Salman Khan

Pakistan 🇵🇰 Zindabad. The Indus Valley civilisation is here to stay 🔥
Cybersecurity researcher.

[Strategic Warfare @WarUpdatespp]

Not for sale,Not under pressure,A nation chose dignity, sovereignty & strength over every offer!🔥

[Mohsin Ali @Mohsin_o2]

The Serbian president has confirmed that the CM-400 destroyed Indian S-400 radar component last year.

[XHack @xhackio]

Supercharge Your Security Arsenal

XHack pairs a senior human red team with autonomous AI agents that hunt vulnerabilities across web, infrastructure, APIs, and mobile apps. One platform — every attack surface, every audience.

XHack for everyone.

[Salman Khan @salmanite]

Saar saaar saaar India very powephull😂😂😂😂😂😂😂

[The Times Of India @timesofindia]

#Gujarat | A shocking case has come to light from Morbi, where a man allegedly allowed his landlord and a relative of the landlord to repeatedly rape his wife and 13-year-old daughter, as he could not pay his rent.

More details 🔗https://t.co/UzwhFflVaz

[Steel Sentinels @OgAugmenter]

Archive footage of an IAF Su-7 Fitter being engaged and subsequently destroyed by Pakistani Anti-Aircraft Artillery (AAA)

[Salman Khan @salmanite]

#NewProfilePic

[Salman Khan @salmanite]

@Mohsin_o2 😂😂😂😂😂😂

[Salman Khan @salmanite]

@yeswehack Solved.

[YesWeHack ⠵ @yeswehack]

New Dojo #CTF Challenge: Deadbolt is now live! 🚩

Can you generate a license key and get a RCE on the application?

Jump in and capture the flag 👉 https://t.co/P1Cx2Mt0eN

#BugBounty

[XHack @xhackio]

🚨 FBI & Indonesia Take Down $20M Phishing Empire

A major phishing-as-a-service operation using the 'W3LL' toolkit has been dismantled. This off-the-shelf platform made it easy for criminals to launch credential-stealing campaigns, attempting to defraud victims of over $20 million.

This takedown highlights the professionalization of cybercrime. Attackers no longer need deep technical skills; they can rent sophisticated toolkits. For defenders, this means phishing remains a top initial access vector, and user awareness training is more critical than ever.

How does your organization test its resilience against credential phishing campaigns?

https://t.co/oLCN2mH5Kh

#threatintel #cybersecurity #infosec

[Salman Khan @salmanite]

@Callsign_Ciphar Most of the Pakistanis have stealers installed in their computers.

They don’t have proper awareness what to download and what not to download.

On the web side, no regulations. @pakcert should make Vulnerability assessment mandatory for any company holding Pakistani data.

[Salman Khan @salmanite]

@dooomlet Yep,
Said the same for Rafales as well.

“Agar rafale hota”

But what happened?
8-0 🤣😂

[Salman Khan @salmanite]

@timesofindia _|_
🤣

[Salman Khan @salmanite]

@SofiyanKoznava @GabbbarSingh Social media saaar 🪳
😂😂😂🤣🤣🤣🤣🤣😂😂😂🤣🤣
https://t.co/777lkRtdO3

[Kashmir Urdu | کشمیر اردو @KashmirUrdu]

🚨 آپ سب کو یہ دن تو یاد ہوگا؟

[Daniel Zahoor @DanielZahoor]

To all my new followers:

We have archived the satellite imagery of the strikes on Indian bases and military infrastructure.

Link in bio. Go to the " Op: Bunyan-Un-Marsoos" to get all images.

We also have the live map locations of the areas where their jets were shot down.

[Salman Khan @salmanite]

@soor2003aj @Griezmenace Wse to mai 🪳ko reply nhi deta lakin tumhe dedeta hu..

I admit that India targeted inside Pakistan, but did you know what Pakistan did after that? Maybe due to sensorship, you aren't aware or maybe in delusions, but let me show you some visuals before you call it AI.

[ℭ𝔥𝔯𝔦𝔰𝔱𝔬𝔭𝔥 𝔚𝔞𝔤𝔫𝔢𝔯-𝔏𝔦𝔢𝔟𝔥𝔞𝔟𝔢𝔯 @wagn36507]

Deutsche Ritterlichkeit im Luftkrieg 1943 ✠🕊️

Franz Stigler hat die zerfetzte B-17 im Fadenkreuz.
Ein Schuss würde genügen.
Doch er sieht die Verwundeten durch den Rumpf – und kann nicht abdrücken.
Stattdessen eskortiert er den „Feind“ in Sicherheit und salutiert. 🛩️🫡

[XHack @xhackio]

🔍 The Art of IDOR Discovery

Invisible Direct Object Reference (IDOR) vulnerabilities are gold mines in bug bounty programs. They often hide in plain sight because developers assume sequential IDs are secure.

Instead of just incrementing IDs, try these techniques:

✅ Parameter pollution: /api/user?id=123&user_id=456
✅ JSON manipulation: {"userId": 123, "id": 456}
✅ UUID prediction: analyze patterns in existing UUIDs
✅ Mass assignment: /api/user/123?admin=true
✅ HTTP method swapping: POST vs PUT vs PATCH

Most scanners miss these variations. Manual testing with Burp Suite's Intruder using wordlists of common parameter names (uid, user, account, profile) can reveal hidden endpoints.

What's your favorite IDOR hunting technique?

https://t.co/zhBrvAPRA2

#bugbounty #bugbountytips #cybersecurity #xhack