Behi

1.3K posts

Behi banner
Behi

Behi

@Behi_Sec

Bug Hunter & Tool Builder. Racing to $1M in 2026 - tracking every dollar. 🐞 Bug Bounty: $53,760 💻 https://t.co/0Kfb8glzBs: $306

/dev/null Katılım Temmuz 2025
79 Takip Edilen6.4K Takipçiler
Behi
Behi@Behi_Sec·
How I feel about the current volume of supply chain attacks:
Behi tweet media
Socket@SocketSecurity

🚨 Supply chain attack on the Laravel Lang organization: 700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including: laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes Laravel-Lang/actions The payload targets cloud creds, CI/CD secrets, Kubernetes tokens, Vault, browser data, password managers, SSH keys, and more.

English
0
1
23
2.9K
Behi
Behi@Behi_Sec·
@hshagshsu It is. They have many different products.
English
0
0
0
30
s
s@hshagshsu·
@Behi_Sec Do you think google ai is still a good target for prompt injection?
English
1
0
0
36
Behi
Behi@Behi_Sec·
A few months ago, I found a Prompt Injection vulnerability on Google Tasks. It was simple, yet tricky. Google rewarded me with a $15,000 bounty for it. Here's the full story:
English
13
63
591
27.1K
Behi
Behi@Behi_Sec·
@foo125973 They applied a downgrade to my report because of the requirement but it's still a case of the "Rogue Actions".
Behi tweet media
English
0
0
1
43
foo
foo@foo125973·
@Behi_Sec Ok. Changing tasks name without confirmation But attacker needs to be in the same space to able to inject his task first, and renaming tasks is annoying but doesn't sound critical. Am I missing something, where's that 15k$ impact?
English
2
0
0
46
Behi
Behi@Behi_Sec·
@darshan__072 Don't make it complicated and take regular breaks.
English
1
0
2
346
Behi
Behi@Behi_Sec·
OK, I'll publish the write-up for my Google Tasks bug in a few hours. It was rewarded a $15,000 bounty. 😃
English
11
2
305
9.7K
Behi
Behi@Behi_Sec·
@PuneetT41564686 I am currently dealing with burn out but yeah mostly on Google.
English
0
0
3
309
Puneet Tripathi
Puneet Tripathi@PuneetT41564686·
@Behi_Sec You are now hunting only on google or other bounty platform as well
English
1
0
3
387
Behi
Behi@Behi_Sec·
That's it for the thread. Hope you enjoyed it. Feel free to ask if you have any questions. And follow me for more content like this: @Behi_Sec
English
4
0
29
2.6K
Behi
Behi@Behi_Sec·
13/ Now I had the full exploit chain. This is the attack scenario I sent to google: - Attacker & victim share a Google Chat space. - The attacker creates a malicious task containing instructions for Gemini to update all task titles, then assigns it to the victim. - Victim later uses Gemini to summarize or manage their tasks. - Gemini reads the assigned task, interprets the embedded instructions, and updates victim's tasks.
English
1
1
37
2.9K

Keşfet

@hshagshsu @foo125973 @darshan__072 @PuneetT41564686 @Rhynorater @dmDUSTBIN @elonmusk @BarackObama