0std | Pentester | AppSec

Few words about me: 5.5 years pentesting (40+ external + 20+ web apps, red team, physical) → now 3 years in defensive (SOC, SSDLC, AppSec, Wazuh, Suricata). Found $250 bug bounty in the first week of my 30-day challenge. Sharing real purple team labs, implemeting AI, practical setups, and lessons from both red and blue sides. Subscribe & grow with me 🔥

@ZackKorman remember some of those people told that models are conscious xd

Cybersecurity is being used as a pawn in the AI debates. First it was “these models are too dangerous.” Now it’s “Chinese open-weight sleeper agents.” These ideas are pushed by non-security people to serve an agenda, and that agenda has nothing to do with cybersecurity.

@jun_song clicking accept on claude doesn’t require a laptop, agreed

Surprised to see so many people still hauling MacBooks around. I completely switched to working remotely via my iPhone, and it handles everything flawlessly. What is even the reason to carry a heavy laptop anymore?

@IceSolst NONONO that's definitely was found by Mythos aka too dangerous to release cyber capable model. We are doomed

🚨BREAKING: RCE in Microsoft Chat (1996)! PATCH ASAP! Wait there is no patch, THIS IS A ZERO DAY, the vulnpocalypse is here

@IceSolst @0xTib3rius FURRIES MENTIONED 💪🏼💪🏼💪🏼💪🏼💪🏼

Full video with @0xTib3rius, we address some of your tweets about defcon myths, furries, feet feud, the legality of deodorant, etc

@AbhiCodes15 depends on model and actually you can But the speed will be like 10tps

What's the point of a local model if most developers can't realistically run it?

So everyone is saying that Kimi K3 benchmaxxed all frontier models? Waiting for a score on “backdoor creation” benchmark

@RyanGCox_ @techspence from software engineering straight to red teaming? wow, I think better to start off with penetration testing

Here are some logical career pivots if you want to break into Cybersecurity: IT -> Corporate Security SWE -> Application Security/Red Team Network Engineer -> Cloud Security Data Analyst -> SOC Analyst SysAdmin -> IAM Security DevOps -> DevSecOps/Infrastructure/Cloud Security Help Desk -> SOC Analyst To work in cybersecurity, you don't have to start in cybersecurity. Everyone's path is different. Find the path that makes the most sense for you.

@techspence somehow cybersecurity requires understanding what and how needs to be done in a lot of areas like devops, sysadmin, backend dev all at once but significantly underpaid compared to all of them

Getting an IT job first before getting into cybersecurity is unmatched. Especially true if you want to do any kind of technical role, that IT experience is only going to help you. The problem is, so many people lack the patience to do it. Especially when you get a "cybersecurity" degree...

@0xAlaric Fable guardrails were bypassed the same day as it was released to public yet we don’t see everyone hacked or some rapid emerge of cyberattacks. So it’s either cybercriminals are not using it either it is not so good at it as it was stated by Anthropic lmao

Anthropic: “Fable is an agentic coding superweapon, capable of developing cyber- and bio-weapons at unprecedented speed and scale. We cannot in good faith release it without guardrails.” China: “lmao here’s Fable but open-source. Good fkn luck”

@jvr0x @0xSero read my calculations bro

@0std1 @0xSero Do you know what 50 tok/s looks like?

It costs: - 18,000$ for GLM-5.2 on 4x DGX Sparks @ 30 tok/s - 60,000$ for GLM-5.2 on 4x RTX Pro 6000 @ 80 tok/s - 24,000$ for GLM-5.2 on ??????? @ 50 tok/s Here it's using subagents to research x API & build a local.ai bot, it's actually phenomenal.

@IceSolst @haroonmeer @Jhaddix @madelinelawren sales persons in cybersecurity field which are quite a rare kind as it is really hard to understand what is going on in this field

Marketing for cybersecurity can be done right: just look at @haroonmeer @Jhaddix @madelinelawren & what they’ve built. When you deeply understand the community, you can speak to its members directly. Otherwise you hire a clueless sales exec and turn people away.

@techspence I've heard that some people use company's internal network for this purpose! 😂

One of the best investments ever, if you work in security, is having your own lab. Your own little sandbox or playground where you can literally destroy stuff and it doesn't matter.

@dunik_7 hahahha another 0.12 tokens/s repo, good luck doing anything with such speed

he made 405-billion-parameter models run on a single 8GB gaming GPU. instead of turning it into a paid service, he open-sourced the whole thing. Gavin Li Founder and CEO of Anima AI in the Bay Area. 'airllm' - it keeps one layer on the GPU at a time and streams the rest, so a 70B model fits in 4GB and DeepSeek's full 671B fits in about 12GB 22,700 stars. Apache 2.0. → github.com/lyogavin / he has 808 followers. / his repo has 22,700 stars. bookmark it. that's what shipping something impossible looks like.

@infmes open source models can’t provide you one either as they are completely blackbox and give undetermined answers as other models do and are

@0std1 can't put a price on privacy 🫣

@infmes with such speed? better pay just 8 bucks for 1m tokens or buy subscription for 100$/month

@0std1 24k for one user not for entire company

@infmes @0xSero we've built AI SAST which spends about 1,5 mln tokens per merge request which amount can be about 500 per day (company wide). So it will take about 13 hours to analyse 1 which obviously we can't afford. So yeah in commercial sense this speed is quite useless.

@0std1 @0xSero you cant do anything with 50 tps?????

@ZackKorman @InsiderPhD Exactly! because model’s answer isn’t determined and it is still blackbox as we can’t debug its behavior through layers

I really struggle to understand Semgrep’s research on backdoored AI models. They say we urgently need trusted third parties to validate models. But… why? A non-backdoored model can still behave in an unsafe way. You shouldn’t trust any model. cc @InsiderPhD

@techspence I agree. Catching in infra people who thought are smarter than you can be fun.

@0std1 to each their own. I think a lot of the blue team stuff IS fun

In the 5 year's I've been pentesting, I've worked with clients that had: hardened endpoints, app control, edr & mdr, custom alerts they created themselves, good hygiene, tiered admin accounts, etc. I wish I could talk about all the awesome stuff these folks are doing. I think part of why offensive security has become so popular is because the super cool awesome blue team stuff isn’t shared as much, for obvious reasons. Defenders don’t want to give up their hands or put a target on their back. Certainly don't blame them. Blue team stuff is cool and fun and awesome. We just don’t get to see it as often. I wish we did.

@hakluke youtube.com/watch?v=dQw4w9…

Send me a link to a blog or video that changed your life.