Abhishek Meena 🏵️

3.4K posts

Abhishek Meena 🏵️ banner
Abhishek Meena 🏵️

Abhishek Meena 🏵️

@aacle_

Building @Vulncure ⚡| Helping founders fix vulnerabilities before hackers find them. Talk to me about: Bug Bounties, LLM Security & React.👇 Book a 15-min Demo

Katılım Haziran 2017
276 Takip Edilen45.2K Takipçiler
Sabitlenmiş Tweet
Abhishek Meena 🏵️
We've curated entire API Pentesting Series into a single, auto-updating Notion page. • All existing parts • Future parts added automatically • One link to bookmark Access the full library here: vulncure.com/api-pentest/ap…
Abhishek Meena 🏵️ tweet media
English
4
125
595
27.6K
Abhishek Meena 🏵️ retweetledi
sadkat
sadkat@sadkatwt·
Antigravity is a legit scam use it for an hour and get rate limited for a week even on PRO plan. Also there was a bug they rolled out credit system and just after limits were about to reset there was another week added to the reset timer.
sadkat tweet media
English
165
80
1.1K
55.1K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
If we don't fix this, curl won't be the last project to leave. I wrote a deep dive on: • The specific bad reports • The economics of "AI Slop" • How to use AI without getting banned Read it here: @Aacle/why-curl-quit-hackerone-526a05e12289" target="_blank" rel="nofollow noopener">medium.com/@Aacle/why-cur…
English
0
0
1
302
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
Elite researcher Sean Heeland notes a "1-to-50" signal ratio with AI tools. For a maintainer, that means triaging 50 hallucinations to find 1 valid bug. That isn't "helping." That's a Denial of Service attack on human time.
English
1
0
2
441
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
The curl project just pulled out of HackerOne. The reason? "AI Slop." When the signal-to-noise ratio hits 1:50, the bug bounty model collapses. Here’s how automated hallucinations are killing open source programs. 🧵 #bugbountytips #infosec #curl @Aacle/why-curl-quit-hackerone-526a05e12289" target="_blank" rel="nofollow noopener">medium.com/@Aacle/why-cur…
English
1
0
7
988
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
3/ The Lesson: Never trust a URL after you've checked it. Pin the IP or use a whitelist. Full write-up coming soon on my Medium! Stay tuned. 🎯 #SSRF #HackingTips
English
0
0
9
1K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
2/ The Attack: Between the "Check" and the "Fetch," we switch the DNS record. Our DNS server now says: attacker.com is 127.0.0.1 (Localhost). Slack fetches the data thinking it's public, but it's actually hitting its own internal database. 🤯
English
1
0
11
1.5K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
🧵 How a simple DNS trick bypassed Slack's security and earned a researcher $10,000. 💰 Most SSRF filters are broken by design. They check the IP once, but the server uses the domain twice. Enter: DNS Rebinding. Here is the breakdown... 👇 #bugbounty #infosec #cybersecurity
English
1
10
119
10.2K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
Api Pentesting Series Part 9: Endpoint Analysis is live. We’re covering: • Reverse Engineering undocumented APIs • Spotting "Excessive Data Exposure" • Bypassing business logic (negative numbers, skipped steps) Grab the full Notion notes here: vulncure.com/api-pentest/ap…
Abhishek Meena 🏵️ tweet media
English
0
20
128
6K
Abhishek Meena 🏵️ retweetledi
N$
N$@nav1n0x·
CVE-2025-55182 - UTF-16LE (Little Endian) parsing bypass. Many targets appeared not vulnerable when tested with standard GitHub PoCs. However, by sending the same payload encoded as UTF-16LE, the request was parsed differently and reached the vulnerable React Server Components path, resulting in server-side RCE. #CVE2025_55182 #NextJS #React #RSC #BugBounty
N$ tweet mediaN$ tweet media
English
14
95
597
44.1K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
⚡ Part 9 Loading... Topic: API Endpoint Analysis 🎯 It’s not just about finding the endpoint; it’s about understanding what it reveals. From dissecting Swagger docs to reverse engineering JS files, this guide covers it all. Get your tools ready. Dropping soon. ⏳ #BugBounty
Abhishek Meena 🏵️ tweet media
English
0
20
126
5.3K
vogel
vogel@ryanvogel·
can someone please make an OSS alternative to ngrok?
vogel tweet media
English
264
8
682
195.8K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
The best part about Bug Bounty isn't the finding, it's the sharing. 🤝 Documented 7 key insights from the community on the new React2Shell vulnerability guide. This section alone is worth the read if you're hunting CVE-2025-55182 this week.
Abhishek Meena 🏵️ tweet media
Abhishek Meena 🏵️@aacle_

📝 CVE-2025-55182 Bug Bounty Hunting Guide In-depth analysis : ✅ Technical exploitation details ✅ 6+ detection tools & scanners ✅ WAF bypass techniques ✅ Testing strategies Perfect Start from here. @Aacle/cve-2025-55182-react2shell-complete-bug-bounty-hunting-guide-9cbfd15b6e47" target="_blank" rel="nofollow noopener">medium.com/@Aacle/cve-202…

English
0
0
18
2.6K
Abhishek Meena 🏵️
Abhishek Meena 🏵️@aacle_·
📝 CVE-2025-55182 Bug Bounty Hunting Guide In-depth analysis : ✅ Technical exploitation details ✅ 6+ detection tools & scanners ✅ WAF bypass techniques ✅ Testing strategies Perfect Start from here. @Aacle/cve-2025-55182-react2shell-complete-bug-bounty-hunting-guide-9cbfd15b6e47" target="_blank" rel="nofollow noopener">medium.com/@Aacle/cve-202…
English
0
6
31
5.9K
Abhishek Meena 🏵️
🚨 New article: SSRF exploitation What's inside: → 20+ bypass techniques → Cloud metadata attacks (AWS/Azure/GCP) → Gopher protocol exploitation → Docker & Redis RCE chains → Blind SSRF detection → Real automation scripts From ping to RCE: @Aacle/server-side-request-forgery-ssrf-from-ping-to-rce-6ac95bf4e489" target="_blank" rel="nofollow noopener">medium.com/@Aacle/server-…
English
2
28
115
8.6K