Abss @absshax

Sporadic Bug Hunter. Aspiring Security Researcher. Cats. Techno 🎧. Tweets only relate to things I find Interesting. abss0x7tbh.github.io India Joined November 2017

Tweets

499
Followers

1K
Following

642
Likes

2K

Atiq @atiq_gauri

4 days ago

Transformer Visualized: How GPT decides "Paris" with live GPT-2 running in browser Created with @OpenAI GPT 5.5 and @AnthropicAI Opus 4.7

2 4 8 1K 7

View Details

RCE in Warp Terminal! I believe the attack surface is broadening with every new tool you use. Every OAuth app you authorise with elevated scopes.. we'd see more breaches via targeting tools/SaaS.. the attack surface is everyone and everything now - hacktron.ai/blog/the-attac…

1 12 46 3K 25

View Details

Preben @prebenve

3 weeks ago

Found a cool bug at Meta. From misconfigured Grafana instance to R/W access on 507 private Meta repositories. Wrote up the full chain here: sectricity.com/blog/misconfig… $157k bounty awarded by @metabugbounty

24 129 806 69K 616

View Details

Abss @absshax

2 months ago

@hg_sandesha @bcpsouth @KarnatakaCops @DgpKarnataka @BlrCityPolice look into this

0 0 0 135 0

View Details

Eib @eib_____

2 months ago

A write-up about an interesting SSRF chain I found earlier this year eib.hashnode.dev/crafting-a-ful…

1 27 150 9K 112

View Details

Abss @absshax

3 months ago

First autonomous bug bounty paid out. Interesting times ahead!

0 0 1 154 1

View Details

Abhishek Joshi 👨‍💻🐶 @kaalicharan

3 months ago

This incredibly gentle 2-year-old cat is fully vetted (neutered, vaxxed, litter-trained) and promises to purr your ears out. 🐈🐾 📍 South Delhi 📨 [email protected] Even if you can't give him a home today, a RT could change his life! 🙏

6 321 630 15K 17

View Details

Graham Helton (too much for zblock) @GrahamHelton3

5 months ago

Excited to disclose my research allowing RCE in Kubernetes It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout. Unfortunately, this will NOT be patched.

47 376 3K 414K 2K

View Details

André Baptista @0xacb

5 months ago

@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯 @claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments. All fixed in v1.0.93 by switching from blocklists to allowlists. Blog link 👇 flatt.tech/research/posts…

0 13 65 3K 34

View Details

Abss @absshax

7 months ago

I earned $3,000 for my submission on @bugcrowd bugcrowd.com/absshax #ItTakesACrowd RCE via dependency confusion!

0 0 3 254 0

View Details

Harsh Jaiswal @rootxharsh

7 months ago

With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards. This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings. Read here - hacktron.ai/blog/jdbc-audi…

13 81 335 53K 267

View Details

Abss @absshax

8 months ago

@monkehack So true lol

0 0 1 123 0

View Details

Abss @absshax

9 months ago

@Hack_All_Things Rest In Peace🙏🏽

0 0 0 570 0

View Details

Abss @absshax

9 months ago

This was a fun find during a recent pentest! CDN eventually displays images leaking AWS temp creds. appsecengineer.com/blog/pixelated… OG Read: buer.haus/2019/10/18/a-t…

0 0 4 276 1

View Details

zere @j_zere

10 months ago

Just published my first blog post "Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover" You can read the full write-up here: zere.es/posts/cache-de…