abrahack

Bug Bounty Hunter | .
Synack Red Team Member @SynackRedTeam |

[abrahack @theabrahack]

My experience on @immunefi .
Has been worst BB experience in my career, the mediation team is practically non existent.
Walk with my through two reports,
The first report was traiged by @immunefi , the program close as OOS.
The program proceeded to remove the asset from scope.

[nopnop @__nopnop]

The written version of my BSides Riga and @bsidesvilnius talks is up: exploiting git integrations in cloud services, with four bugs I found in GCP (Looker, Dataform), including the one that won me MVH.
https://t.co/HuWlK5dnfj

[abrahack @theabrahack]

@nullenc0de Hello,
I'm interested in this.

[Manchester City @ManCity]

Ten years that will live forever.

Thank you for everything, Pep 🩵

[abrahack @theabrahack]

@NigeriaStories M.m

[ϻг_ϻε @steventseeley]

Literally every old school hacker out there dreamed of achieving a find like this: https://t.co/wvQ6WqBHoj

[Mike Myers @MikeMye11392187]

How Wordfence Paid Me $0 for a Critical Vulnerability Affecting 700K Websites https://t.co/yFHbpnLVku

[abrahack @theabrahack]

Up until this point there has been no comment or effort by @immunefi mediation team.
This is my official Public notice outrightly labeling the @immunefi program a SCAM.

[abrahack @theabrahack]

My experience on @immunefi .
Has been worst BB experience in my career, the mediation team is practically non existent.
Walk with my through two reports,
The first report was traiged by @immunefi , the program close as OOS.
The program proceeded to remove the asset from scope.

[abrahack @theabrahack]

My second report the program claimed they fixed the bug days before my report.
They provided a screenshot of the patch from their github.
Only problem my POC showed exploitation almost 24 hours since the "claimed" patch.
They closed the report as spam.

[castilho @castilho101]

Stealing Salesforce OAuth Tokens via the WAF: A write-up on SFRA context and escalating XSS to Account Takeover using the WAF as a gadget. Hope you enjoy it

https://t.co/vUNKbjUeWk

[The Hacker's Choice (@[email protected]) @hackerschoice]

THC Release 💥: The world’s largest IP<>Domain database: https://t.co/o4F8M1Pqi1

All forward and reverse IPs, all CNAMES and all subdomains of every domain. For free.

Updated monthly.

Try: curl https://t.co/5V2xLadmx5

Raw data (187GB): https://t.co/cBZOSAE89K

(The fine work of messede 👌)

[abrahack @theabrahack]

@DamilolaAbiona8 @sisinerd @SANSInstitute @cybersafehq Congratulations.

[Soufiane @S0ufi4n3]

CVE-2025-59287 - 9.8, WSUS Remote Code Execution
Write-up and PoC
https://t.co/LTUbmWoIH4

[sudi @sudhanshur705]

Found an RCE in Google Web Designer :)
Very similar to the CSS Injection to RCE found by Bálint Magyar.
https://t.co/BpOJ4sfvNx

[abrahack @theabrahack]

@Issam_Rabhi @yeswehack Hello @Issam_Rabhi , please could you send me a DM.
Would like to explore an opportunity with you.

[abrahack @theabrahack]

@Hack_All_Things Rest in peace Roy.

[abrahack @theabrahack]

@PortSwigger Here are my suggestions.
Intruder results panel)
1. Their should be an option to copy the payloads of highlighted results.
2. Results tab can be exported as a csv and you can select the columns.

[abrahack @theabrahack]

@PortSwigger Here are my suggestions.
Intruder results panel)
1. Their should be an option to copy the payloads of highlighted results.
2. Results tab can be exported as a csv and you can select the columns.

[abrahack @theabrahack]

In the big 2025, @PortSwigger burpsuites intruder is simply still shit.
The most simple stuff simply doesn't work, how does it make any sense, that there isn't an option to copy matched payloads in the result tab.
Like how do they regularly mess up the most basic stuff.

[abrahack @theabrahack]

@InsecureNature @LinusTech @JakeKing Hello Dylan, please could you DM me, I need your insight.