Olivia
Online
Siddharth Gupta
@web3_sidd
Building StreakKeeper in Public 🚀
Never Lose Your GitHub Streak
Joined August 2016
366 Following
191 Followers
1.3K Posts
Pinned Tweet
My appointment got scheduled accidentally, and now the portal shows:
“Maximum number of attempts exceeded for Reschedule/Cancel appointment.”
@passportsevamea @rpolucknow @MEAIndia @CPVIndia
🚨 BREAKING:
All 2,048 Bitcoin mnemonic seed words have just been leaked. You just have to put them in the right order.
Too early?
Most bug hunters stop at X-Forwarded-Host and wonder why their cache poisoning reports get $500.
Someone spent 6 months studying CDN architectures.
Here's what separates $500 reports from $10,000+ critical findings:
🧵👇
The wait is over...
Today, We're releasing VidRush to the public:
A swarm of AI video production agents that, over the last 6 months, has been responsible for over 100 million views. 🧵
Use code to skip waitlist → VIDRUSH
FREE MiniMax M3 + all models API key - 5B+ tokens still untouched 😳
7.6B already burned through this key, and theres 5B+ remaining
which model you get for 0$:
- MiniMax-M3 (frontier coding, 1M ctx, competes with Claude Sonnet)
- MiniMax-M2.7 / highspeed (general + turbo)
- MiniMax-VL-01 (vision-language)
- Hailuo 2.3 / 2.3Fast (video gen)
- speech-2.8-hd + turbo (TTS)
- Image-01 (image gen)
- Music-2.6 + Cover (music gen)
you would pay $330/mo for these capabilities separately
API Key:
sk-cp-hg3e9-_fthmb7xDCQultEPAVBYKgt9PPYqWbTKGNlr95p-IDcWfI8rlzNR71sIfDvQyX4EwrIPhQJSPBu9DtmZTQ58V9c7bp-4djS6uLy9Kf-FlXv-2A9F0
> use with any OpenAI-compatible client (base URL in reply)
> key is shared now grab it before the quota runs out
bookmark this and thank me later
how you can get $150+ worth ai credits for free
you can access glm 5.2, claude opus 4.6, 4.7, 4.8, chatgpt 5.5 with the api
you don't need to connect any card
> go to: https://t.co/CfG0npoNfD
- signup with github
- go to the api token section & create token
- copy the API key & use it anywhere as you wish
> what's the catch:
- we can't confirm that these are the official models
- there may be a distilled kimi model running behind & we can't even find it in first place
- don't use any sensitive information on the prompts
- so use these credits and don't touch this platform again
gpt k12和gpt plus已补货
有问题请联系客服处理~
https://t.co/smm8M6u6yN
fully uncensored Cybersecurity-specialized model tuned on exploits, pentesting and Run locally on MacBook, delivers expert-level offensive & defensive insights.
- Zero refusals
- Exploit writing
- vuln analysis
- Fully uncensored
- OWASP, and MITRE.
- fine-tuned deep on real security data
- 11 quants available from tiny Q2_K to full precision, Runs great on consumer hardware.
Runs 100% offline on your laptop no refusals.
Perfect for CTFs, bug bounties, blue/red teaming.
If you audit smart contracts, you already know @DeFiHackLabs. It's the most complete open library of exploit PoCs there is, and SunWeb3Sec has done the whole industry a service by maintaining it.
But a PoC is a starting point, not an explanation. To actually learn from one you have to:
➡ get the Foundry test compiling (solc version, EVM version, remappings)
➡ source an archive RPC for the correct chain and fork at the exact block
➡ reconstruct the attack from raw trace output
➡ cross-reference the trace against the test's Solidity
➡ pull the source of every downstream contract from Etherscan - the PoC ships the attacker's code, not the victim's.
We built https://t.co/vP9Yq3H6ca to collapse that into one page.
What you get per hack:
✅ Pre-written vulnerability analysis, with the root-cause line highlighted directly in the source.
✅ A live EVM playground (think in-browser debugger) that replays the exploit deterministically.
✅ Opcode-level stepping plus line-level Next / Prev / Step-in / Step-out; click an opcode to jump to its source line.
✅ Full call trace (execution tree) so you can see exactly what called what.
✅ EVM state at every step: memory, stack, and storage.
✅ Matched source for every executing contract in the call tree - fetched from Etherscan, compiled, and source-mapped, so you never leave the page.
✅ Any chain, no RPC needed - the execution is recorded, so there's nothing to set up and nothing to rot: no rate limits, no stale fork blocks, no version drift.
