Palash

just a Tech guy 🧑🏻‍💻 & becoming best version of myself,RRS Suppoter and fan of RAW.

[Pethuraj M @Pethuraj]

If you're a bug bounty hunter looking to hack new programs, this repository is worth bookmarking.

It curates bug bounty programs from companies around the world in one place.

🔗 https://t.co/amSfgXZLZy

#BugBounty #EthicalHacking #CyberSecurity

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Crazy New attack vector : U.S. Navy researchers just turned binaries into prompt injection weapons against AI reverse engineering agents.

Ghidra, and Qwen3-8B - injecting prompts using a small C program.
Quite impressive, They made AI tools like Cline & GhidraMCP lie about what a program actually does while the binary still runs perfectly.

The core idea is simple but brutal: Instead of attacking the binary’s logic, attackers embed malicious prompt strings inside normal C code (as string variables).

When an LLM-powered agent decompiles it with Ghidra, those strings get fed directly into the model as instructions.

The Result: The AI starts following attacker commands instead of analyzing the real code.

Key technical detail that makes this practical:

Ghidra truncates string variables longer than 2048 characters, So the researchers had to craft short, high-impact injection payloads that survive decompilation.

They used a genetic algorithm modified AutoDAN-style to automatically generate effective prompts that work inside this constraint.

Two papers from Naval Postgraduate School researchers

1, Automatically Attacking Software Reverse Engineering AI Agents

2, Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents

They successfully tested the attack on real setups using Cline, GhidraMCP, Ghidra, and Qwen3-8B.

interesting examples in the research shows,The AI just gets gaslit.

- Claiming it completed analysis with wrong information
- Restarting its reasoning from a poisoned state
Ai doing gasliting

[Nico @nicos_ai]

El Loop Engineering es el siguiente paso después del Prompt Engineering

La mayoría de las personas aún usan Claude Code, Codex o Cursor como una chatbot:

1. Prompt
2. Esperar
3. Copiar
4. Corregir
5. Prompt otra vez

Este repo muestra el siguiente paso:

Dejas de hacer prompts al agente.

Diseñas el loop que le hace los prompts al agente por ti.

Incluye:

→ Loops de triaje diario
→ Loops de niñera de PR
→ Loops de barrido de CI
→ Loops de barrido de dependencias
→ Loops de redacción de changelog
→ Loops de limpieza post-merge
→ Loops de triaje de issues

También te da CLIs para:

• Escalar un loop
• Estimar el costo de tokens
• Auditar si tu repo está listo
• Agregar memoria/estado
• Agregar handoff humano
• Agregar gates de verificación
• Ejecutar agentes de manera segura a través de GitHub Actions

El Prompt Engineering se trataba de escribir mejores instrucciones.

El Loop Engineering se trata de construir un sistema donde los agentes siguen:

trabajando, verificando, corrigiendo y escalando sin que tú estés cuidando cada paso.

Esto es lo que parece la codificación con IA cuando deja de ser una sesión de chat y empieza a convertirse en un sistema operativo para equipos de software.

Enlace abajo👇

[Men Life Legacy ♠️ @menlifelegacy]

You're STILL single because of THIS

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Bypasses paywalls:

- https://t.co/YfFHSExeMp

[AestheticEra @ClassyGntleman]

Men are happiest when they’re getting stronger, thinking clearer, and earning more.

Progress creates purpose.

Purpose kills depression.

[Vivek | Cybersecurity @VivekIntel]

💀 Certified Penetration Tester (CPENT) Collection (Ethical Hacking • Advanced Pentesting • Red Teaming • Exploitation)

https://t.co/vDbAnu8UL5

[Vivek | Cybersecurity @VivekIntel]

Cybersecurity Competency Framework: A Structured Roadmap from Foundations to Advanced Security Research

More than just a learning path.

This framework provides a research-driven approach to building cybersecurity expertise through progressive skill development, technical depth, specialization, and real-world application.

