Roman

a web builder & defender 🕷️
proud to be pinoy 🇵🇭
appsec quarterback 🛡️

[Roman @securecodeninja]

I learned that the lack of proper input validation is where many of vulnerabilities start.

I condensed these lessons into a 30-min course for C# developers.

Free with your Pluralsight subscription 👇
https://t.co/dPnCI0ytBy

#csharp #security #dotnet #appsec #securecode

[Roman @securecodeninja]

Had a great time at the Pen Testing Village yesterday diving into secure code reviews in the CTF! #bluehat #securecode #appsec

[spaceraccoon | Eugene Lim @spaceraccoonsec]

You may have read @AnthropicAI Frontier Red Team's blogpost about finding zero-day vulnerabilities at scale. I think it's more than that - LLM workflows greatly improve "negative-day" and "never-day" discovery. Here's the tool I built to do this.

https://t.co/2U5VHOiBBD

[Claude @claudeai]

We just shipped automated security reviews in Claude Code. Catch vulnerabilities before they ship with two new features:

- /security-review slash command for ad-hoc security reviews
- GitHub Actions integration for automatic reviews on every PR

[spaceraccoon | Eugene Lim @spaceraccoonsec]

Wasting time fuzzing hardened code without hitting new vulnerabilities.

Legacy black-box fuzzers stall at validation checks, missing deeper bugs.

In Chapter 8 of my new book From Day Zero to Zero Day, you'll explore the advanced techniques behind coverage-guided fuzzing using AFL++, and how to remove fuzz blockers that halt progress.

Key lessons you’ll learn:
✅ Why code coverage feedback outperforms black-box fuzzing
✅ How to write your own fuzzing harness for optimized inputs
✅ Where AFL++ shines over older fuzzing tools
✅ What to patch in code to unlock deeper fuzzing
✅ How to use afl-cov and Fuzz Introspector for blind-spot analysis

Ready to level up your fuzzing stack? Grab your copy of From Day Zero to Zero Day today! (🔗 link in comments)

#BugBounty #Fuzzing #Cybersecurity #AFLplusplus #ApplicationSecurity

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

McDonald's uses an AI bot called "Olivia" for hiring. A pair of hackers found they could access every conversation job applicants had with it—including all the personal info they shared—by exploiting security flaws as basic as using the password "123456". https://t.co/55WueJz3Of

[Luke Jennings @jukelennings]

Oktajacking - Using Okta to keylog for initial access or as a sneaky form of SAMLjacking for lateral movement from a compromised SaaS app.

Massive shoutout to @_xpn_ as I used his great research for this, I just applied it to different kill chain phases.

https://t.co/7R5UzDbG6c

[Clint Gibler @clintgibler]

👔 Security Architect & Principal Security Engineer Interview Questions

A consolidated list of questions pulled from Glassdoor

From: Netflix, Morgan Stanley, Wiz, & more

* Technical
* Behavioral and Influential
* Frameworks/Design/Threat Modeling

https://t.co/gKg5ZpREXx

[Luke Jennings @jukelennings]

Just because you're using Okta, doesn't mean you're using SSO.

I wrote a blog post covering:

• What is SWA and what are the risks?
• Extracting SWA passwords
• Bypassing password reveal restrictions
• Detection and response for Okta account breaches

https://t.co/gJuytf85Ql

[Clint Gibler @clintgibler]

🛠️ Building a free Burp Collaborator with Cloudflare Workers

How to use Cloudflare Workers to receive out-of-band connections during your web app testing (e.g. track when blind XSS triggers) and pipe the results to Discord

https://t.co/CJoB4P5IkV

[Klaudia Kloc @KlaKlo_]

After the success of our security research, we decided to invest a $120k bounty and share our story and tools with you.

Now, we are releasing an Automated Scans feature on VIDOC, allowing you to easily automate your #bugbounty hunting on a large scale!

https://t.co/Ue5JKrVrdL

[Clint Gibler @clintgibler]

😈 The Offensive ML Playbook

A database of offensive ML TTPs covering:
* Supply chain attacks
* Offensive ML techniques
* Adversarial ML

Examples:
* Poisoning an LLM’s ground truths
* How to put malware in a model and distribute it

By @WHITEHACKSEC

https://t.co/eszzIi1uGp

[Aviad Carmel @AviadCarmel]

Just discovered a full account takeover on https://t.co/9dAKCEpkrV, https://t.co/3b6VWzGVsC and more using a new OAuth attack technique.

This is the last part of the OAuth trilogy; in total, we could take over 1+ BILLION accounts!

https://t.co/TRCljIp6iB

#OAuth #hacking

[Merill Fernando @merill]

What are HAR files?
A HAR file is a recording of your current session & includes all web traffic including secrets & tokens.

Admins usually share these files with customer support when troubleshooting issues.

Here's a thread on how you can handle .har files safely.

🧵⬇️

[Clint Gibler @clintgibler]

🎓 Free Cybersecurity Course from Harvard

An introduction to #cybersecurity for technical and non-technical audiences

Self-paced, 2-6 hours/week over 5 weeks

https://t.co/vtLVtzlqho

[Crash Override @crashappsec]

Chalk is now officially open source. Total visibility of your software engineering lifecycle. Designed for platform and security teams. https://t.co/HBadM0RW7m

[happydecoder @happydecoder]

𝗟𝗲𝗮𝗿𝗻 𝗝𝗪𝗧 𝗹𝗶𝗸𝗲 𝘆𝗼𝘂'𝗹𝗹 𝗻𝗲𝘃𝗲𝗿 𝗳𝗼𝗿𝗴𝗲𝘁.

🧵

[Roman @securecodeninja]

Now Generally Available: GitHub Advanced Security for Azure DevOps is ready for you to use https://t.co/WdiCvccphJ

[Clint Gibler @clintgibler]

🗒️ Source Code Management Platform Configuration Best Practices

Guide by @OpenSSF for securing SCM platforms

* Harden CI/CD pipelines against supply chain attacks
* Branch protection policies and access controls/permissions
* Server-level policies

https://t.co/j0Tkbzzp41

[Clint Gibler @clintgibler]

🤖 promptfoo

A tool for testing your prompts.

Evaluate and compare LLM outputs, catch regressions, and improve prompt quality.

https://t.co/wsoazuBBnk