The analysis + build pipeline is fully open source: https://t.co/SrCRX81rNJ - issues and PRs welcome.
Explore 840+ hacks 👉 https://t.co/VeFfnrWdK7
#SmartContractAudit #Web3Security #DeFi #Solidity #EVM #Foundry #Blockchain
Free AI API credits & $4,000 right now
This is a limited-time offer, so you should create your accounts before it ends
1/ https://t.co/4uQXiHGjwU - claims $4,000 credit
Models: DeepSeek v4 flash, GLM-4.7
2/ https://t.co/W1e4juhslF - 100k credits (3-day window)
2,000+ open models, OpenAI-compatible
3/ https://t.co/beshLhjQEP - 3M credits on signup
Models: Sonnet 4.6, DeepSeek v4 pro
Also, If you want to use GPT-5.6 Sol, Terra, and Luna at the highest quality:
1. Go to: https://t.co/3p3Q5k7GUn
2. Sign up and select 'Agents' from the left-hand menu
3. Click: Create your first agent
Really like how they work on this service.
1/
One of my favorite bug bounty findings Mass assignment in Rails feature that lets you initialize database and esc priv to admin TestCenterAdmin records using a hash of parameters, like https://t.co/hyCQfFaEA5(params[:user]). While highly convenient, it can lead to severe security vulnerabilities if untrusted form data updates sensitive model attributes (like admin or account_balance)
It started with one question:
“What can a newly registered organization actually do before it’s approved?”
And that question broke the entire trust model.
🧵
2/
The application had a straightforward onboarding workflow:
Register → Upload documents → Wait for approval → Become operational
Pretty standard.
At least, that’s what the UI wanted me to believe.
3/
I registered a brand-new organization using my own controlled email and completed the normal password setup.
After logging in, something immediately caught my attention.
My account had already been assigned a legitimate:
TestCenterAdmin
No JWT tampering.
No forged session.
No role injection.
The application gave it to me.
4/
At the same time, the organization itself was still marked:
pending
That single inconsistency became the entire investigation.
The database said:
“We don’t trust this organization yet.”
The authorization layer said:
“Welcome, administrator.”
Beautiful.
5/
Most people would test whether they could inject an admin role:
{ "role": "TestCenterAdmin" }
I didn’t need to.
The role was real.
The session was real.
The only thing missing was approval.
So the real question became:
Does the backend check the role only, or does it also check the organization’s business state?
6/
While mapping the application, I reached the branch-creation feature.
Then I saw this request structure:
center_branch_admins_attributes[][first_name] center_branch_admins_attributes[][last_name] center_branch_admins_attributes[][email]
The Rails smell was immediate.
Nested attributes.
7/
In Ruby on Rails, request parameters like:
something_attributes[][field]
often indicate a relationship handled through:
accepts_nested_attributes_for
Meaning one request may create the parent object and its associated child records together.
In this case:
Create branch + Create branch administrator
One request. Multiple database objects.
8/
Conceptually, the backend could resemble:
class CenterBranch < ApplicationRecord has_many :center_branch_admins accepts_nested_attributes_for :center_branch_admins end
With permitted parameters similar to:
params.require(:center_branch).permit( :name, :iban, center_branch_admins_attributes: [ :first_name, :last_name, :email ] )
Very Rails.
Very convenient.
And very interesting from a security perspective.
9/
Whenever I see nested [] parameters in Rails, I immediately think about mass assignment:
Can I inject an ID? Can I assign a foreign user? Can I modify the role? Can I set approval status? Can I overwrite protected attributes?
So naturally, I tested the surrounding parameter boundary.
Not randomly.
Surgically.
10/
I tried variations involving protected fields, approval state, foreign identifiers, and nested administrator attributes.
Most of them were rejected or ignored.
So this wasn’t the classic:
“Add role=admin and become root.”
Strong Parameters appeared to be filtering the obvious mass-assignment attacks correctly.
But that didn’t make the flow secure.
11/
The dangerous part was what the application already allowed through the legitimate parameter set.
I submitted the normal branch-creation request while the parent organization was still pending.
No hidden parameter.
No parser trick.
No exploit-looking payload.
Just the intended form.
The server accepted it.
12/
The application created:
A new child branch + A nested branch-administrator record
under an organization that had never been approved.
That’s where the Rails nested attributes became the perfect enabler.
The application wasn’t just creating business data.
It was creating a new identity.
13/
Then I activated the nested administrator through the standard password workflow:
Request password reset → Receive controlled email → Verify token → Set password → Log in
Login succeeded.
