BlockChain

Learning Cybersecurity and AI.

[Burp Suite @Burp_Suite]

Introducing Burp AT.

Agentic AI for human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills.

Now live in public beta for Burp Suite Professional users.

https://t.co/VMWhsBRIDk

[Gareth Heyes \u2028 @garethheyes]

Bypass CSP in a single click using my new Custom Action, powered by @renniepak's excellent CSP bypass project.

[Burp Suite @Burp_Suite]

Hidden parameters are not hidden anymore!

Burp AI can review the context of the endpoint and generate a wordlist of likely parameters to check with intruder.

No guessing. No luck. No search. Just AI-powered goodness.

[Intigriti @intigriti]

JS files are a goldmine for bug bounty hunters! 🤑

But are you also struggling with reading & understanding JS files? 😓

Check out our detailed article that forms a complete guide on what to look for in JS files when testing targets!

https://t.co/iIVwfk3itM

[elvis @omarsar0]

Reasoning LLMs Guide

Here is my practical guide to building with Reasoning LLMs.

Lots of dev tips in it.

It covers:

- What are Reasoning LLMs?
- Top Reasoning Models
- Reasoning Model Design Patterns & Use Cases
- Reasoning LLM Usage Tips
- Limitations with Reasoning Models

[Wiz @wiz_io]

🔍IT'S HERE: #ExfilCola, our cloud IR security CTF challenge!🥤

Your mission:
- Investigate the cloud environment logs
- Research the compromised machines
- Secure the files and save the day

⏰ The Cloud Hunting Games are live >> https://t.co/MaTZeY0DpM

[Aditya Shah @AdityaD_Shah]

🚨Massive changes to the health insurance space

Finally, insurers move to comply with IRDAI guidelines to provide health insurance for all medical conditions,

Niva Bupa makes massive changes to its underwriting guidelines,
Niva will now accept patients with
🩺Coronary Artery Disease
🩺Congenital heart disease
🩺 Crohn's and Ulcerative colitis
🩺Chronic Pancrieatis
🩺Hepititis B
🩺Rhemeutoid Arhtitis
🩺Alzeimiers diseases
🩺Pakinsons disease
🩺Posaris
🩺Cancer patients(only in super top up)
All these medical conditions will come with a permanent exclusion(not covered permanently)

Customers can get a comprehensive policy i.e. Reasure 2,0 also with permanent exclusion.

This is a massive change in the health insurance industry,
Opens up the gates for people who did not get a health insurance policy

All other insurers will now be forced to take these risks on with permanent exclusions!

Top move by Niva Bupa,
Will expand the health insurance coverage

[C. Vivek Lal @CVivekLaL]

The modern Western lifestyle is destroying your gut.

Your gut is the control center influencing your mood, immunity, weight, and even lifespan.

After 15 years of researching the gut & microbiome, here's how your gut works, what’s damaging it, and how to fix it: 🧵

[Intigriti @intigriti]

Want to master 2FA bypassing? 🤑

Let's look at several possible ways to bypass this 2FA screen! 👇

[Intigriti @intigriti]

Do you want to master authentication bypasses? 🤑

Open this thread! 🧵👇

[Akshay 🚀 @akshay_pachaar]

What is Tool calling with LLMs ?

Take a look at this code👇
.
.
Just like a ​RAG systems​ an LLM often need to invoke external tools or APIs to fetch a relevant context to answer the user query.

This is known as tool calling, where the LLM acts as a natural language interface between you and APIs, such a weather API, providing real-time match scores, or running a piece of code to get an answer.

The process is as follows:

• Identify if a task requires external assistance.
• Invoke the appropriate tool or API
• Use the tool's output to generate final response

The code below depicts a stock price retrieval assistant that combines the natural language capabilities of an LLM with the real-time data retrieval capabilities of the yfinance library.

• Define the set of tools.
• Prompt the LLM and specify the tools it can access.
• Invoke the functions.

Simple, isn't it?

This demo shows how tool calling can make LLMs more flexible and capable of addressing diverse user needs.

I hope you enjoyed this simplified explanation of a powerful concept! I'll share the link to the code in the next tweet.
____
Find me → @akshay_pachaar ✔️
For more insights and tutorials on AI and Machine Learning.

[Intigriti @intigriti]

Ever wanted to automate SSRF vulnerabilities? 🤑

autoSSRF is a context-based SSRF vulnerability scanner that can identify whitelisted hosts and generate advanced bypasses based on the enumerated results!

autoSSRF is open-source and available on Github!
https://t.co/he5pe4sS5B

[anand mahindra @anandmahindra]

This clip went viral a while ago.

An American vlogger discovers a Ph.D candidate running a food stall, part-time.

What struck me as truly special, however, was the end, when he picks up his phone & the vlogger thinks he’s going to show him social media mentions of his stall—but instead, he proudly shows him online the research papers he has authored!

Incredible. Unique. Indian.

[𝕏 Bug Bounty Writeups ��� @bountywriteups]

🔰 Attack Surface Tools 🔰

[Intigriti @intigriti]

You're missing out on a lot of bounties if you're not testing your targets for CSRF vulnerabilities...

Read our latest article that goes in-depth about CSRF vulnerabilities featuring 5 exploitation methods (including advanced cases)! 🤑

Check it out! 👇
https://t.co/q2edxEGd2H

[Mandiant (part of Google Cloud) @Mandiant]

🚨 #Mandiant flagged a vulnerability in #MicrosoftAzure Kubernetes Services to Microsoft via MSRC.

This flaw, which has been addressed, could have allowed for privilege escalation for services used by a vulnerable cluster.

Get the full details → https://t.co/ghib8uSzWu

[Intigriti @intigriti]

If you're not looking for misconfigurations in your targets...

You're probably missing out on a lot of bounties! 🤑

Misconfig Mapper is a tool to help you automate security misconfigurations at scale! And it even supports custom templates! 🤠

👇
https://t.co/5ZIpY79lPS

[Intigriti @intigriti]

Ever came across a scenario where your request header's value got reflected but you weren't able to escalate it to a reflected XSS? 🧐

💡 Try to use the transform the header name to a query parameter to escalate your XSS!

Example 👇