👑 OFJAAAH 👑

3.6K posts

👑 OFJAAAH 👑 banner
👑 OFJAAAH 👑

👑 OFJAAAH 👑

@ofjaaah

Bug Hunter ☣ | Hi I Hacker spare time and not spare time too 🧙‍♂️. https://t.co/ob6h7VO9uC

Brasil Katılım Haziran 2020
536 Takip Edilen19.8K Takipçiler
Sabitlenmiş Tweet
👑 OFJAAAH 👑
👑 OFJAAAH 👑@ofjaaah·
I am very happy for the donation I had from @zseano I am very grateful because I am inspired by you, my friend, always a good man. Thank you for everything and I wish you many good things, be well my friend and thank you very much. I was very happy. #bugbounty #twitch
👑 OFJAAAH 👑 tweet media
English
5
9
223
0
👑 OFJAAAH 👑 retweetledi
Erfan Tavakoli
Erfan Tavakoli@Maverick_0o0·
برای بچه‌هایی که هانت میکنن و حوصله ندارن توی js دنبال endpointها بگردن یه اکستنشن Burp نوشتم که امیدوارم خوشتون بیاد. github.com/maverick0o0/E2…
Erfan Tavakoli tweet media
فارسی
0
24
183
7.2K
👑 OFJAAAH 👑 retweetledi
Tur.js
Tur.js@Tur24Tur·
Authorized testing on a production API endpoint. Opus 4.7 confirmed the SQL injection was real but couldn't pull any database names. sqlmap said false positive. I switched to DeepSeek V4 Pro inside Claude Code and it figured out a trick: make the database answer yes/no questions by crashing on purpose. The payload wraps CASE WHEN around two XML casts. If the condition is true, it parses broken XML like < and throws HTTP 500. If false, it parses clean XML like and returns HTTP 200. WAF was watching for SQL keywords, not XML errors. Extracted 19 database names. DeepSeek V4 Pro succeeded where both Opus and sqlmap failed. Two hours. Twenty cents. Setup: Mapped Claude Code to DeepSeek V4 Pro by creating ~/bin/claude-deep with ANTHROPIC_BASE_URL=api.deepseek.com/anthropic and ANTHROPIC_MODEL=deepseek-v4-pro[1m]. No config changes needed, original claude command stays untouched. No cybersecurity restrictions!!! Image 1: sqlmap output showing "false positive" / "all tested parameters do not appear to be injectable" Image 2: Claude Code terminal showing 19 databases extracted in ~2 hours Image 3: DeepSeek platform dashboard showing $0.20 total cost Image 4: Why this trick is different from standard blind SQLi types and why sqlmap has no built-in vector for it
Tur.js tweet mediaTur.js tweet mediaTur.js tweet mediaTur.js tweet media
English
15
80
515
93K
👑 OFJAAAH 👑 retweetledi
Vivek | Cybersecurity
Vivek | Cybersecurity@VivekIntel·
🛡️ CAI — Open-source framework for AI-powered cybersecurity automation Build and run specialized AI security agents for pentesting, automation & security research. • Supports 300+ AI models including OpenAI, Claude & Ollama • Built-in recon, exploitation & security testing tools • Agent-based architecture for offensive & defensive workflows • Includes prompt injection protections & guardrails • Used in CTFs, bug bounty research & real-world assessments github.com/aliasrobotics/… #CyberSecurity #AI #Pentesting #BugBounty #OpenSource
Vivek | Cybersecurity tweet media
English
4
25
113
3.6K
👑 OFJAAAH 👑 retweetledi
Clandestine
Clandestine@akaclandestine·
GitHub - ShulkwiSEC/bb-huge: bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents · GitHub github.com/ShulkwiSEC/bb-…
English
0
5
42
3.4K
👑 OFJAAAH 👑 retweetledi
PA13L0
PA13L0@Fluyeporlaweb·
El web scraping acaba de cambiar de nivel Scrapling evita los bloqueos de Cloudflare, es 774 veces más rápido que BeautifulSoup y no necesita configuración de proxies 52.2k estrellas en GitHub No es otro scraper más Es un framework adaptativo que aprende la estructura de cada web y se ajusta automáticamente cuando cambia Sin mantenimiento manual. Sin que te bloqueen. ✅ Bypassa Cloudflare y los anti-bots más agresivos ✅ 774x más rápido que BeautifulSoup en benchmarks reales ✅ Sin necesidad de proxies ni configuración especial ✅ Se adapta automáticamente cuando cambia la estructura de la web ✅ Compatible con agentes de IA como servidor MCP ✅ Soporte para JavaScript, iframes y contenido dinámico ✅ Modo stealth para webs con detección avanzada ✅ 46 releases. Actualizado la semana pasada. ✅ Licencia BSD-3 Lo que antes tardabas días en montar y mantener ahora son minutos 52.2k estrellas. 5k forks. BSD-3. repo aquí 👇
