Amin Nasiri @0xnxenon
Fan of reading RFCs and interested in playing with different versions of HTTP and web-related protocols & also inductive reasoning; a Hitchhiker when I am AFK aminnasiri.com Germany Joined February 2019-
Tweets152
-
Followers409
-
Following158
-
Likes468
I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!
I have added application/grpc-web+proto support in my extension. Now you can encode/decode these content-types automatically: - application/grpc-web-text - application/grpc-web+proto github.com/nxenon/grpc-pe… #burp #burp_extension #grpc_web #grpc_web_pentest
I also have an account on Blue Sky, drop me a follow if you are there too bsky.app/profile/nxenon…
You can bypass path-based WAF restrictions by appending raw/unencoded non-printable and extended-ASCII characters like \x09 (Spring), \xA0 (Express), and \x1C-1F (Flask):
You can wrap @0xnxenon's h2xspacex library pretty quickly in python to perform timing-related SPA tests. Here's a scoped-SSRF detection using that detects DNS behavior changing between 60 and 70 chars of the host header as explained in @albinowax's presentation
You can wrap @0xnxenon's h2xspacex library pretty quickly in python to perform timing-related SPA tests. Here's a scoped-SSRF detection using that detects DNS behavior changing between 60 and 70 chars of the host header as explained in @albinowax's presentation https://t.co/ZzYxmNXux9
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here -> portswigger.net/research/liste…
I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack. This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack. flatt.tech/research/posts…
I love the debate around storing JWTs in localStorage
When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦♂️ Awesome work! Never under-estimate the crazy.
When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦♂️ Awesome work! Never under-estimate the crazy.
Lovely to see the Email RFCs abused to embed a command injection payload in the local-part of the address! Nice work Michael Imfeld & @parzel2 modzero.com/en/blog/beyond…
Does Burp have plan to support HTTP/3 and quic @albinowax @Burp_Suite ? I think many websites now use HTTP/3 and hackers also need to upgrade their tools to hack the applications using H3 too.
@yu5k3 @irsdl @0xnxenon @PortSwiggerRes Turbo Intruder doesn't support the single-packet attack when run via the command line, since it leans on Burp Suite's network stack for HTTP/2 (I did code a native HTTP/2 stack for TI but it's really flaky). h2spacex is perfect for the standalone exploit use case.
Nice to know that UDP + (one protocol on it) can be as expensive as TCP (not from networking perspective), because of context switch between user space and the OS
For pentesting application/grpc-web+proto Content-Type see this short article: medium.com/@nxenon/hackin…
DOS in HTTP/2 implementations: According to my interest in HTTP/2 protocol and its attack like Rapid Reset Attack and Single Packet Attack, I would say that you have to read this too. Nice Job from Bartek.
DOS in HTTP/2 implementations: According to my interest in HTTP/2 protocol and its attack like Rapid Reset Attack and Single Packet Attack, I would say that you have to read this too. Nice Job from Bartek.
@rossjanderson Professor Ross Anderson, FRS, FREng Dear friend and treasured long term campaigner for privacy and security, Professor of Security Engineering at Cambridge University and Edinburgh University, Lovelace Medal winner, has died suddenly at home in Cambridge.
Some years ago, I may have said untyped programming languages are better and easier to code. Nowadays I would say that typed languages are better. Less runtime errors and when you want to edit a library or find out what the hell it is doing, definitely they help you with that؛
محمد صالح ت�... @twad_y10985
1 Followers 59 Following
Mohammad Owais @mohammadowais_x
525 Followers 25 Following Cyber Security Enthusiast. Security Engineer at @snap_sec
Satar @satar_nz
427 Followers 5K Following
Izhar @Izhar5711725495
0 Followers 101 Following
Talayi @Hosien_talayi
225 Followers 2K Following
JoYeates @2Lrdq5U5x0OUl3
81 Followers 1K Following
Yassin Elgammal @yassinelgammal0
113 Followers 2K Following
Daju @Daajuu
7 Followers 246 Following
Nahid Hasan Limon @nh___limon
341 Followers 2K Following Busy in learning to build and break the web 😴️✨️
Sunjang @sunjangyo14
1 Followers 134 Following
LIL NIX @thelilnix
3K Followers 903 Following Ethical Hacker, Bug Bounty Hunter, and Mentor. Interested in astronomy, psychology, browsers (R.I.P. to IE), and watches.
