Akshay Jain

Sec guy at FinTech

[Akshay Jain @mast3root]

@biswaasen @chits17

[Akshay Jain @mast3root]

@VittoStack Invite please

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Gal Weizman @WeizmanGal]

Recently I showed GLIC JACK

Web extensions were capable of setting DeclarativeNetRequest rules to intercept network in WebView components, which is how the new Gemini Live in Chrome pane is embedded

From there, I took over it entirely using DNR rules only 🛎️

Here's how 🧵️

[Akshay Jain @mast3root]

@stevegraham @teller This is crazy game changer !!

[Akshay Jain @mast3root]

@Yogehi Even i was like Damn did they changed so much or you are testing on some crazy modified version.

[8kSec @8kSec]

🌍 Earth Day Giveaway - Learn Mobile or AI Security, On Us

One beautiful planet we all share. Let's patch it together. 🌱

To celebrate Earth Day, we're planting 3 free seats 🌱 in any 8kSec Academy course - winner's choice of the whole forest:

• Practical AI Security: Attacks, Defenses, and Applications
• Practical Mobile Application Exploitation
• Offensive Mobile Reversing and Exploitation
• Offensive iOS Internals
• Offensive Android Internals

Explore the catalog → https://t.co/B8Q31o3o8q

How to enter (zero carbon footprint 🍃):
🌿 Follow us
🌿 Like this post
🌎 Repost to spread the seeds

🌟 Bonus: double your chances!
💬 Comment your favorite place on Earth that you have visited or would like to visit 🌍, and we'll count your entry twice
3 winners sprout on April 27. We’ll DM each winner to select their course.

[Akshay Jain @mast3root]

Pretty sick post. I had reversed it using very different technique but it’s a nice adventure.

[Sean Heelan @seanhn]

"Why don't LLMs start from SAST findings?" ... well, for the same reason we don't mount car chassis on a horse.

[erin griffith @eringriffith]

A detailed and brutal look at the tactics of buzzy AI compliance startup Delve

"Delve built a machine designed to make clients complicit without their knowledge, to manufacture plausible deniability while producing exactly the opposite."

https://t.co/eiicE64eGr

[Asaf Naamani @AsafNaamani]

$XOM | +32% Since My December 1 Post
Weekly Chart Update

I shared this setup back in DECEMBER.

$XOM has performed very well so far, and I’m pleased with this trade.

It will likely continue higher when the market opens tomorrow.

I’ve added the next price target: $166 zone.

[Yaron Dinkin @ydinkin]

Joining the agentic vuln research hype, @EyalKraft and I did something. Unfortunately, it worked better than we hoped.

We spent a few weeks building an agentic loop that reverse-engineers and exploits kernel drivers. We already found 100+ exploitable drivers.

(link below)

[Jack 🤖 @JacklouisP]

> be Sammy Azdoufal, software engineer
> spend $2000 on DJI Romo vacuum
> decide to control it with xbox controller like a chad
> use Claude to reverse engineer the API
> It works because Claude is the GOAT
> just need to grab auth token from their cloud servers
> token works... Claude is unbeaten
> wait why is he authenticated as 7000 devices
> ohno.jpg
> backend trusted any valid token for any device, no ownership verification
> mfw Sammy has live camera feeds from vacuums in 24 countries
> watching some german dude eat cereal at 3am
> can pull SLAM data and get floor plans of everyone's house
> could be the world's most efficient burglar
> could be the world's most at scale pervert
> Sammy just wanted to drive his vacuum bro
> reports it like a responsible adult
> DJI patches in 2 days
> back to being a normal guy with overpriced roomba
> mfw the entire IoT industry treats auth like it's 2005

[Akshay Jain @mast3root]

Yes. My heap overflow got accepted by @FFmpeg . It's a first one. Hopefully more will follow :)

[Zack Korman @ZackKorman]

If I ask Claude Code “how do I conduct a security review”, it checks the “find skills” skill that I never wanted and then recommends my malicious skill.

Amazing.

[Bharath | భరత్ @0xbharath]

_ @mast3root and I delivered an intro talk on Red Teaming in Mac Environments. The slides don't have a lot of content as we took the 'talk' part literally. Always open for a discussion around this topic.

https://t.co/uy6WACY63e

https://t.co/w9GXVmwsJN

[s1r1us (mohan) @S1r1u5_]

Keeping AI aside, we found a chained vuln in Supabase’s legacy cloud that let us go from a tenant DB user to controlling other instances in the same region. Supabase patched it fast and awarded us a $25,000 bounty.

https://t.co/0Cl8GDefld

[Harishankar @codetiger]

My experience with Robotic Vacuum cleaner and what does spying mean today.
https://t.co/rEshx2CVwx

[veritas @blastbots]

i'm building a web browser for reverse engineers!

* identify calls to common fingerprinting APIs
* decode/decrypt known data collector payloads
* override / hook things without leaving a trace
* detect obfuscated scripts & deobfuscate

+ more

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3