People think learning Claude takes days. It doesn't.
I wrote 17 free guides that teach it in hours:
Claude 101: https://t.co/QQDmzBAoH5
Claude Code: https://t.co/o782qegoKu
Claude Skills: https://t.co/RgQUCNMqzQ
Claude Connectors: https://t.co/cSPMBUNmRG
Claude for Excel: https://t.co/ZgmUFXd0Iw
How to Prompt: https://t.co/Sw2tg2PMMc
Claude Certificates: https://t.co/LyV7fegv4c
Claude for your team: https://t.co/NakViTGCAL
Stop Prompting Claude: https://t.co/45xPLDRB6Y
AI Slides (PPT in 2026): https://t.co/OY7cHDTV7l
Claude Design: https://t.co/FhlRSlH0aD
Set up Claude Cowork: https://t.co/4jygw4M1RO
Claude to sound like you: https://t.co/LyV7fegv4c
Stop writing like AI: https://t.co/JXKAVP6hdS
Claude as your computer: https://t.co/tQDrcs8drQ
Claude Cowork + Project: https://t.co/xU97EpdrEe
Stop hitting Claude limits: https://t.co/Yu24rPQafQ
___
1. Save this list for later (three dots, top right).
2. Share it with a friend by ♻️ reposting this image.
3. Subscribe to my free newsletter: https://t.co/psB7XxAv8w.
Instead of watching an hour of Netflix, watch this 2 hour hour Stanford lecture will teach you more about how LLMs like ChatGPT and Claude are built than most people working at top AI companies learn in their entire careers.
Instead of watching an hour of Netflix, watch this 2-hour Stanford lecture on AI careers. It will teach you more about winning in the AI race than all the AI content you’ve scrolled past this year.
IDOR (Insecure Direct Object Reference)
Impact: Users could access other users’ private data
Root Cause: Missing authorization check on API requests
PoC Insight:
By changing the user_id in an API request, attackers accessed data they didn’t own.
Lesson:
Never trust client-controlled IDs. Always validate ownership server-side.
#HackerOne #BugBounty #CyberSecurity #Pentesting
WAF bypass for XSS can be that simple, change the request method from GET to POST.
The WAF was blocking the single quote we needed for an XSS payload, We managed to bypass by simply changing the request method from GET to POST which bypassed the WAF
#BugBounty#XSS
RCE in tcp connection (rocketMQ protocol)
Everyone Hunt in HTTPS but you can get bug in TCP connection service.
1. Make a .bin file (request body)
2. Use ncat / socat / python for send the request
3. Use burp url for blind test
Join my BugBounty channel https://t.co/J6uPf8H57o
rep+ can scan captured JS files for hardcoded secrets like API keys, tokens, and private keys.
Sure, you can do this in the browser with your own regex, but rep+ ships with a bunch of solid patterns out of the box and we’re improving them to cut down false positives (Base64 lookalikes, etc.).
@jackfriks - looks like this Supabase token is anon, not a service key😅
I just shipped the JS Endpoint Extractor in rep+. It grabs endpoints from captured JS and shows them in a clean table (UI still needs work).
Next step is letting you fuzz them with different methods and maybe even extract possible params from the js code. Not ready yet, but I think this will be super useful.
Would love to hear your techniques so I can get inspired and build this the right way !