Radman

Security enthusiast

[Radman @radsec01]

@navid_rebian Solid catch🔥

[watchTowr @watchtowrcyber]

You're back in the room, trapped with us - and a Citrix NetScaler Pre-Auth RCE (CVE-2026-8452)

Enjoy...

https://t.co/sl0IByEz3w

[watchTowr @watchtowrcyber]

What do we even say at this point?

CVE-2026-8451, a zero-day Memory Overread that watchTowr Labs identified in Citrix NetScaler appliances in March, has just been publicly disclosed with patches.

We're not done yet... speak soon... ;-)

https://t.co/MAzxLkbbsZ

[Radman @radsec01]

New subdomain went live

Yii2 debug mode enabled → Full database credentials leaked in stack trace

Just 3 hours later → Access Forbidden

Continuous monitoring isn’t optional

Note: This subdomain was only discoverable via DNS brute-force

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Radman @radsec01]

@MrMSA16 Adapt to change or be shaped by it

[Radman @radsec01]

@0xHo3ein0xploit @voorivex Congrats bro🔥

[Radman @radsec01]

@patterniha @vahidfarid @iSegar0 @markpash @mahsanet @ircfspace @amin_o__o دمت گرم واقعا خیلی کار خفنی انجام دادی

[Radman @radsec01]

@jorjandii تاحالا ندیده بودم که آخوند OSINT سوپر سنگین انجام بده که اینم دیدم
از عجایب آخوند هر چی بگم کم گفتم

[Yasho @YShahinzadeh]

It's time for sharing, this is not a simple write-up, we are sharing our methodology and reasoning, detailing how we approached and hunted the flaw, I hope you like it :]

https://t.co/MNmJyNZVBg

[Radman @radsec01]

@zseano sorry for your loss🖤

[Radman @radsec01]

Yay, i was rewarded $1500
Bug: Stored XSS via an SVG file led to full account data exposure
Tip: Always try to exploit XSS and don’t just report it with a simple alert

[Radman @radsec01]

@voorivex 🔥🔥🔥

[Radman @radsec01]

@Fara_dst @voorivex Congrats🍾

[Radman @radsec01]

@cyber_advising 🧐

[Radman @radsec01]

I just found a WAF bypass for Akamai and Cloudflare:
<address onscrollsnapchange=window['ev'+'a'+(['l','b','c'][0])](window['a'+'to'+(['b','c','d'][0])]('YWxlcnQob3JpZ2luKQ==')); style=overflow-y:hidden;scroll-snap-type:x><div style=scroll-snap-align:center>1337</div></address>

[Radman @radsec01]

@mosyo_hunt نه اینطوری نبود چون که تونستم وارد حساب یکی دیگه بشم.
Zero click ATO

[Radman @radsec01]

@iSegar0 خوشتیپ😁😂

[Radman @radsec01]

@NahamSec @YShahinzadeh @AmirMSafari 🔥🔥

[Radman @radsec01]

IDOR + Auth Bypass = Admin takeover😎😈