Mantas Sabeckis

Bug Bounty Hunger

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Part 2 of one of our craziest episodes so far, with an insane amount of tips you can start applying right now on every target you hack on, thanks @brutecat for sharing everything with the community!

Episode 178, part 2

[Mantas Sabeckis @ott3rly]

Its cheaper to buy pentest instead of getting one from the threat group.

[the_IDORminator @the_IDORminator]

#bugbounty isnt dead. Its actually just fallen victim to an unprescedented unrelenting denial of service attack. Classic resource exhaustion

I think everyone wants to fix it with neat logic tricks, code, and bots. Which can help. But maybe the effective thing is to actually increase the exhausted resource(s) 🤷🏼‍♂️

[Mantas Sabeckis @ott3rly]

Is this real?

[Soren Iverson @soren_iverson]

ChatGPT make all messages public if you delete your account

[Mantas Sabeckis @ott3rly]

Some evidence from the chat itself

[Mantas Sabeckis @ott3rly]

Tried Kimi 2.6 LLM Agent Swarm. Looked promising at first, but its another misleading marketing SCAM.
Advertised as "300 Agents Swarm", it does not have capability launching 300 parallel sub agents! It only reserves 300 slots for 4-6 parallel agents at the time...

[Mantas Sabeckis @ott3rly]

After new update, started seeing this nonsense. @OpenAI Whats the point nerfing this feature like this?

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[box turtle @xploitrsturtle2]

Github knew for hours, they delayed telling you and they wont be honest in the future. what an amazing run, its been an honor to play around with the cats over the past few months. #teamPCP #github

[payloadartist @payloadartist]

AMA by an ex-H1 triager.

An interesting read.

https://t.co/bHaafJKQc5

h/t @zseano

[Aman @Amank1412]

Be Anthropic:

- compete with OpenAI
- OpenAI uses Stainless for their SDK
- acquire Stainless
- shut it down

[Mantas Sabeckis @ott3rly]

AI Slop Report Programs DDoS Era

[Nicolas Krassas @Dinosn]

Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’ https://t.co/ahGMSCjGrQ

[Karthik @karthikponna19]

POV : USING CLAUDE OPUS 4.7 TO JUST RENAME A VARIABLE

[Mantas Sabeckis @ott3rly]

Here is the sauce, now go cook something good

[Joseph Thacker @rez0__]

Here’s the sauce:
- agent md file with lots of disclaimers about how it’s approved testing
- a bunch of hacking skills
- /goal find a crit on target . com

That’s literally 90% of the way there and enough to blow anyone’s mind who hasn’t been convinced yet.

[Nicolas Krassas @Dinosn]

Fragnesia: universal Linux LPE
https://t.co/cNgddliMus

[Mantas Sabeckis @ott3rly]

Even more convinced that I did right thing switching to codex

[ClaudeDevs @ClaudeDevs]

Starting June 15, paid Claude plans can claim a dedicated monthly credit for programmatic usage.

The credit covers usage of:
- Claude Agent SDK
- claude -p
- Claude Code GitHub Actions
- Third-party apps built on the Agent SDK

[Joseph Thacker @rez0__]

I got a CVE for LFI in Adobe Magento!

Back in Jan, the team at @AutonomousCyber's let me give them targets for their hackbot FUZZ-E to look at. It also found 2x zero days in Angular, which I'll post on later.

With 1 run overnight, it found vulns in wildly hardened projects.

[sui ☄️ @birdabo]

never deleting this app 💀

bro is gonna wake up with -$300k

[Mantas Sabeckis @ott3rly]

@ArmanSameer95 Maths play well here