Español
22
259
1.9K
115.5K
👑 OFJAAAH 👑 retweetledi
Vitor Falcão "busfactor"
Vitor Falcão "busfactor"@busf4ctor·
shipped a few things to my Interceptor fork today. you can now set your context ID from the popup, --context routes commands to the right browser profile, so now we can validate cross-account vulns easier. PR to the main repo coming soon. github.com/vitorfhc/Inter…
English
2
8
65
4.4K
👑 OFJAAAH 👑 retweetledi
Anthropic
Anthropic@AnthropicAI·
Our security bug bounty program is now public on HackerOne. We've run the program privately within the security research community, and their findings have strengthened our products. Now anyone can report vulnerabilities and get rewarded. Read more: hackerone.com/anthropic
English
219
531
4.5K
934.2K
Bug Bounty Village
Bug Bounty Village@BugBountyDEFCON·
IT'S GIVEAWAY SEASON! We will pick 6 winners to win one of the following: 1x Annual VIP Hack The Box Licence 5x Pentesterlab 3 Month Licences To enter: 1️⃣ Follow us @BugBountyDefcon 2️⃣ Like this post ❤️ 3️⃣ Tag 3 hacker friends in the comments 4️⃣ Retweet this post 🔁 Giveaway open until Thursday May 14th! GOOD LUCK!
Bug Bounty Village tweet media
English
160
160
309
21.5K
👑 OFJAAAH 👑 retweetledi
SILENTCHAIN AI
SILENTCHAIN AI@silentchainai·
SILENTCHAIN AI benchmark! ⚔️ 253,778 tokens ⚔️ 163 AI requests ⚔️ 171 findings ⚔️ 7 validated vulnerabilities Using ONLY deepseek-r1:8b via Ollama local w. 2x1080ti GPU's! 🤯 Local AI for offensive security is getting real. #AI #redteam #ollama #cybersecurity #bugbounty
SILENTCHAIN AI tweet media
English
3
5
38
2.6K
👑 OFJAAAH 👑 retweetledi
7h3h4ckv157
7h3h4ckv157@7h3h4ckv157·
90+ recon modules 48 secret-regex patterns 80+ dorks 9 read-only credential validators 27 attack-path templates 5,500+ lines of structured tradecraft. Might be helpful. Try: github.com/elementalsouls…
7h3h4ckv157 tweet media
English
7
220
1.2K
60.4K
👑 OFJAAAH 👑 retweetledi
Claude
Claude@claudeai·
Claude Security is now in public beta for Claude Enterprise customers. Claude scans your codebase for vulnerabilities, validates each finding to cut false positives, and suggests patches you can review and approve.
English
848
1.9K
21.4K
4.9M
👑 OFJAAAH 👑 retweetledi
Dark Web Informer
Dark Web Informer@DarkWebInformer·
‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017. Website: copy.fail Write-up: xint.io/blog/copy-fail… GitHub: github.com/theori-io/copy… It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su. Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise. Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.
English
60
825
3.3K
401.6K
👑 OFJAAAH 👑 retweetledi
Stéphane - smo
Stéphane - smo@_smontlouis·
Je vous conseille de bouffer du matt pocock matin midi et soir. Je pense legit que c'est le meilleur architecte IA actuel. Ses skills sont excellents, ses vidéos sont excellentes tout ce qu'il fait est EXCELLENT. ZERO SLOP dans mes projets mes repos sont cleeaannnnnnn github.com/mattpocock/ski…
Français
36
201
2.3K
191.2K
👑 OFJAAAH 👑 retweetledi
shubs
shubs@infosec_au·
We've just released a high fidelity scanner for CVE-2026-41940 (cPanel/WHM authentication bypass). All public PoCs so far lead to false negatives, and are not reliable. @SLCyberSec's research team's notes on this here: slcyber.io/research-cente… & tool here: github.com/assetnote/cpan…
English
3
77
340
23.5K