https://t.co/sJgOE5VVIs

#php #cybersecurity #research #appsec #bugbounty

[James Kettle @albinowax]

HTTP Request Smuggler now has a probe for desync flaws caused by broken header removal operations, like this Akamai exploit.

PS you can find the lengthy rambling editions of most of my tweets at @[email protected]

https://t.co/Sbcj4PGuI4

https://t.co/kKvN54H74k

[lalka @0x01alka]

Writeup

5k$ g/vrp SSRF.

https://t.co/AGmS7G9vF3

Thanks for reading.

Regards.

#BugBounty

[s1r1us (mohan) @S1r1u5_]

Watch,
Proof of Concept: Remote Code Execution on Element Desktop Application.

https://t.co/C1qFFcVbaI

This involves usage of v8 n-day exploit to bypass certain Electron Framework restrictions.

[s1r1us (mohan) @S1r1u5_]

Watch,
Proof of Concept: Remote Code Execution on Discord

https://t.co/eUcZ22lK9I

Meanwhile, I will write one more blog to release after our
DEFCON talk.