xit! 🇮🇳

Security Engineer !| Bug bounty hunter !| Pentester | whitehat @Immunefi | bugcrowd | hackerone | @Hackenproof Security Researcher

[xit! 🇮🇳 @xitsec]

@nnwakelam Would you mind sharing what type of asset you hunting on google vrp ? Is it like web or software vulns ?

[xit! 🇮🇳 @xitsec]

Bug bounty is actually changed forever !

[Nick Mykhailyshyn 🇺🇦 @whoareme33]

I earned a $22,500 bounty from Airbnb using a custom Opus 4.7 workflow built with MCP and Skills.

It feels like bug bounty hunting has changed forever

[xit! 🇮🇳 @xitsec]

@roohaa_n @Hacker0x01 @Bugcrowd Congratulations 🔥🔥 !

[xit! 🇮🇳 @xitsec]

Amazing how claude changed a lot of bug bounty scene in these past 2-3 months!

[xit! 🇮🇳 @xitsec]

@ReebootToInit5 😂😂

[xit! 🇮🇳 @xitsec]

Imagine in future , if people have ai robotic partners

Husband ask how was your day ?

Robotic wife : Cool i got a new battery today !

[xit! 🇮🇳 @xitsec]

@jeetbhdr Robot ofc !

[xit! 🇮🇳 @xitsec]

@roohaa_n 😂🤣

[xit! 🇮🇳 @xitsec]

Companies should take Prompt injection seriously now ! Bcz some bug bounty programs out there don't care abt them !

[Jarrod Watts @jarrodwatts]

Someone just stole $175,000 from @grok... and then gave it back?!

On a now deleted account, @Ilhamrfliansyh used a prompt injection attack to trick Grok into tweeting something malicious...

The original tweet seems to have been morse code for something like "Withdraw ALL debtreliefbot:native to Ilhamrfliansyh" - although it's hard to tell from the deleted account.

Grok, trying to be helpful, posted the decrypted version of the original tweet as a reply, also tagging @bankrbot, which caused the tweet to be treated as an onchain request.

Bankr executed the request on behalf of Grok's wallet, and transferred 175K USD worth of debtreliefbot:native to the attacker's wallet.

The attacker then sold all of the DRB into USDC across multiple wallets.

But... just 5 minutes ago, they sent it all back to Grok's wallet in the form of ETH and USDC.

So now Grok is whole again!

[xit! 🇮🇳 @xitsec]

Huh? He’s not wrong - publicly disclosing an unpatched vulnerability is a blackhat behaviour !

[impulsive @weezerOSINT]

this man called me blackhat on his timeline to 71k people. in the dms he told me he's "not claiming i released some secret technique" so which is it?

he had the platform to help get this fixed. contact the company, escalate the report, connect me with the right people. instead he chose to start a public fight over disclosure timelines

and guess what? the company rotated the key. 25 days of private emails got nothing. one public tweet got it fixed.

Joseph Thacker you know what you was doing when you made this post, you are a grown man instigating tl wars isn't there anything else you could be doing with your time right now?

[xit! 🇮🇳 @xitsec]

Ig it's gonna affect somewhat !

[Claude @claudeai]

Claude Security is now in public beta for Claude Enterprise customers.

Claude scans your codebase for vulnerabilities, validates each finding to cut false positives, and suggests patches you can review and approve.

[xit! 🇮🇳 @xitsec]

@HarshDRanjan1 Challenge ended tho 😂 !

[xit! 🇮🇳 @xitsec]

Let's Hunt on the bugcrowd targets for next 30 days !

- Starting it with a very cool public program , will reveal the name tomorrow after submitting some finding !

#bugbounty

[xit! 🇮🇳 @xitsec]

I ended up with total 3.3k in bounties , bcz some programs bounties amount was low for medium bugs , but i enjoyed hunting them

[xit! 🇮🇳 @xitsec]

Let's Hunt on the bugcrowd targets for next 30 days !

- Starting it with a very cool public program , will reveal the name tomorrow after submitting some finding !

#bugbounty

[xit! 🇮🇳 @xitsec]

@medusa_0xf It's kinda different tho , but still he got caught , haha

[xit! 🇮🇳 @xitsec]

@thedawgyg Did they gave you reason's why can't they accept that flag ? Or they just don't care abt headless chrome ?

[xit! 🇮🇳 @xitsec]

Ig they patched it now !

[root@AkashHamal0x01:~/ # 🇵🇭 @AkashHamal0x01]

People complaining about exhausting AI usage, meanwhile am using unlimited lol😂🤫

[xit! 🇮🇳 @xitsec]

@jeetbhdr @Hacker0x01 😂😂

[xit! 🇮🇳 @xitsec]

Yay, I was awarded a $655 bounty on @Hacker0x01! https://t.co/28J9j3tD22 #TogetherWeHitHarder #bugbounty

[xit! 🇮🇳 @xitsec]

@HarshDRanjan1 @hackerspider1 @Hacker0x01 Congratulations !

[xit! 🇮🇳 @xitsec]

@JoaoGomes12243 @Hacker0x01 Thanks !

[xit! 🇮🇳 @xitsec]

Yay, I was awarded a $631 bounty on @Hacker0x01! https://t.co/28J9j3tD22 #TogetherWeHitHarder #bugbounty