0xba3ba4 @0xba3ba4

Electronic engineer. I hack vulnerable devices for a better world. All opinions are my own. Retweets are not endorsement. Cybersec related account of @barban74. 127.0.0.1 Joined October 2016

Tweets

5K
Followers

507
Following

2K
Likes

3K

Shah Sheikh @shah_sheikh

a week ago

[TheHackersNews] FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available. The Sangoma FreePBX Security Team has issued an advisory warning about an actively exploited FreePBX zero-day vulnerability that impacts systems with an... ow.ly/xYFM106keng

0 1 1 32 1

Sherpa @LLMSherpa

2 weeks ago

Novel jailbreak discovered. Not only does OpenAi putting your name in the system prompt impact the way GPT responds, but it also opens the model up to a prompt INSERTION. Not injection. You can insert a trigger into the actual system prompt, which makes it nigh indefensible.

74 239 4K 623K 2K

Download Image

0xdf @0xdf_

4 weeks ago

Zero from @hackthebox_eu via @vulnlab_eu releases this week. It's all about exploiting Apache. I'll abuse .htaccess files to get a foothold. Then I'll fake process names in the process list and overload a parameter to get a rogue Apache process running. 0xdf.gitlab.io/2025/08/12/htb…

0 21 83 4K 23

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

4 weeks ago

HTTP Request Smuggling In Bug Bounty Hunting medium.com/@zodiacHacker/… #bugbounty #bugbountytips #bugbountytip

1 17 78 5K 69

Hackmanac @H4ckmanac

4 weeks ago

🚨Critical WinRAR Zero-Day Exploited. PATCH NOW A critical WinRAR zero-day (CVE-2025-8088, CVSS 8.8) is actively exploited via path traversal to execute code. Patched in v7.13 (July 31, 2025), it was used by the Paper Werewolf (GOFFEE) hacking group, allegedly bought for…

1 60 140 16K 44

Download Image

James Kettle @albinowax

a month ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 250 746 75K 334

Pethuraj M @Pethuraj

4 weeks ago

📌 𝐏𝐞𝐧𝐭𝐞𝐬𝐭 𝐓𝐢𝐩 If you want to find API authorization flaws easily, try using 𝗔𝘂𝘁𝗼𝘀𝘄𝗮𝗴𝗴𝗲𝗿. It extracts & categorizes endpoints from OpenAPI specs to accelerate auth testing and attack surface mapping. 🔗 github.com/intruder-io/au… #Cybersecurity #bugbountytips

0 133 671 33K 701

Download Image

ransomNews @ransomnews

4 weeks ago

⚠️ WinRAR 0day abused in phishing to deploy RomCom malware WinRAR’s zero-day flaw (CVE-2025-8088), fixed in v7.13, was used in phishing RAR files to drop executables into Startup folders, triggering RomCom malware on login. RomCom (aka UNC2596) is a Russia-linked group behind…

0 131 417 32K 187

Download Image

I am Jakoby @I_Am_Jakoby

6 months ago

PowerShell for Hackers is LIVE. 💻 A fully interactive Windows-like hacking playground 📜 A blog to share PowerShell hacking techniques 🎯 CTFs, tools, payloads, and more... 👀 Explore it now: powershellforhackers.com I reccomend starting with the first blog post which should…

39 166 797 65K 680

Download Image

Swissky @pentest_swissky

9 months ago

🚀 Big Announcement! 🚀 After 8+ years of working on PayloadsAllTheThings, I’m excited to release it as an ebook on Leanpub! 📖✨ To celebrate, I’m gifting 5 free copies to random retweeters! 🔥 👉 Retweet for a chance to win Thank you all for your incredible support! 🙌…

9 146 169 30K 25

Swissky @pentest_swissky

4 weeks ago

Claude is competitive with humans in (some) cyber competitions red.anthropic.com/2025/cyber-com…

1 2 11 2K 6

Michael Bargury @mbrg0

a month ago

we hijacked microsoft's copilot studio agents and got them to spill out their private knowledge, reveal their tools and let us use them to dump full crm records these are autonomous agents.. no human in the loop #DEFCON #BHUSA @tamirishaysh

107 904 9K 1.2M 7K

Download Image

Shah Sheikh @shah_sheikh

a month ago

[Dark Reading] Google Gemini AI Bot Hijacks Smart Homes, Turns Off the Lights. Using invisible prompts, the attacks demonstrate a physical risk that could soon become reality as the world increasingly becomes more interconnected with artificial... ow.ly/JzgK106iaEp

0 1 1 24 1

Hunter @HunterMapping

a month ago

🚨Alert🚨 :CVE-2025-54574:Critical Squid Vulnerability Allows Remote Code Execution & Data Leakage 📊66.9M+ Services are found on the hunter.how yearly. 🔗Hunter Link:hunter.how/list?searchVal… 👇Query HUNTER : product.name="Squid" FOFA : product="squid"…

0 35 97 19K 46

Download Image

Sam Bent @DoingFedTime

a month ago

Intel ME (Management Engine) runs below your OS with network access even when powered off. AMD PSP (Platform Security Processor) provides similar backdoor functionality.

93 523 4K 241K 2K

Download Image

𝖽𝖺𝗎𝗌 @vicevirus2

a month ago

Found a simple command injection vuln in CodeIgniter 4 ImageMagick handler with the help of LLM agent. Nothing too complex or mindblowing, but it's fun to tap into AI agents again at this time :) Detailed blog post about the vuln: vicevirus.github.io/posts/cve-2025…

8 35 124 6K 57

Andy Zou @andyzou_jiaming

a month ago

We deployed 44 AI agents and offered the internet $170K to attack them. 1.8M attempts, 62K breaches, including data leakage and financial loss. 🚨 Concerningly, the same exploits transfer to live production agents… (example: exfiltrating emails through calendar event) 🧵

70 394 2K 517K 2K

Download Image

RocketGod @jeremyyablan

2 months ago

#flipperzero Reverse Engineering SubGHz Protocols. Reversing the Russian car stealing firmware. This is an app I made to force Flipper Zero into reverse engineering itself, decrypting Keeloq manufacturer codes and giving up memory addresses of all protocol parts for later use.

3 2 36 3K 25

Download Video

GiamMa-based researchers SDR R&D IoT @giammaiot2

a month ago

@Zappit3 @mrTeigen @cemaxecuter Nothing secret for the technicians, using special firmware for Flipper Zero, known as 'Flipper Unleashed,' it becomes possible to decode even the counter (Cnt) for many key fobs from various manufacturers. From December 08, 2023 securitum.com/hacking_the_in…

1 8 20 5K 23

Download Image

0xdf @0xdf_

2 months ago

NeoVault from the HackTheSystem Bug Bounty-themed CTF challenge from @hackthebox_eu abuses an older API to find an IDOR vulnerability. Then I need to find the right ID, either by snooping on requests when sending money or brute forcing Mongo object IDs. youtube.com/watch?v=tbbL4h…