Aseem Yash 🇮🇳 @aseemyash01
167 Followers 5K Following Cybersecurity student not a pro yet (A lone fighter, carving my own path)
BetilløGalvan(ß2G) @BetilloGalvan_
933 Followers 6K Following Developer|CyberSecurityResearcher|DC664🔫|🇲🇽🤠🥷
ww4 @HiiNuclei94417
14 Followers 1K Following
COLLECTOR CRYPT/ Supp... @AmberJ80520
187 Followers 2K Following We sell RWA Pokemon cards on Solana | CA:CARDSccUMFKoPRZxt5vt3ksUbxEFEcnZ3H2pd3d KxYjp| https://t.co/S1A6TTKzAV
Glitobrar @Glitobrar9HB
36 Followers 4K Following
Ben @ClerkNPC
332 Followers 958 Following Rep the set, gotta rep the set. #OpenTheGreatHighway #ReplaceEngardio " Reverse Kramer #PolyMarket "
Shinobyx @crypticrebel337
23 Followers 1K Following Bug bounty hunter who is a bit inactive on social media, so don't expect too much from me here...
Luke Jahnke @lukejahnke
3K Followers 6K Following
Thamzhack @thamzhack
190 Followers 1K Following
jeff @jjjjefffff
5 Followers 124 Following
Smevoaez @SmevoaezJ5mi
23 Followers 452 Following
Gypysboy @self_unknown_
2 Followers 61 Following
ARI__ @NchSaad
61 Followers 855 Following
Hulda Kizzie @HKizzie4005
26 Followers 98 Following
Kian Shahi @MostPow3rful
732 Followers 977 Following || Web3 @Alectrona_eth || CTF Player @FlagMotori || Solidity-Foundry || Go, Py, JS, Bash
Charles Shirer @bsdbandit
25K Followers 26K Following A Hacker who is A Lover of People, and Life @RetroTwinz @Secbsd, @GrumpyHackers, @NovaHackers, @deadpixelsec @hacknotcrime Advocate @PositivelyBlue_ OSCP, OSWP
Brittany @Brittan80061797
10 Followers 413 Following I'm a single never married looking for a serious relationship
Packet Phantom @NtAlexio2
124 Followers 1K Following Offensive Developer | Cyber Security Enthusiast | Network Protocols Researcher | @Metasploit contributor | Enjoy breaking things and remaking them!
Circle @circle
247K Followers 437 Following Circle helps businesses and developers harness the power of @USDC for payments and commerce. NMLS ID# 1201441 https://t.co/qwq45JuM7N
M.Azadi - Vojood @mah_azadi
4K Followers 150 Following داستان رخداد خلق یک هویت فراتر از خِرَد اکانت شخصی م.آزادی - وجود
Offensive AI Con @OffensiveAIcon
637 Followers 12 Following The first conference dedicated to exploring the offensive use of AI. Request an invite at our site. #OffensiveAICon Oct 5-8, 2025 | Oceanside, San Diego
Kévin GERVOT (Mizu) @kevin_mizu
6K Followers 755 Following Researcher for @ctbbpodcast lab 🐛 | DOMLogger++ developer 👨🏻💻 | CTF with @FlatNetworkOrg, @rhackgondins 🦦 | @ECSC_TeamFrance 2023 🇫🇷
Compass Security @compasssecurity
3K Followers 111 Following Penetration Testing, Red Teaming, Incident Response, Bug Bounty, Security Training, Cyber Range
Byreal @byreal_io
29K Followers 86 Following The ultimate liquidity layer built for real assets. Incubated by @Bybit_Official
The Sandbox @TheSandboxGame
1.1M Followers 1K Following The Sandbox is a social gaming metaverse where you can play games, build worlds, and earn rewards.
Snapsec @snap_sec
3K Followers 0 Following All Your Cybersecurity Needs Centralized at One Place. Detect, Manage, and Remediate Vulnerabilities with Cutting-Edge Solutions.
Simaei @ArastehCma
686 Followers 1K Following Phd student at USC | Binary Analysis |EXIntern @Certik | EXIntern @Qualcomm | (ENFJ) a person who physically lives in LA and mentally in Iran.
Tucker Carlson @TuckerCarlson
16.5M Followers 2 Following
Cyber Saiyan | RomHac... @cybersaiyanIT
5K Followers 77 Following A community | RomHack Conference, Training and Camp - more info https://t.co/15V29skoWi
Ethereum @ethereum
4.0M Followers 0 Following The universal platform for crypto, blockchain apps, stablecoins & decentralized tech. An account about the Ethereum ecosystem maintained by @ethereumfndn.
Donald J. Trump @realDonaldTrump
108.8M Followers 53 Following 45th & 47th President of the United States of America🇺🇸
Voltage ⚡ @voltage_cloud
14K Followers 749 Following Lightning Payments Provider for exchanges, neo-banks, and Finserv innovators. Instant settlement payments at near-zero fees.
Lightning Labs⚡️�... @lightning
162K Followers 291 Following Lightning scales and speeds up #bitcoin. We build lnd, taproot assets, lightning loop.⚡️ Support: @lightning_help
Kresus Wallet @KresusOfficial
24K Followers 690 Following No seedphrase, easiest onboarding in all of crypto Your Base and Solana Wallet https://t.co/4YWK5y3FGn https://t.co/E9Ijk8sx5d https://t.co/Lv2guoN9zr
Alcardox @Alcardox
460 Followers 534 Following Invoker LoVer who loves #Cybersecurity and tries to become a bughunter | try - fail - learn - repeat | previous known as R1Cky :)
Volodya @volodiyah
613 Followers 448 Following Security Engineer interested in Program Analysis with applications in (de)obfuscation, antivirus evasion or vulnerability research.
Luke Jahnke @lukejahnke
3K Followers 6K Following
Binary Gecko @Binary_Gecko
1K Followers 1 Following Binary Gecko GmbH. Custom Security Research Solutions. Organisers of @offensive_con.
yan @bcrypt
75K Followers 329 Following security engineering @brave / helped build Let's Encrypt, Privacy Badger, and HTTPS Everywhere @eff / physics alum @mit / rabbit enthusiast
Elon Musk @elonmusk
225.4M Followers 1K Following
Santiago Víquez @santiviquez
3K Followers 1K Following DevRel @sodadata. Writing “The Little Book of ML Metrics” at https://t.co/AXgBKX33TE
Bluesky @bluesky
432K Followers 1 Following 🌐💬💙 From platforms to protocols. Bugs, feature requests, feedback: [email protected]
Practical DevSecOps @PDevsecops
2K Followers 104 Following The DevSecOps, AI Security and AppSec Training and Certification
Sina Yeganeh @Sin4Yeganeh
4K Followers 371 Following
Google Labs @GoogleLabs
83K Followers 71 Following Google’s home for our latest AI tools and experiments.
Trust Wallet @TrustWallet
4.3M Followers 351 Following The #1 crypto wallet for swaps, trusted by 200+ million people. $TWT
NULLCON @nullcon
22K Followers 2K Following International #Security Conference, Training & Exhibition Platform - the neXt security thing! ✈️Up next #NullconBerlin2025
Kian Shahi @MostPow3rful
732 Followers 977 Following || Web3 @Alectrona_eth || CTF Player @FlagMotori || Solidity-Foundry || Go, Py, JS, Bash
7h3h4ckv157 @7h3h4ckv157
51K Followers 117 Following Hacker (He/Him) | Hall of Fame: Google, Apple, NASA, 𝕏 (FKA Twitter) | Speaker: BlackHat MEA x1 | CVE ×4 | HTB Rank: Guru | P1 warrior - Bugcrowd | CS Engineer
HAHWUL @hahwul
11K Followers 257 Following 🔥 Offensive Security Engineer, Developer and H4cker. Feel free to call me HAH-hul or HOWL—whichever you prefer!
prin @fuxksniper
8K Followers 101 Following frankenstein coder, Hacker, Bug Bounty Hunter dead insyde CEO/Founder - @AcademyCipher
zseano @zseano
79K Followers 702 Following #1 Amazon Security Researcher. full time hacking team with @jonathanbouman @fransrosen @avlidienbrunn
OrangeCon @OrangeCon_nl
1K Followers 217 Following The New Dutch Cybersecurity Conference! Experience the Hackers Community in Amsterdam, on September 5th!
Dafydd Stuttard @DafyddStuttard
7K Followers 78 Following Founder and Chief Swig at @PortSwigger. Creator of @Burp_Suite and @WebSecAcademy. Author of The Web Application Hacker's Handbook.
PentestGPT @PentestGPT
22K Followers 0 Following AI-Powered Penetration Testing Assistant for offensive security testing, focused on web applications and network penetration testing.
pspaul @pspaul95
1K Followers 851 Following source code connoisseur @Sonar_Research | CTF @FluxFingers | @[email protected]
Pavel Durov @durov
2.7M Followers 1 Following Founder, CEO at @telegram (2013), founder, ex-CEO of @vkontakte (2006), part-time troll.
ArcherySec @ArcherySec
568 Followers 94 Following Vulnerability Assessment and Management Tool #OpenSource for #DevSecOps #DevOps #ArcherySec
Nicolas Krassas @Dinosn
146K Followers 735 Following Head of Threat & Vulnerability Mgmt @ Henkel AG & Co. KGaA https://t.co/NC1orlKrW3
bee @bee_sec_san
5K Followers 2K Following developer with 5+ million downloads Inventor of RustScan, Ciphey, PyWhat, Ares, Name-That-Hash, Search-That-Hash. @cisco @duosecurity @monzo @realtryhackme
Trend Zero Day Initia... @thezdi
83K Followers 16 Following Trend Zero Day Initiative™ (ZDI) is a program designed to reward security researchers for responsibly disclosing vulnerabilities.
Martin Doyhenard @tincho_508
3K Followers 227 Following Security Researcher at PortSwigger. Speaker at BlackHat, DEF CON, RSA, Hack In The Box, Troopers, EkoParty
Daniel Cuthbert @dcuthbert
32K Followers 2K Following Documentary photographer, old creaky hacker. Co-author of @OWASP ASVS standard. Blackhat/Brucon Review Board & Co_chair UK Gov Cyber Security Advisory BoardTrends for United States
You might like