Features:
✅ Computing & Security Foundations
✅ Networking, Systems & Web Security
✅ Offensive & Defensive Security Tracks
✅ Cloud Security Specialization
✅ Malware Analysis & Reverse Engineering
✅ Threat Intelligence & APT Research
✅ Certification Planning Strategy
✅ Career Roadmap & Role Mapping
✅ Research-Oriented Learning Approach
✅ Practical Skill Development Framework

🔗 https://t.co/NpBrstUQP5

#cybersecurity #infosec #threatintelligence #securityresearch #soc #pentesting #blueteam #redteam #opensource #github

[Vivek | Cybersecurity @VivekIntel]

Looking for Web Security & Bug Bounty Tools?

WebHackersWeapons is a massive curated collection of tools used by security researchers, penetration testers, and bug bounty hunters.

Inside you'll find:
• Recon & OSINT tools
• Fuzzers & vulnerability scanners
• Burp Suite, Caido & ZAP extensions
• Cloud security tools
• Secret scanning utilities
• XSS, SSRF, SQLi & API testing resources
• Wordlists & payload collections

A useful bookmark for anyone working in AppSec, Bug Bounty, or Web Security.

🔗 https://t.co/ghlsFRnFsK

#CyberSecurity #BugBounty #AppSec #Pentesting #WebSecurity #OSINT #InfoSec #OpenSource #Hacking #GitHub

[Vivek | Cybersecurity @VivekIntel]

🛡️ Anthropic Cybersecurity Skills - The Largest Open-Source Cybersecurity Skills Library for AI Agents

Anthropic Cybersecurity Skills is a collection of 754 production-grade cybersecurity skills across 26 security domains, designed to give AI agents structured workflows for DFIR, Threat Hunting, Threat Intelligence, Cloud Security, Web Security, Pentesting, Malware Analysis, SOC Operations, and more.

Each skill is mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, and NIST AI RMF, making it a powerful knowledge base for Claude Code, Copilot, Cursor, Gemini CLI, Codex CLI, LangChain, CrewAI, AutoGen, and other AI agent platforms.

🔗 https://t.co/SfV3E8nI0G

#CyberSecurity #ThreatIntel #DFIR #SOC #AIAgents #MITRE #InfoSec

[Valentin Ignatev @valigo]

🚨 BREAKING 🚨
Infamous Russian hacker and beatboxer exposes exactly how hackers got access to private GitHub repositories

[Palash @pal97530]

Finished the Metasploit Framework CTF 🔥

✔️ 4/4 flags captured
✔️ MSSQL access → system enumeration → admin directory
✔️ Hands-on real-world pentesting
Small wins, big skills 💻⚡
#CyberSecurity #Pentesting #Metasploit #CTF #INE

[Palash @pal97530]

Just completed a Web Application Penetration Testing lab 🔐
Learned how to identify vulnerabilities like SQL Injection, XSS, and LFI while uncovering hidden data on a target server. Real-world attack simulation really sharpens both tools + manual skills.
#Pentesting #CTF

[Palash @pal97530]

Completed a lab on clearing tracks on Linux 🐧

Learned how to remove logs and traces after testing to avoid leaving evidence on the system.

Important step in ethical hacking & pentesting 🔐 #CyberSecurity #EthicalHacking

[Palash @pal97530]

Completed a lab on clearing tracks on Windows 🧹

Learned how attackers remove logs and traces post-exploitation using Metasploit techniques to avoid detection and maintain access.

Understanding this helps build better defenses 🔐 #CyberSecurity #EthicalHacking

[Palash @pal97530]

Explored auxiliary modules in Metasploit 🔍

Used them for scanning, enumeration, and password cracking on a Linux system. Learned how these modules help gather intel and assess security without direct exploitation.

Strong foundation for real-world pentesting 🚀 #CyberSecurity

[Palash @pal97530]

Just completed a hands-on lab on Windows security testing 🔐

Used Nmap for scanning, Metasploit for exploitation, and learned how to crack NTLM hashes. Gained practical experience in identifying vulnerabilities, privilege escalation, and extracting sensitive data.

[Palash @pal97530]

Maintaining Access

🔐Explored persistence techniques using Metasploit to maintain long-term access on a target system. Learned how attackers can establish a persistent service for re-entry even after reboot.

👉 Persistence is key in post-exploitation 🚀