Nerdwell

Making things by day; breaking things by night.

[bugcrowd @Bugcrowd]

Anthropic is expanding access to Claude Mythos, an AI model previously restricted for its advanced bug hunting capabilities. 🔋

By opening access to vetted security teams, organizations can use its codebase mapping to find and fix vulnerabilities before attackers do.

Read more from ISMG: https://t.co/22xBM0zLK5

[bugcrowd @Bugcrowd]

Gadgets: Turning harmless bugs into P1s

Gadgets are low-impact bugs like open redirects or client-side quirks, that seem harmless alone. But when you chain these pieces (Prototype Pollution, cookie injections, etc.), you can build a high-impact exploit that crushes a hardened target.

Let’s learn.

🧵👇

[🍜 @cprkrn]

HOLY FUCKING SHIT OMG CLAUDE JUST CRACKED THIS SHIT, THANK YOU @AnthropicAI THANK YOU @DarioAmodei NAMING MY KID AFTER YOU 😍

https://t.co/gObNirRDpS

[Nerdwell @nerdwell]

@InsiderPhD 100% this! The LLMs' tendency for sycophancy make them great at playing Devil's Advocate if used properly.

[Nerdwell @nerdwell]

@SnobbyScheffler Amen! I was noting this just the other day. @Chik_Fil_A got cocky and lately feels like they're trying to see how much b.s. the customer is willing to take. I'll admit the degree of failure varies by location, and a handful are still decent, but notable nationwide falloff.

[the_IDORminator @the_IDORminator]

ETSY uses a lot of integers.... go get those #bugbounty payouts people! Holler here when you find a bug.

#bugbountytips Actually buy and sell a product to open up more buttons to push and APIs to call! Duh 😜

[Nerdwell @nerdwell]

@vxdb @caffeinedoom Safe to assume this also affects Apple Watch? Users may be more likely to enable Express Transit on Apple Watch because the form factor makes it a special kind of PITA to authorize transactions (e.g. trying to double-click while holding close enough to reader).

[Nerdwell @nerdwell]

Gonna have to start hacking iOS .... if @Apple put as much effort into security on iOS 26 as they did UAT, it must be riddled with vulns. 🙄

[Nerdwell @nerdwell]

@zoecyber001 The main character from Billions. Congrats, you're a badass!

[Nerdwell @nerdwell]

Fascinating stuff and surprisingly easy! There are many great articles/resources on fault injection; but here's a shameless plug for my high-level overview of how such attacks can be applied to #BugBounty, along with some other interesting examples.

https://t.co/Y5vA9PiHXB

[Zoë @zoecyber001]

The attack is called Clock Glitching (or Voltage Glitching). It’s surgical.

The tester didn't guess the PIN. They waited for the exact microsecond the CPU was asking the question: "Is the PIN correct?" At that precise moment, they used the paperclip to short the power rail with the AA battery, "
starving the chip of just enough juice to cause a hiccup.

The CPU didn't crash. It just tripped. It skipped the "Compare" instruction entirely and landed on the very next line of code: Access Granted.

[Nerdwell @nerdwell]

@hjluks Amen to this! I'm a figure skater (low level) and whenever I slack-off in the gym, this is the first place I notice. It's all in the hips baby!

[Nerdwell @nerdwell]

@engadget Many of these companies have actively engaged the ethical hacker community to help secure their products. They put their money where their mouth is. You're WAY out of line @FCC! No way this is actually about cybersecurity.

[Nerdwell @nerdwell]

@engadget Damn .... Those are some of my favorite #BugBounty targets. Typical government failure mode ... right problem; wrong solution.

[Nerdwell @nerdwell]

I'm surely not the first to do that but thought I'd share with the class.

Happy Hunting! 😃

[Nerdwell @nerdwell]

For all my #BugBounty friends ... quick way to supercharge your workflow:

1. Burp extension that hooks IHttpListener + IProxyListener, serializes req/res pairs to JSON, and POSTs them to a local MCP server.

2. MCP server that receives the traffic, dedupes by endpoint, and exposes tools like get_pending_reqs, search_traffic, & submit_request.

3. Now Claude can see your Burp traffic in real time, analyze endpoints, and submit test requests back through Burp's HTTP stack.

Bonus: Just have Claude build both sides and iterate ad infinitum.

#bugbountytips

[kavan @KavanSG]

Thrust vectoring mount for model rocket project

… soo spacex job offer yet? 😀😀

[bugcrowd @Bugcrowd]

Catch Tatiana Uklist from Bugcrowd on the Women in Cybersecurity Careers Panel hosted by the UTS Cyber Security Society 💼

It’s always inspiring to see conversations like this create more visibility, representation, and guidance for the next generation of talented folks in cyber!

[ScriptKiddo | Offsec USA Chapter Ambassador @kaorrosi]

Performed manual token manipulation using WinDbg , stole a token from the SYSTEM process and assigned it to my CMD process, achieving privilege escalation to NT AUTHORITY\SYSTEM. ✨

[bugcrowd @Bugcrowd]

3/ Mobile Secrets: Decompile that APK. 📱

Hardcoded AES keys in strings aren't just "informational" P4s.

If you can use those keys to forge requests or decrypt local data, you’ve just escalated a "low" finding to a critical P1.

[bugcrowd @Bugcrowd]

Why ignore crypto? Most hunters think it’s "math." 🧮

The truth: The math is usually fine, it’s the implementation that breaks.

Take a 6-digit OTP. If the "random" seed is just a system timestamp, it’s not secure. It’s predictable. Brute-force becomes faster than the expiration timer. 

Crypto hacking isn't about breaking the code; it's about finding where the developer left the key under the mat. 🗝️

(👇🧵)