The account returned a legitimate role:
CenterBranchAdmin
So this wasn’t some dead record sitting in the database.
It was a real administrator account.
14/
At that point, the chain looked like this:
Public registration → Pending organization → Legitimate TestCenterAdmin → Rails nested branch creation → Legitimate CenterBranchAdmin → Protected authenticated access
The organization was still pending throughout the process.
Approval had become decoration.
15/
This is why calling the issue only “mass assignment” would be incomplete.
The nested *_attributes[] structure looked like the entry point.
But the deeper vulnerability was missing business-state authorization.
The application appeared to ask:
user.test_center_admin?
Instead of:
user.test_center_admin? && user.test_center.approved?
One missing condition.
A complete trust-boundary failure.
16/
Strong Parameters can answer:
“Which attributes may this request assign?”
They cannot answer:
“Should this pending organization be allowed to perform this operation at all?”
That is not a parameter-filtering problem.
That is an authorization and business-logic problem.
And those are usually much more fun.
17/
The best part?
I never needed to force the application into an impossible state.
I simply connected two states that the developers assumed would never exist together:
Valid administrator role + Pending organization
Both values were legitimate.
Their combination was not.
18/
During one creation attempt, the server returned:
HTTP 529
It looked like failure.
But I checked the state afterward.
The branch existed.
The administrator existed.
The transaction had already committed.
The API said “error.”
The database said “done.”
Always verify state after a 5xx.
19/
I also tested the deletion boundary.
The newly created CenterBranchAdmin could not delete the branch.
Correctly denied.
The parent TestCenterAdmin could delete its own controlled branch.
A foreign controlled organization could not.
So no, this was not arbitrary branch deletion or a cross-tenant IDOR.
I don’t need to exaggerate impact when the real bug is already clean.
20/
The proven impact was:
• Create branches before approval • Provision real administrator identities • Activate those identities normally • Authenticate as those administrators • Access protected branch resources • Manage owned branch structure while pending
All before the organization passed review.
21/
This finding is a perfect example of why I don’t only hunt payloads.
Payloads are easy to screenshot.
Broken assumptions are where the serious bugs live.
Especially around:
pending invited suspended disabled unverified under review
Every role should be tested in every lifecycle state.
22/
The takeaway:
A valid role does not mean the user is in a valid business state.
And when I see Rails parameters shaped like:
model_attributes[][field]
I don’t just ask what I can mass assign.
I ask what objects, identities, and permissions the framework will quietly create for me.
Sometimes the most powerful payload is not SQL, JavaScript, or Ruby.
Sometimes it’s simply:
status = pending
:)
#BugBounty #RubyOnRails
![phisher305's tweet photo. 1/
One of my favorite bug bounty findings Mass assignment in Rails feature that lets you initialize database and esc priv to admin TestCenterAdmin records using a hash of parameters, like https://t.co/hyCQfFaEA5(params[:user]). While highly convenient, it can lead to severe security vulnerabilities if untrusted form data updates sensitive model attributes (like admin or account_balance)
It started with one question:
“What can a newly registered organization actually do before it’s approved?”
And that question broke the entire trust model.
🧵
2/
The application had a straightforward onboarding workflow:
Register → Upload documents → Wait for approval → Become operational
Pretty standard.
At least, that’s what the UI wanted me to believe.
3/
I registered a brand-new organization using my own controlled email and completed the normal password setup.
After logging in, something immediately caught my attention.
My account had already been assigned a legitimate:
TestCenterAdmin
No JWT tampering.
No forged session.
No role injection.
The application gave it to me.
4/
At the same time, the organization itself was still marked:
pending
That single inconsistency became the entire investigation.
The database said:
“We don’t trust this organization yet.”
The authorization layer said:
“Welcome, administrator.”
Beautiful.
5/
Most people would test whether they could inject an admin role:
{ "role": "TestCenterAdmin" }
I didn’t need to.
The role was real.
The session was real.
The only thing missing was approval.
So the real question became:
Does the backend check the role only, or does it also check the organization’s business state?
6/
While mapping the application, I reached the branch-creation feature.
Then I saw this request structure:
center_branch_admins_attributes[][first_name] center_branch_admins_attributes[][last_name] center_branch_admins_attributes[][email]
The Rails smell was immediate.
Nested attributes.
7/
In Ruby on Rails, request parameters like:
something_attributes[][field]
often indicate a relationship handled through:
accepts_nested_attributes_for
Meaning one request may create the parent object and its associated child records together.
In this case:
Create branch + Create branch administrator
One request. Multiple database objects.
