Dedsec

[Brute @BRuteLogic]

JWT Auth Bypass TestBed

https://t.co/qoYUYTxduT

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://t.co/ThMs09G3Hp

[GitHub Projects Community @GithubProjects]

Claude-Bughunter is a drop-in skill bundle that transforms Claude Code into a senior bug-hunting researcher and red-team operator with 51 skills and 15 commands.

- 574+ disclosed report patterns across 24 vulnerability classes
- Enterprise platform attack chains for M365, Okta, VMware, and VPN appliances
- 5-phase non-linear hunting workflow with critical-thinking framework
- Automated engagement-folder scaffolding and Burp MCP integration

Explore it here:
https://t.co/HtZMIaBNci

[TheOuts1derX @TheOuts1derX]

GitHub repos with reports/writeups for bug bounty hunters:

1. HackerOne Reports https://t.co/AFNt3oGGO0
2. Google VRP Writeups https://t.co/hkuwO1Yz6i
3. Facebook Bug Bounty Writeups https://t.co/H2AbmfHrRJ
4. Awesome Bugbounty Writeups https://t.co/8vrqvBWsh3
5. Daily Bugbounty Writeups https://t.co/82Bja7EERg

#BugBounty #BugBountyTips #Infosec #EthicalHacking #CyberSecurity

[Amr Elsagaei @amrelsagaei]

I built FoxHound, a Firefox extension that gives any AI agent full control over your browser.

I needed this while hunting. There are bugs the egent can not properly exploit without using the browser. Clicking things, reading the DOM, replaying requests, checking cookies across containers, running JS on the page. So i built it.

The agent can navigate tabs, click elements, fill and submit forms, upload files, take screenshots, capture all HTTP traffic with full request and response bodies, replay and modify requests, read and write cookies and storage, intercept live requests, hook into postMessage traffic, WebSocket connections, route changes, console output, service workers, and more.

It also uses PwnFox containers so the agent knows which container each request came from. If you are doing multi account testing, everything stays separated.

Setup takes 2 minutes:
1. Install the extension: https://t.co/zp0L5sonlL
2. Run: npm install -g foxhound-mcp
3. Copy the config from the extension options page into your MCP client. Done.

It is free. Give it a try and if you find any issues or want to add anything, open an issue on the GitHub: https://t.co/XtmZfbZzcU

[obscaries ❘ AppSec @obscaries]

🚨 GitMiner3

Stop manually digging GitHub for secrets.

🔎 Automated dorking + secret scanning
🔑 Finds API keys, tokens, creds in public repos
📊 Clean reports for quick triage

🔗 https://t.co/l5SsXcPPOo

#BugBounty #Recon #Infosec #Pentesting

[0xMarioNawfal @RoundtableSpace]

YOUR AI AGENT CAN FINALLY SCRAPE WEBSITES WITHOUT GETTING BLOCKED

- Zero bot detection
- Bypasses Cloudflare naturally
- 774 times faster than BeautifulSoup
- No need for selector maintenance

GitHub: https://t.co/4REiEjgaed

[Es Geeks @EsGeeks]

Drift 🕵️‍♂️ 🧪 ⚙️: tu copiloto de seguridad con IA para Caido. Integra Claude Code, Gemini, Copilot y Codex en local y sin API keys. Analiza peticiones, genera planes de test y crea hallazgos usando 18 herramientas MCP. ¡Todo queda en tu entorno!

💥🛠️🔓🛡️ #ethicalhacking #pentest #ai #caido #ciberseguridad

[obscaries ❘ AppSec @obscaries]

🚀 Useful tool for bug bounty hunters

👉 https://t.co/m3xwPFfysi

headi = automated HTTP header injection tool

Great for spotting hidden backend trust issues 🔥

#bugbounty #pentesting #infosec #websecurity

[Tom Dörr @tom_doerr]

All-in-one automated web recon tool

https://t.co/Uc7IzqCFwi

[Jacob Krell @hackerfren]

The review for the Hack the Box AI Red Team course and associated Certified Offensive AI Expert (COAE) certification is now live:

https://t.co/M3gjDPdpgI

Hack The Box Academy's AI Red Teamer Job Role Path and its associated HTB Certified Offensive AI Expert (COAE) certification together form the most comprehensive machine-learning-focused offensive AI security training package available today. Developed in collaboration with Google and aligned with Google's Secure AI Framework (SAIF), the complete package takes learners from foundational AI/ML concepts through advanced adversarial techniques and validates those skills with a demanding 7-day practical exam. The course spans 12 modules covering the full spectrum of AI attack surfaces: prompt injection, model privacy attacks, adversarial evasion, supply chain risks, and deployment-level vulnerabilities. The COAE exam then puts all of that knowledge to the test in a simulated corporate AI environment, requiring a commercial-grade report as the final deliverable.

Overall, I thought the complete package was excellent. This is the first certification I have taken that incorporates high-level mathematics, and working through the course and then applying it under exam conditions genuinely transformed the way I think in a systematic way. Concepts like gradient descent, norm constraints, and adversarial perturbation theory are not the kind of material you encounter in traditional offensive security certifications, and engaging with them here gave me a fundamentally deeper understanding of how these systems work. My grasp of machine learning and AI is significantly greater than it was going in, at both the academic level (understanding the math and theory behind models) and the operational level (knowing how to exploit and assess real-world AI systems). If you are a security professional looking to develop genuine competency in AI red teaming rather than surface-level familiarity, this is the training and certification I would recommend.

[Tom Dörr @tom_doerr]

Interactive codebase knowledge graphs

https://t.co/rTSuMR94Ho

[Vox @Voxyz_ai]

just checked github trending, the #1 repo this week is a CLAUDE.md file. 44,465 new stars this week.

a skill distilling Andrej Karpathy's LLM coding pitfalls into 4 principles:

→ think before coding: ask when unsure, don't silently pick one interpretation and run with it
→ simplicity first: minimum code, any overengineering shows at a glance
→ surgical edits: only touch what's required, don't fix up neighboring code on the way by
→ goal-driven: translate fuzzy instructions into verifiable targets before starting

swapped it into my claude.md, a few tasks in it feels tighter. repo below 👇

[Tom Dörr @tom_doerr]

Collection of cheatsheets, hacks and CLI tools

https://t.co/MJEqsrSegM

[Allen Braden @allen_explains]

1 hour. That’s all it takes.

This full Claude AI course shows you how to build and automate like a pro.

Save it for the weekend.