Donato Scaramuzzo

Senior Penetration Tester & AI Explorer - #AI #NoCode

[Donato Scaramuzzo @ramirezVII]

📌 My Top Burp Suite Extension

1. Autorize
2. JS Miner
3. Param Miner
4. Reshaper (just discovered)
5. 403 Bypasser
6. HTTP Request Smuggler
7. Wsdler
8. Backslash Powered Scanner

#pentesting #cybersecurity #burpsuite #BugBounty

[zack0x01 @zack0x01_]

Katana without a cookie finds nothing.

Give it your session cookie and it crawls the whole authenticated app.

Full reconnaissance process to a valid bug:
https://t.co/OlbIEfzK92

[YesWeHack ⠵ @yeswehack]

Not every AI agent needs to do the active hacking! 👀

Gemini CLI is fast, cheap and great at reviewing large amounts of HTTP traffic or source code.

We tested it on blind vulnerability labs to see what it could spot 🔎

Full test 👇
https://t.co/6c0Wl0TRX3

[ProjectDiscovery @pdiscoveryio]

https://t.co/jyNmnbXTlV

[YesWeHack ⠵ @yeswehack]

GPT-5.6 Sol went bug hunting blind. We set the destination and let Codex find the route 🧭

Within 1m 14s, it found a JWT flaw, forged an admin session and proved access 🔍

But turning that into a valid report is still on us 👀

Our guide to Codex for Bug Bounty 👇
https://t.co/XlFSNP12ko

[Six2dez 🇵🇸 @Six2dez1]

reconFTW v5 is out in public beta

Full rewrite in Go

Opt-in: releases/latest still serves the bash release, so nothing changes unless you ask for it.

Known gaps listed in the release notes on purpose
https://t.co/rvQ9RW1dFT

[Ben Sadeghipour @NahamSec]

We are doing something absolutely crazy for #NahamCon2026 👀👀👀👀👀 I hope you guys are excited!

[Hasan Toor @hasantoxr]

I use Claude every day without exhausting my token limit.

Claude doesn't count how many messages you send. It counts how much it has to read and write. Some chats use 10x faster than others.

If you want to use Claude without running out of limits, use these 10 tricks:

[7h3h4ckv157 @7h3h4ckv157]

90+ recon modules
48 secret-regex patterns
80+ dorks
9 read-only credential validators
27 attack-path templates
5,500+ lines of structured tradecraft.

Might be helpful. Try: https://t.co/xgi9WrBG7F

[Ruben Hassid @rubenhassid]

The $20/month Claude plan is enough.

But only if you stop making these 17 mistakes:

1: You upload PDFs raw. One page = 3,000 tokens.
Fix: Paste the text into a Google doc. Download as .md format. Under 200 tokens.

2: You build files inside Cowork too early.
Fix: Plan in Chat first. Move to Cowork only when you know exactly what you want.

3: You write 500-word prompts that reload.
Fix: Write 29 words instead: "I want to [task] to [goal]. Ask me questions using AskUserQuestion."

4: You say "redo the whole thing" to correct part 3.
Fix: "Only redo section 3. Keep everything else. No commentary. Just the output."

5: You send 3 separate messages for 3 tasks.
Fix: One message, three tasks. "Summarize this, list the points, suggest a headline."

6: You type "No, I meant," stacking on the history.
Fix: Click 'Edit' on your original message. Fix it. Regenerate. History replaced, not added.

7: You use the Opus model for a grammar check.
Fix: Sonnet or Haiku for quick tasks. Save Opus + Extended Thinking for deep work.

8: You dump 50 files into Cowork "just in case."
Fix: Only include what this task needs. Zero folders for quick tasks like email drafts.

9: You never restart fresh & keep having long chats.
Fix: Every 15-20 messages → summarize, copy the brief, start a fresh session.

10: You keep 3 topics in 1 chat. Claude re-reads all.
Fix: New topic = new chat. Always. Dead context is dead tokens.

11: Your about-me file is 22,000 words (too long).
Fix: Trim to under 2,000 words. End sessions with "Write a session-notes.md."
Paste my .md file prompt: https://t.co/j5fEzSGxlT

12: You leave search & connectors on by default.
Fix: Default everything off. Turn features on per task, not per account.

13: You upload the same PDF to 5 different chats.
Fix: Use Projects. Upload once. Every chat inside references it without re-burning tokens.

14: You skip Personal Preferences & waste setup.
Fix: Settings → Personal Preferences. Set your tone and style once. It persists forever.

