Профиль

Project Raven Box (1970s) – Underground builders sold custom “black boxes” that simulated coin tones, letting phreakers make free pay-phone calls worldwide until Bell finally changed its signaling. #Hackers

Every “no” is just getting you closer to the “yes.” #bugbounty #grind

burp crashed again. i think it deserves a bounty. #bugbounty

What’s your pre-report ritual before hitting “Submit”? #BugBounty

How often do you revisit old programs after a scope expansion? #BugBounty

The 414s (1983) – A group of Milwaukee teens dialed into dozens of government and corporate systems—including Los Alamos National Lab—sparking the first U.S. Senate hearing on computer crime. #Hackers

funny how the broken things always hide behind the prettiest UIs. #bugbounty

ever find a vuln that makes you say “no way this is real” out loud? #bugbounty

The Max Headroom Broadcast Intrusion (1987) – Chicago TV viewers watched a hacker in a Max Headroom mask hijack two prime-time broadcasts using a rogue microwave link. The culprit was never caught. #hackers

LLM hallucinations feel like chatting with a confident liar. #AIsecurity

Probe every parameter. Don’t just test id=. Try integer fuzzing, negative numbers, encoded payloads, and nested JSON keys. Even “read-only” params can hide IDOR or injection bugs. #BugBounty

funny how “deprecated” endpoints are usually the most alive. #bugbounty

tracebit ran the context bomb through 100+ simulated attack runs in a fake aws environment. the whole idea is one content change to bait you already run. no new tooling, no new system. just a string that makes the attacker’s own model refuse itself. www.toxsec.com/p/context-bo...

Context Bombs: Defensive Prompt Injection TrapsA decoy secret loaded with text built to trip an AI attacker’s own safety training, so the model refuses itself.www.toxsec.com

How many Burp tabs is “too many” before you lose track? #BugBounty

sometimes the grind feels endless, but persistence is the real exploit. #bugbounty #motivation

The biggest risk in “serverless” is believing it means “securityless.” #Cybersecurity

your #AI injection defense has a blind spot: it can't tell you when it fails. a #classifier that misses an attack doesn't raise its hand. you find out from a support ticket.

model stealing sounds fancy until you realize it’s just downloading weights like a pirate. #machinelearning

Lockpick Village – Physical security meets hacking: attendees learn to pick real locks, often opening “secure” high-end cylinders in under a minute. A DEF CON tradition that’s outlived several encryption algorithms. #defcon

it’s always the endpoints with “test” in the name that give the best surprises. #bugbounty