Rezy Dev 🇳🇵

Security Researcher | HTB CPTS | Penetration Tester | Open To Work

[Rezy Dev 🇳🇵 @RezyDev]

Certified Hacker!! :D

[Rezy Dev 🇳🇵 @RezyDev]

@GhimireVeshraj @marriot @Hacker0x01 Sed they take almost months to reply. H1 mediation sucks.

[Rezy Dev 🇳🇵 @RezyDev]

@OreoB1scuit Very much yes. I have alot of reports pending with no reply and is killing motivation slightly.

[Rezy Dev 🇳🇵 @RezyDev]

@wanahmadqais007 🔥 thanks

[Rezy Dev 🇳🇵 @RezyDev]

:D

[Rezy Dev 🇳🇵 @RezyDev]

I have just completed the Attacking GraphQL module on HTB Academy!

Short yet perfect module. ;)

https://t.co/ndRaPxqHYo

#hackthebox @hackthebox_eu #webhacking

[Rezy Dev 🇳🇵 @RezyDev]

seems like using claude opus 4.6 is becoming new flex

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Rezy Dev 🇳🇵 @RezyDev]

@AlfinCodes For a single year, GoDaddy is pretty good with their first year discounts. For long term like 10 years, Cloudflare wins easy.

[Rezy Dev 🇳🇵 @RezyDev]

Quick tip for bug bounty hunters:

Use https://t.co/caxQhhxk4N to quickly extract interesting endpoints with a single click. It’s especially useful for finding API endpoints in large JavaScript files.

#BugBounty #BugBountyTips

[Rezy Dev 🇳🇵 @RezyDev]

@Ruturaj_04 Yes available in my github. Dm me I'll send you the link.

[Rezy Dev 🇳🇵 @RezyDev]

This hurts more than breakup😂

Wasn't quick enough!

#BugBounty #Duplicate

[Rezy Dev 🇳🇵 @RezyDev]

@SysTrack40 😭😭

[Rezy Dev 🇳🇵 @RezyDev]

@EvanKlein338226 I tried techniques like case manipulation of event handlers and null bytes. Mixing tricks made some payloads work. One simple XSS payload I found on Twitter months ago still bypasses the Cloudflare WAF. Surprisingly, it still works! Haha.

[Rezy Dev 🇳🇵 @RezyDev]

Just found a simple Cloudflare WAF bypass 👀

<img src=x onerror=alert()> → blocked by Cloudflare

<Img Src=OnXSS OnError=alert(document.domain)> → bypasses the WAF and triggers the alert.

#BugBounty #BugBountyTips #WAFBypass

[Rezy Dev 🇳🇵 @RezyDev]

If you haven't sent 200 modified requests, you haven't tested anything yet.

#BugBounty

[Rezy Dev 🇳🇵 @RezyDev]

Another fun web hacking challenge I made for @hackinghub_io

Chain and pwn. :)

Link:
https://t.co/7F83RNCNGZ

[Rezy Dev 🇳🇵 @RezyDev]

@leroibull @hackinghub_io Hello @leroibull.
I can give you a hint or narrow things for you. Stay at is_admin_username(...) function properly. You should be able to solve it.

[Rezy Dev 🇳🇵 @RezyDev]

I just published a new Web CTF challenge: SmallMart 🛒
It’s all about source code review → find the bug → exploit it.
Try it on @hackinghub_io: https://t.co/yDXX99bIpu

[Rezy Dev 🇳🇵 @RezyDev]

@DsokeyyV @tryhackme Hey @grok. How brutal reply was this to thm?