8/
Conceptually, the backend could resemble:
class CenterBranch < ApplicationRecord has_many :center_branch_admins accepts_nested_attributes_for :center_branch_admins end
With permitted parameters similar to:
params.require(:center_branch).permit( :name, :iban, center_branch_admins_attributes: [ :first_name, :last_name, :email ] )
Very Rails.
Very convenient.
And very interesting from a security perspective.
9/
Whenever I see nested [] parameters in Rails, I immediately think about mass assignment:
Can I inject an ID? Can I assign a foreign user? Can I modify the role? Can I set approval status? Can I overwrite protected attributes?
So naturally, I tested the surrounding parameter boundary.
Not randomly.
Surgically.
10/
I tried variations involving protected fields, approval state, foreign identifiers, and nested administrator attributes.
Most of them were rejected or ignored.
So this wasn’t the classic:
“Add role=admin and become root.”
Strong Parameters appeared to be filtering the obvious mass-assignment attacks correctly.
But that didn’t make the flow secure.
11/
The dangerous part was what the application already allowed through the legitimate parameter set.
I submitted the normal branch-creation request while the parent organization was still pending.
No hidden parameter.
No parser trick.
No exploit-looking payload.
Just the intended form.
The server accepted it.
12/
The application created:
A new child branch + A nested branch-administrator record
under an organization that had never been approved.
That’s where the Rails nested attributes became the perfect enabler.
The application wasn’t just creating business data.
It was creating a new identity.
13/
Then I activated the nested administrator through the standard password workflow:
Request password reset → Receive controlled email → Verify token → Set password → Log in
Login succeeded.
The account returned a legitimate role:
CenterBranchAdmin
So this wasn’t some dead record sitting in the database.
It was a real administrator account.
14/
At that point, the chain looked like this:
Public registration → Pending organization → Legitimate TestCenterAdmin → Rails nested branch creation → Legitimate CenterBranchAdmin → Protected authenticated access
The organization was still pending throughout the process.
Approval had become decoration.
15/
This is why calling the issue only “mass assignment” would be incomplete.
The nested *_attributes[] structure looked like the entry point.
But the deeper vulnerability was missing business-state authorization.
The application appeared to ask:
user.test_center_admin?
Instead of:
user.test_center_admin? && user.test_center.approved?
One missing condition.
A complete trust-boundary failure.
16/
Strong Parameters can answer:
“Which attributes may this request assign?”
They cannot answer:
“Should this pending organization be allowed to perform this operation at all?”
That is not a parameter-filtering problem.
That is an authorization and business-logic problem.
And those are usually much more fun.
17/
The best part?
I never needed to force the application into an impossible state.
I simply connected two states that the developers assumed would never exist together:
Valid administrator role + Pending organization
Both values were legitimate.
Their combination was not.
18/
During one creation attempt, the server returned:
HTTP 529
It looked like failure.
But I checked the state afterward.
The branch existed.
The administrator existed.
The transaction had already committed.
The API said “error.”
The database said “done.”
Always verify state after a 5xx.
19/
I also tested the deletion boundary.
The newly created CenterBranchAdmin could not delete the branch.
Correctly denied.
The parent TestCenterAdmin could delete its own controlled branch.
A foreign controlled organization could not.
So no, this was not arbitrary branch deletion or a cross-tenant IDOR.
I don’t need to exaggerate impact when the real bug is already clean.
20/
The proven impact was:
• Create branches before approval • Provision real administrator identities • Activate those identities normally • Authenticate as those administrators • Access protected branch resources • Manage owned branch structure while pending
All before the organization passed review.
21/
This finding is a perfect example of why I don’t only hunt payloads.
Payloads are easy to screenshot.
Broken assumptions are where the serious bugs live.
Especially around:
pending invited suspended disabled unverified under review
Every role should be tested in every lifecycle state.
22/
The takeaway:
A valid role does not mean the user is in a valid business state.
And when I see Rails parameters shaped like:
model_attributes[][field]
I don’t just ask what I can mass assign.
I ask what objects, identities, and permissions the framework will quietly create for me.
Sometimes the most powerful payload is not SQL, JavaScript, or Ruby.
Sometimes it’s simply:
status = pending
:)
#BugBounty #RubyOnRails](https://pbs.twimg.com/media/HM211YeXoAAptS2.jpg)
8 free Polymarket Trading Bots on GitHub (from Beginner Friendly to Advanced Level).
Each of these repos comes with a detailed step by step setup and usage guide in English.
> Beginner Level - 5 min setup
1. This bot includes 120 ready to use strategies and tools for trading on prediction markets (Binance-Polymarket latency, Smart Routing, Penny Clipper, Momentum, DCA bots, Expiry Fade and more).
