z1

z1

[Tom Dörr @tom_doerr]

Reverse engineers Android APKs using LLMs

https://t.co/jFQPEXurgA

[striga @striga_ai]

PoCs for Apache Tomcat Unauth RCE (CVE-2026-34486) and Apache httpd Pre-auth RCE (CVE-2026-23918) are now public on our Github.

Tomcat exploit is fully reliable. httpd chain works in a controlled lab setup with a known info leak.

https://t.co/D3dg5iTuwP
https://t.co/2zyr1ds4Mo

[Tom Dörr @tom_doerr]

Collection of GPT jailbreaks, prompt injections, and super prompts

https://t.co/AH5rGYIbGO

[Vivek | Cybersecurity @VivekIntel]

AWESOME OSINT ARSENAL
The Ultimate Open-Source Intelligence Toolkit 💀🔥

1100+ OSINT tools • 50+ categories • Massive curated recon ecosystem

Built for:
🕵️ OSINT Investigators
🔴 Red Teamers
🛡️ Threat Intelligence Analysts
📡 Recon Specialists
🎯 Bug Bounty Hunters

Includes:
✔ Username & social media OSINT
✔ Email & breach intelligence
✔ Domain/IP reconnaissance
✔ Dark web investigation tools
✔ Image, video & geolocation OSINT
✔ Threat intel & people search
✔ Web recon & scanning tools
✔ Privacy & anonymity utilities

https://t.co/o7S8xeiBfX

#OSINT #ThreatIntelligence #CyberSecurity #DFIR #RedTeam #Recon

[Tom Dörr @tom_doerr]

Turns Claude into a specialized reconnaissance operator

https://t.co/8HknvW6sTm

[曾哥 @AabyssZG]

HashDump-BypassEDR：https://t.co/oa8qQcuUd1
通过系统白程序 Reg.exe 的拓展应用，巧妙绕过EDR的拦截点，实现绕过EDR从而DumpHash😈
该方法针对Windows系列均有效，操作难度不大，具有实战价值🥳
本项目实战文章：https://t.co/IcjVWYtjBY
源代码和Release已发布，师傅们麻烦点个Star，万分感谢！😍

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Claude Code with agent, autonomously hacked Subway Surfers, and printed millions of coins.

A rooted Android phone... and it turned Subway Surfers into a money printer.

From 4 coins to 2,000,000+ coins in two runs. autonomous loop, analyzed, and pwned a Unity game in one session, intercepts traffic, bypasses SSL pinning, and even reverse-engineers offline games.

The full Setup: Rooted emulator via rootAVD + Magisk + AlwaysTrustUserCerts.

Toolchain: UI Automator, mitmproxy traffic capture, Frida bypass scripts, APK static analysis.

The agent loops by itself:
- Dump screen & UI elements
- Tap/swipe via ADB
- Analyze traffic or binary
- Decide next move without a human.

It played the game, reverse-engineered the Unity IL2CPP binary, hooked Frida on SafeInt anti-cheat, and silently multiplied currency.

Subway Surfers (com.kiloo.subwaysurf) Almost zero network traffic to agent pivots.
Detects Unity IL2CPP parses global-metadata.dat
Finds WalletModel, RunSessionData, AddCoins, and SetCurrencySilently.

Then hooks with Frida and multiplies rewards ×100+.
Result: 4 coins to over 2 million.
SafeInt anti-cheat? Bypassed Stealth mode

This is the future of mobile pentesting?

credit via: @skshadan_

- https://t.co/TtQX9szWjH

[歸藏(guizang.ai) @op7418]

厌倦了千篇一律的衬线字体和排版？

歸藏的 PPT Skill 新主题预告

[z1 @vcantry]

@KELMAND1 @grok 验证下真实性，以及来源的真实性

[Panos Gkatziroulis 🦄 @ipurple]

PolyEngine - an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques. https://t.co/yvrgPeQt0q

[GitHub Projects Community @GithubProjects]

Add production-grade memory with hybrid search to any AI Agent.

[Nicolas Krassas @Dinosn]

SilentNimvest: Nim implementation for sud0Ru's Credential Dumping from SAM/SECURITY Hives Method (a.k.a. SilentHarvest) https://t.co/7GxTVxda0Z

[Dark Web Informer @DarkWebInformer]

TLDSweep: A domain intelligence OSINT tool that sweeps 800+ TLDs to find registered variants of a domain, flag newly registered lookalikes, and alert via Telegram and Discord.

GitHub: https://t.co/dC73yKedJM

[Chaofan Shou @Fried_rice]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G

[Panos Gkatziroulis 🦄 @ipurple]

apimspray - a specialized Entra ID Passwordspraying Toolkit designed for authorized security research and Red Teaming. It utilizes Azure API Management (APIM) gateways as a distributed, rotating proxy layer for IP Rotating https://t.co/JWEgcJ8Unl

[Dark Web Informer @DarkWebInformer]

W3b0s1nt (WebOSINT) is a Python tool/script for passive Domain Intelligence gathering

GitHub: https://t.co/mgszkvloB5

[Nicolas Krassas @Dinosn]

DllSpy — map every input surface in a .NET assembly without running it (HTTP, SignalR, gRPC, WCF, Razor Pages, Azure Functions, OData, Blazor) https://t.co/wnvYwj5NMc

[Tom Dörr @tom_doerr]

Captures Android network traffic without proxies or certificates

https://t.co/yapp5OoF1Z

[Tom Dörr @tom_doerr]

GUI for Android app testing via ADB

https://t.co/f2m4cduPrJ

[Noise @liangwenhao3]

#AI FastMovieAI 是一个功能完整的开源短剧/短视频创作平台，采用前后端分离架构，提供 AI 驱动的视频内容创作能力,适合内容创作者和视频制作团队使用。
https://t.co/xUzhzSUK28