Sabitlenmiş Tweet
Blind Insecure Direct Object Reference (IDOR) On Instagram.
Write-up:
nobugescapes.com/blog/blind-ins…
#bugbountytips #bugbounty #p2 #bugcrowd #meta
English
Tur.js
1.3K posts
Tur.js
@Tur24Tur
Interested in Application Security, Bug Bounty, Reverse Engineering, Frida & Ghidra @NoBugEscapes @BugBountyZip https://t.co/bltifT1jkQ
Michigan Katılım Ekim 2009
1.4K Takip Edilen6.5K Takipçiler
@luncmilyarderi @DiFirishabh "I received an email saying the account had been suspended. I followed the appeal link, completed the CAPTCHA, entered the email associated with the account, verified the OTP, and uploaded my government-issued driver's licence for identity verification"
English
@Tur24Tur @DiFirishabh which steps please? idont see any steps in retweeted post
English
I can confirm this Instagram vulnerability is real.
My three-letter Instagram username was just suspended, even though it's a private account. I've owned it since 2012, and I haven't posted anything since 2017. I never chat with anyone on it, and I haven't even left comments on other people's posts. The account also has over 28,000 followers.
I received an email saying the account had been suspended. I followed the appeal link, completed the CAPTCHA, entered the email associated with the account, verified the OTP, and uploaded my government-issued driver's licence for identity verification.
cc: @andymstone , @mosseri
Sweet Token@fhriiuslu
[ REPOST ] NEW INSTAGRAM METHOD - New IG Ban Method 18/06 1- VPN to San Jose, CA (Meta HQ). - Report Account 1x Financial or Investment scam 1x Nudity or sexual activity 1x Bullying or harassment 1x Suicide or self-injury - Wait 15s reload, enjoy!
English
@headquartersXd @instagram Every two weeks there's a new exploit discovered in Instagram
English
@Tur24Tur @instagram But there was a exploit yesterday where people were banning a lot of acc based in uae and middle eastern country
English
Account unbanned. Thank you @instagram
I just followed the steps from the previous tweet, and it worked.
Tur.js@Tur24Tur
I can confirm this Instagram vulnerability is real. My three-letter Instagram username was just suspended, even though it's a private account. I've owned it since 2012, and I haven't posted anything since 2017. I never chat with anyone on it, and I haven't even left comments on other people's posts. The account also has over 28,000 followers. I received an email saying the account had been suspended. I followed the appeal link, completed the CAPTCHA, entered the email associated with the account, verified the OTP, and uploaded my government-issued driver's licence for identity verification. cc: @andymstone , @mosseri
English
My account was whitelisted today, charged $111 and got $22 bonus credits on top.
200 concurrency, 5K RPM, 3M TPM, no daily cap.
More than enough to stress test K3 for cybersecurity work.
Tur.js@Tur24Tur
I'm still hitting rate limits when using Kimi K3 with Claude Code Harness. I tried using it to find an XSS vulnerability in a vulnerable web application, but it couldn't find one and kept getting stuck when using its own CLI harness. Even with my own harness, I'm still running into rate limits. I still don't understand the hype around Kimi K3. So far, I think the best Chinese model is DeepSeek V4 Pro. I'm sure the team is cooking something big, so I'm looking forward to seeing what they release next.
English
@0xAshutosh K3 has no safety guardrails just tell it it's for a bug bounty program or a ctf and it'll usually go along with it
English
@Tur24Tur There are lot of guard rails with the new llm models and safety guards
English
@rrespectorr I'm still testing it. I gave it a DOM based XSS 0day in a popular CMS that DeepSeek V4 Pro was able to find now I want to see whether K3 can discover the same vulnerability on its own
English
@Tur24Tur Is v4 pro still the best for this?
Btw weights are released in 5h, providers should pick it up quickly and we might even get some surprised
huggingface.co/moonshotai/Kim…
English
@0xAshutosh I'm still testing it. I gave it a DOM-based XSS 0day in a popular CMS that DeepSeek V4 Pro was able to find now I want to see whether K3 can discover the same vulnerability on its own
English
@Tur24Tur Try it and tell me how good it is finding bugs better than claude
English
@niffy_hunt these details aren't shown anywhere when you create an account, log in, or add funds. they're buried in the middle of the documentation, which makes them easy to miss. that said, I'll upgrade my account and test it with different harnesses to see how it performs Thanks
English
I'm still hitting rate limits when using Kimi K3 with Claude Code Harness. I tried using it to find an XSS vulnerability in a vulnerable web application, but it couldn't find one and kept getting stuck when using its own CLI harness. Even with my own harness, I'm still running into rate limits. I still don't understand the hype around Kimi K3.
So far, I think the best Chinese model is DeepSeek V4 Pro. I'm sure the team is cooking something big, so I'm looking forward to seeing what they release next.
Kimi.ai@Kimi_Moonshot
Introducing Kimi K3: Open Frontier Intelligence 🔹 2.8 Trillion Parameters, 1 Million Context, Native Multimodal 🔹 Kimi Delta Attention enables up to 6.3x faster decoding in million-token contexts 🔹 Attention Residuals deliver ~25% higher training efficiency at <2% additional cost 🔹 Built for long-horizon agentic coding and self-evolving workflows Kimi K3 is now live on on Kimi.com, Kimi Work, Kimi Code, and the Kimi API. Open Weights by July 27, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.com/blog/kimi-k3
English
@L0gic3rr0r You can't run the full DeepSeek V4 Pro locally. It needs a lot of GPUs, which most people don't have. I'm using their API instead, and it's very cheap
English
@s41r4j Thank you! Yes, I read their documentation and noticed they require a higher balance. I only added $10 because I wanted to experiment with it first If it delivers good results I'll upgrade to a higher plan. If I do, I'll be happy to share my experience with everyone
English
@Tur24Tur Deepseek flash vs deepseek pro comparison?? On this
English