It was built by a Cambridge computer science student who won a hackathon with this bot.
GitHub: https://t.co/2MCzD8iZG7
2. A trading bot with a Smart Money strategy - it finds top traders in selected markets, filters them by Pnl, win rate, stable performance and then creates a list for automated copy trading.
GitHub: https://t.co/qbk9l2uxLd
3. This is a bot toolkit that includes Polymarket - Kalshi arbitrage, whale alerts, market making, spread farming, sports trading and more.
GitHub: https://t.co/p3obYeQTzO
4. A weather trading bot from Chinese dev that analyzes different sources in real time, like forecasts, airport data and aviation observations (METAR + SPECI) to get the latest temperature data and generate a detailed weather report for a specific city and day.
GitHub: https://t.co/No3sBcqMg1
5. A huge collection of 30+ free trading bots and services for prediction markets.
GitHub: https://t.co/a2WRRl8PJl
> Advanced bot setup
1. This bot analyzes the real trading behavior of any Polymarket trader.
It finds repeated patterns in his trades, shows which strategies he uses and helps you understand how to adapt them to your own trading.
GitHub: https://t.co/SzdjHtASLt
2. A bot that automatically manages all your limit orders on Polymarket to maximize liquidity rewards.
GitHub: https://t.co/nvb96dTIwx
> A full ML weather model
1. A machine learning weather model that learns from weather forecasting errors.
Instead of blindly trusting forecasts, it analyzes how different weather sources have historically overestimated or underestimated temperature values in specific cities and conditions.
Then it automatically adjusts new forecasts to produce more accurate predictions.
GitHub: https://t.co/9DnTPu5iKE
All of these bots also support Dry Run mode, so you can test them on real markets without risking any funds.
Adding to this list. All free. No paywall. No signup.
https://t.co/x516DQRcB8 - 700+ pages of malware analysis and exploit research
https://t.co/cgxRDKvx2g - full university malware analysis course
https://t.co/7uSbDhTq6s - RE101, RE102, macOS RE, PE injection
https://t.co/mRHslgjr4f - ARM assembly, shellcode, heap exploitation
https://t.co/SLm7Vlyd93 - applied RE series and hypervisor development
https://t.co/3SLFBf6xSp - buffer overflows to kernel exploitation
https://t.co/gDWRH5YpIx - 30+ courses, WinDbg, IDA, Ghidra, UEFI, kernel exploitation
https://t.co/rA4x1Hv2iE - 41 tutorials spanning 17 years of exploit dev
https://t.co/DIqWzR1Xp3 - 19-part series, usermode to kernel
https://t.co/BJpRHdbTHu - Windows internals, secure kernel, VBS, KDP, dynamic analysis
YouTube:
https://t.co/KLUDZ9us2g
https://t.co/yxJUVqTzvK
https://t.co/IvelLJIQhH
https://t.co/C8aErWJ5RJ
https://t.co/NDG3swCvB1
Thousands of dollars worth of knowledge. All free.
#ReverseEngineering #MalwareAnalysis #InfoSec
i’m launching a memecoin on solana
you have 8 hours to fill out form
for a bonus airdrop, rt + drop your SOL address
https://t.co/RaGHIUyK6T
@RoarWeb3 3NMJWTeSN8jQ89ppFCYEa3Mbdp2bgrCv4XDghEUK4Vao
lets go
Despite contacting the helpline number and emailing the relevant official support/grievance contacts, I have not received a satisfactory resolution.
Requesting Passport Seva/MEA to kindly look into this issue and help enable the reschedule option again.
This means I do not have access to either cancel or reschedule, even though the date was selected unintentionally.
In genuine accidental booking cases, applicants should have some practical option to correct the appointment date.
I have seen other applicants facing similar issues too, where users get locked out without any clear solution.
This becomes more serious in Tatkaal cases because time and fees are critical.
My appointment got scheduled accidentally, and now the portal shows:
“Maximum number of attempts exceeded for Reschedule/Cancel appointment.”
@passportsevamea @rpolucknow @MEAIndia @CPVIndia
@moonpay Hoping soooo
💪💪
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.2M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.3M followers
KATY PERRY
@katyperry
88.7M followers
Taylor Swift
@taylorswift13
82.6M followers
Lady Gaga
@ladygaga
74.1M followers
Virat Kohli
@imvkohli
71.5M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.5M followers
Neymar Jr
@neymarjr
64.4M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.8M followers
X
@x
60.8M followers