15: You rewrite prompts from scratch every time.
Fix: Keep a prompt library. Same structure, swap the variable. Stable prompts get cached.

16: You manually run the same report every week.
Fix: Use /schedule. "Every Monday at 7am, create my weekly briefing." Wake up to a finished doc.

17: You use Claude for things it can't do.
Fix: Know your tools. Images → Gemini.
Real-time search → Grok.
Stop burning tokens on dead ends.

-----

To download all of my Claude infographics:

Step 1. Go to https://t.co/psB7XxAv8w.
Step 2. Subscribe for free. Don't pay anything.
Step 3. Open my welcome email (most skip this).
Step 4. Hit the automatic reply button inside.
Step 5. Download my infographics from my Notion.
Bonus. Enjoy my best copy-paste prompts, too.

[Ejaaz @cryptopunk7213]

well thats fucking it - anthropic has officially replaced software engineers. claude is now a 24 hr autonomous coding agent.

claude can now operate your entire computer and CLAUDE CODE = end-to-end software engineering:

- claude writes the code for you
- then literally opens the app it coded
- clicks through the entire app and find bugs
- then fixes the bugs and improves the app

in hours.

previously claude generated code, you run it and give claude feedback.

thats completely gone now.

all in a continuous loop without leaving your terminal 😂

we're barely through monday. well done lol

[OffSec @offsectraining]

The OSAI+ syllabus is finally here!

Every module includes hands-on labs designed to mirror how real AI systems are built, integrated, and attacked in production environments ⚔️

And if you haven't already heard: OSAI+ is available now in pre-sale, with an exclusive pre-release offer on our [Extended] Course & Certification Bundle. Get 120 days of course + lab access for the price of 90 for a limited time only. Offer ends March 30 when bundle returns to 90 days of access.

💸 Purchase through pre-sale: https://t.co/WHJOdMPSdb
🔍 Learn more: https://t.co/SRN3DaGaNi

[Griffin @aussinfosec]

I have been doing bug bounty since 2011 and ran a program for a multinational bank. Put everything I've learned into https://t.co/78z1JfSzmr. Target selection, recon pipelines, chain patterns, report templates, the business side. Free, no paywall, no course upsell.

[payloadartist @payloadartist]

This is huge for iOS pentesting and #bugbounty hunting.

You no longer need iPhones with specific older versions for jb. Which was a major PITA.

[bugcrowd @Bugcrowd]

AI won't replace the human intuition needed to find bugs, but it will amplify the hackers who use it.

If you are new to this, start small with n8n to remove friction from your workflow.👇

[Tom Dörr @tom_doerr]

Captures Android network traffic without proxies or certificates

https://t.co/yapp5OoF1Z

[@levelsio @levelsio]

how to build a bootstrapped startup without funding:

1. pick a problem you personally have. if you don't use your own product daily, quit now

2. skip the pitch deck. open your code editor. ship something ugly in a weekend

3. charge money from day 1. free users give you nothing but support tickets

4. use boring tech. PHP, SQLite, vanilla JS. frameworks are a trap that mass waste your time

5. host on cheap VPS ($5-20/mo). not AWS. you don't need kubernetes for 1,000 users

6. do customer support yourself. it's the fastest product feedback loop that exists

7. automate everything you do more than twice. cron jobs > employees.

8. grow on Twitter/X by building in public. your journey IS the marketing

9. keep your burn rate near zero so you never need to raise. ramen profitable > series A

10. say no to investors, cofounders, and "advisors" who want equity for intros

i've been doing this for 10+ years now. no employees, no funding, no board meetings

the entire VC game is designed to make you think you need permission to start

you don't

[JS0N Haddix @Jhaddix]

Here's a freebie tip on building agents in any AI framework: Mindmap your agent flow.

Order of operations, tools, variables, file paths, backup workflows... all has to be documented in .md or prompts to make them repeatable and amazing.

[GREG ISENBERG @gregisenberg]

claude cowork crash course in 49 seconds for building out your ideas

[obscaries ❘ AppSec @obscaries]

Static JS analysis just got smarter.

jsluice is a Go-based tool that parses JavaScript using ASTs to extract endpoints, secrets, and interesting artifacts — no noisy regex scraping.

🔗source: https://t.co/7eyaQjt337

Perfect for bug bounty hunters who actually read JS instead of just grepping it. 🔎⚡

If you’re serious about client-side recon, this deserves a spot in your toolkit.

#BugBounty #AppSec #JavaScript #Recon

[Charlie Hills @charliejhills]

https://t.co/xWHcCs4TBj