Tox1c

17 y/o | wannabe hacker!👾 he/him

[Nebula Security @nebusecurity]

GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit.

Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected.

Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below

[Cyber Security News @The_Cyber_News]

First-Ever 1- Click Android 17 Exploit Allows Attackers to Gain Full Control Over Your Android Phone

Source: https://t.co/yBgdracx7J

A full-chain exploit dubbed "IonStack" demonstrates how a single malicious URL click can hand attackers complete control over an Android device.

The proof-of-concept, described as the world's first public Android 17 root demo, chains two zero-day vulnerabilities spanning Firefox and the Linux kernel to achieve remote code execution and privilege escalation without further user interaction.

The exploit chain works by first compromising the Firefox renderer process through the browser flaw, then pivoting to the underlying Linux kernel (which powers Android) to break out of sandbox restrictions entirely.

#cybersecuritynews #android

[Tox1c @th3tox1c]

My blue tick is here 😍

[Tox1c @th3tox1c]

I'm new to X.

Hey @X algorithm,

connect me with more tech people and security researchers.

I want my timeline full of people focused on Security Researching, CTFs and Bug Hunting.

If you’re into Tech, Cybersecurity, Bug Bounty or CTFs say hi.👋🏻 #CONNECT #BuildInPublic

[Tox1c @th3tox1c]

Congratulations to me for my 1 follower😭

[Tox1c @th3tox1c]

Just wrapped up the Cisco Ethical Hacker course. Its free and actually a pretty decent refresher for intermediate concepts. Good to check the fundamentals off the list
@LearningatCisco

[Tox1c @th3tox1c]

View my verified achievement from @learningatcisco. https://t.co/z7jKpIrVRy via @credly

[Tox1c @th3tox1c]

Which is more difficult: 5 million impressions or 500 premium followers?

[Tox1c @th3tox1c]

Hey @grok
I'm new here so tell me how long does this shadowban last?

Literally can't reply to any post every attempt fails and goes straight to drafts.

[Tox1c @th3tox1c]

I'm new to X.

Hey @X algorithm,

connect me with more tech people and security researchers.

I want my timeline full of people focused on Red Teaming, Penetration Testing and Bug Hunting.

If you’re into Tech, Cybersecurity, Bug Bounty or CTFs say hi.👋🏻 #CONNECT #BuildInPublic

[Tox1c @th3tox1c]

Tell me you know absolutely nothing about networking without telling me you know nothing about networking.

I'll go first: "bro leaked his ip."

[Tox1c @th3tox1c]

Finally my blue tick has arrived

First post as a blue tick

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Scrapling to scrape any website without getting blocked by Cloudflare.

You don't need to maintain selectors when websites update their structure.

- 774x faster than BeautifulSoup.
- Zero bot detection.
- Bypasses ALL Cloudflare protections natively

- https://t.co/XtktGrFOax

[Nicolas Krassas @Dinosn]

nebusec/cybermeowfia: PoCs and exploits for CVEs discovered by VEGA. https://t.co/tLeX6frSXt

[Vivek | Cybersecurity @VivekIntel]

🎯 Full Bug Bounty Hunting & Red Team Methodology 2026 — A Structured Recon Workflow

Full Bug Bounty Hunting & Red Team Methodology 2026 is an open-source knowledge repository that documents a structured workflow for web application reconnaissance and attack surface discovery. Rather than focusing on individual tools, the methodology emphasizes an intelligence-driven approach where each reconnaissance phase builds upon previous findings to progressively map an organization's infrastructure before conducting manual security testing. The guide covers the complete reconnaissance lifecycle, including passive and active subdomain enumeration, DNS brute forcing, ASN and CIDR infrastructure mapping, reverse DNS analysis, origin IP discovery, WAF-aware reconnaissance, virtual host enumeration, URL and endpoint collection, JavaScript analysis, secret discovery, directory enumeration, source code intelligence, technology fingerprinting, service discovery, automated vulnerability scanning, and subdomain takeover detection. Throughout the workflow, it demonstrates how to correlate outputs from multiple reconnaissance utilities, historical archives, certificate transparency logs, search engines, public datasets, and OSINT sources to improve visibility while reducing redundant effort. The repository also includes environment setup recommendations, curated wordlist references, API integrations, automation examples, and practical techniques for consolidating reconnaissance results into a comprehensive attack surface inventory. It serves as a practical reference for security professionals, bug bounty hunters, penetration testers, and learners seeking a repeatable methodology for authorized web application security assessments.

📌 Credit: @Cybernote9
🔗 https://t.co/JhkWif2Dzu

#CyberSecurity #BugBounty #Recon #OSINT #WebSecurity #PenetrationTesting #RedTeam #AttackSurface #EthicalHacking #ThreatIntelligence

[Nicolas Krassas @Dinosn]

cyber-note/full-bug-bounty-hunting-methodology-2026: How To approach recon on real targets — from passive enumeration to origin IP discovery. Covers tools, automation, and the logic behind each phase. https://t.co/e2R9OOOX88

[Dark Web Informer @DarkWebInformer]

💥 arsenal-ng: A Go-based pentest command launcher with 200+ cybersecurity cheat sheets built in.

Search commands, fill in arguments, and send them straight to your terminal instead of digging through notes every time.

GitHub: https://t.co/jgIzyHPVId

[Tox1c @th3tox1c]

Story of my life

[Tox1c @th3tox1c]

When a malicious site downloads an .exe file into your #Linux machine

[Tox1c @th3tox1c]

After Installing Kali Linux and running 'apt-get update' command: