mrroot @_mohd_saqlain

I teach systems to misbehave — creatively \r\n Application Security Engineer | https://t.co/qtnfutkZkK mrrootsec.vercel.app INDIA 🇮🇳 Joined November 2013

Tweets

3K
Followers

873
Following

407
Likes

12K

d4d @zakfedotkin

3 days ago

We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings: portswigger.net/research/cooki…

3 63 206 15K 145

H4x0r.DZ @h4x0r_dz

2 days ago

ViewState Deserialization Zero-Day Vulnerability cloud.google.com/blog/topics/th…

0 10 122 7K 76

Swissky @pentest_swissky

3 days ago

How to find bugs on a hardened target using gadgets - @aituglo bugcrowd.com/blog/how-to-fi…

0 12 60 4K 45

Max Yaremchuk @0xw2w

3 days ago

Facebook Messenger for Windows RCE worth $112K via Slack/Viber DLL files override using path traversal in attachments by @vulnano vulnano.com/2025/09/remote…

1 41 181 18K 87

As an engineer, I ❤️ clever engineering. Ruby on Rails relies on signed sessions (AES GCM). They are secure, but there is a catch: you cannot invalidate them early. You have to wait for expiry. Workarounds exist, like caching sessions you want to kill, but nothing universal.

2 5 35 7K 7

HAHWUL @hahwul

5 days ago

Interesting post about Client-side RCE and CSS Injection! balintmagyar.com/articles/googl…

0 3 10 712 12

freakyclown @_Freakyclown_

2 weeks ago

New tool drop: JsonViewer 🚀 Stop scrolling through JSON like a raccoon in a dumpster. 👉 Clean, searchable tables 👉 Bookmarks, filters, exports 👉 Runs in your terminal (SSH/VPS/local) GitHub: github.com/freakyclown/js… YouTube demo: youtube.com/watch?v=j8yrV7… make JSON suck less.

1 24 94 22K 107

jeppojeps - Antonio Nappa @jeppojeps

3 weeks ago

For YOU interested in JS exploitation: 2nd episode dissecting the current state of the art. Ready for fakeobj() ? We are looking for you at fuzzsociety.org to learn vulnerability research together, from scratch. youtu.be/hZU_KsShXGk +slides +docker

0 27 106 9K 96

Sean Kahler @battledashdev

11 months ago

Just published a new write-up - Hacking 700 Million Electronic Arts Accounts battleda.sh/blog/ea-accoun…

12 93 366 47K 236

Swissky @pentest_swissky

4 weeks ago

Sleepless Strings - Template Injection in Insomnia - @TantoSecurity tantosec.com/blog/2025/06/i…

0 13 38 3K 24

James Kettle @albinowax

a month ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 250 746 75K 335

Ethiack @ethiack

a month ago

What happens when a WAF blocks every XSS payload you throw at it? You get creative. 🔗 Read the full blog post: blog.ethiack.com/blog/bypassing…

5 43 152 14K 139

sapir federovsky @sapirxfed

a month ago

This post is SO GOOD! I knew nothing about easy auth, It's so interesting! And the abuse ideas are so creative! It's not the first time i see how env variables on app lead to such things (See MI research by NetSpy). Go read it! dazesecurity.io/blog/abusingEa…

1 12 76 6K 43

Kévin GERVOT (Mizu) @kevin_mizu

a month ago

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4

11 167 437 33K 284

Download Image

dbugs @ptdbugs

2 months ago

1/4 dbugs LIVE dbugs.ptsecurity.com — vulnerabilities’ home See trends, discover more, read AI summaries, have all references at hand, and your profile with all your CVEs and CVSS score on a leaderboard. ⬇️ See thread: what’s live + what’s next ⬇️

3 36 116 34K 126

Download Image

GMO Flatt Security Inc. @flatt_sec_en

2 months ago

New blog out! Think XSS is a thing of the past with today's Web frameworks? Think again! Our new article by @i_am_canalun breaks down why this vulnerability persists and offers insights on how to stay secure. Read it here! flatt.tech/research/posts…

0 9 44 4K 24

Sam Curry @samwcyo

2 months ago

When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We (@iangcarroll and I) discovered a vulnerability that could allow an attacker to access the over 64 million chat records using the password "123456". ian.sh/mcdonalds

18 123 471 37K 189

ramsexy @plmaltais

2 months ago

Just dropped a new CSP bypass for salesforce.com on cspbypass.com : <script src="omtr2.partners.salesforce.com/id?callback=al…"></script>

0 25 145 7K 95

Brett Buerhaus @bbuerhaus

2 years ago

Reversing and Tooling a Signed Request Hash in Obfuscated JavaScript buer.haus/2024/01/16/rev… Thanks to @hackinghub_io for putting together a lab to learn more about it: app.hackinghub.io/surl

20 162 519 91K 342

Download Image

chux @chux13786509

2 months ago

Hackers 🔥 I’ve set up this Nginx that forwards traffic to a Flask server and blocks access to /secret - throwing 403 🛑 Can you find a way to bypass this restriction and access /secret? 🥷 Drop your ideas or tricks in the replies — let’s see how creative you can get! ⚡️