D_J @D_J_Hack

#bug_hunter #hackerone #bugcrowd India Joined May 2012

Tweets

1K
Followers

521
Following

749
Likes

2K

skull @brutecat

a month ago

Hacking Google with A.I. for $500,000 brutecat.com/r/hacking-goog…

63 533 3K 353K 3K

View Details

James Kettle @albinowax

2 months ago

It's really cool to see people exploring taking the single-packet attack even further with HTTP/3! Excited to integrate these techniques directly into @Burp_Suite in future.

New paper out on race conditions & last frame synchronization in HTTP/3 🚀 🔗 link.springer.com/article/10.100… Highlights: • Analysis of last frame synchronization in HTTP/3 • Tools & libraries with clean APIs for researchers • Comparison of attack effectiveness: H2 vs H3

1 27 103 27K 109

2 15 137 23K 69

View Details

Elon Musk @elonmusk

2 months ago

Accurate

Brian Halligan @bhalligan

2 months ago

I don't remember where I found this, but its spot on.

735 6K 32K 45.1M 8K

5K 27K 234K 44.0M 29K

View Details

Mike Takahashi @TakSec

2 months ago

Learn how to hijack an AI agent with a single email. Join me and @NahamSec as we dive into hacking 3rd-party connectors in AI agents

Ben Sadeghipour @NahamSec

2 months ago

Plug in Gmail, Calendar, Notion, your whole life, and one phishing email can hijack the agent and walk out with your password resets, 2FA codes, and crypto wallet recovery. @TakSec broke down a real POC he got paid for 👇 youtu.be/_3TfHEfVvCQ

6 7 80 31K 53

6 15 91 21K 69

View Details

Shad0w @Itx_Shad0w

4 months ago

For years, Google API keys (AIza...) had little to no real-world impact. But recently, many of them unexpectedly gained access to Google Gemini. curl "generativelanguage.googleapis.com/v1/models?key=…" This appears to be a widespread misconfiguration that can be hunted in the wild.

15 49 491 34K 400

View Details

Jenish Sojitra @_jensec

6 months ago

Sharing my Burp Extension that earned me $200k in 2025 while API testing heavy JS-rich targets. github.com/jenish-sojitra… The tool helps find endpoints, files, internal emails, and some secrets from minified JS. Its goal is to achieve maximum efficiency with reduced noise in results. Contributions and feedbacks are welcome.

39 409 2K 128K 3K

View Details

James Kettle @albinowax

9 months ago

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

22 181 1K 140K 1K

View Details

PentesterLab @PentesterLab

10 months ago

A good mix of everything to please everyone: CVEs, AI, Integrity Bypass and Unicode 🛠 blog.doyensec.com/2025/09/02/ksm… 🔐 blog.trailofbits.com/2025/09/03/sub… 📰 blog.kulkan.com/in4m-keeping-u… 🤖 executiveoffense.beehiiv.com/p/ai-hackbots-… 🍪 portswigger.net/research/cooki…

2 19 72 6K 51

View Details

James Kettle @albinowax

a year ago

It's easy to bash vulnerabilities with logos but... I couldn't resist, say hello to http1mustdie.com :)

15 88 478 51K 183

View Details

Thomas Roccia 🤘 @fr0gger_

a year ago

🤓 If you want to learn more about MCP attacks or vulnerabilities, check out this project called Damn Vulnerable MCP. It allows you to experiment on MCP server security through 10 challenges, from basic prompt injection to multi-vector attacks. github.com/harishsg993010…

3 27 119 10K 105

View Details

Intigriti @intigriti

a year ago

Even though common CORS attack vectors have been mitigated... It still remains exploitable! 🤠 Open this thread to master CORS misconfiguration vulnerabilities! 🧵 👇

1 17 113 9K 111

View Details

Masato Kinugawa @kinugawamasato

a year ago

lol, this works on Firefox: <object data=# codebase=javascript:alert(document.domain)//> OR <embed src=# codebase=javascript:alert(document.domain)//>

9 68 468 42K 333

View Details

Yasho @YShahinzadeh

a year ago

How did we (@AmirMSafari) earn $50k using the Punycode technique? I’ve published a detailed blog post about our recent talk, we included 3 attack scenarios, one of which poses a high risk of account takeover on any "Login with GitLab" implementation blog.voorivex.team/puny-code-0-cl…

26 151 712 100K 563

View Details

James Kettle @albinowax

a year ago

I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame", at #BHUSA! This is going to be epic, check out the abstract for a teaser ↓↓↓

29 101 615 88K 150

View Details

Tal Be'ery @TalBeerySec

a year ago

The $64k Bounty: Automating secret extraction from GitHub to win $64K in bounties. Loved the way Sharon glued his @github internals knowledge, existing tools (@trufflesec trufflehog), cloud and AI to automate at scale. medium.com/@sharon.brizin…

0 5 26 3K 23

View Details

James Kettle @albinowax

a year ago

Blind CSS exfiltration attacks recently got a lot easier! Full details in this thread:

slonser @slonser_

a year ago

I think many people are familiar with the topic of blind CSS exfiltration, especially after the post by @garethheyes However, an important update has occurred since then, which I wrote below ->

2 79 362 48K 314

3 35 208 16K 111

View Details

James Kettle @albinowax

a year ago

Detect the NextJS middleware bypass directly in Burp Suite with this BCheck from @eternalky_u gist.github.com/fourcube/45a78…

0 85 383 27K 207

View Details

JS0N Haddix @Jhaddix

a year ago

Introducing @arcanuminfosec 's hack_tips! We will begin posting some of our team's best bite-sized content on our repo. This stuff comes from slack, internal wikis, bug bounty history, etc. Our 1st commit is all about Actuators Enjoy! github.com/Arcanum-Sec/ha…

0 33 195 10K 116

View Details

KNOXSS @KN0X55

a year ago

Do you know why most of our #XSS payloads start with a "1" ? 🤔 Besides to appear as a regular alphanumeric input (not lead by any special char) it's mainly to exploit a validation vulnerability named TYPE JUGGLING. #KNOXSS is on another level.