Corben Leo @hacker_

I hack stuff (legally) | Jesus follower | Co-founder @boringmattress boring.co Brookings, South Dakota Joined February 2016

Tweets

4K
Followers

68K
Following

698
Likes

10K

Corben Leo @hacker_

a week ago

And @boringmattress is live on @ProductHunt 😅 producthunt.com/posts/boring-m…

6 3 55 17K 1

You are loved by your creator. “Very rarely will anyone die for a righteous person, though for a good person someone might possibly dare to die. But God demonstrates his own love for us in this: While we were still sinners, Christ died for us.” - Romans 5:7-8 On the third day,…

Mike Beckham @mikebeckhamsm

4 weeks ago

18 17 182 37K 17

3 4 62 11K 5

Corben Leo @hacker_

a month ago

I switched from Superhuman to @Shortwave. Highly highly recommend.

5 3 26 8K 7

Corben Leo @hacker_

2 months ago

You're using Burp Collaborator wrong. Don't use Burp's default collaborator instance when testing for out of band vulnerabilities. Many companies use egress filtering & block outbound traffic to the default collaborator domain oastify.com It's worth setting up a…

7 96 435 35K 449

Corben Leo @hacker_

2 months ago

Doing code analysis? Use cursor.sh by @anysphere! Whether you’re digging through a language you know or adventuring into a new one, using AI can definitely be helpful. Don’t think it’ll replace us yet, but auditing got more accessible. #typefully day 10

2 38 216 16K 185

Download Image

Corben Leo @hacker_

2 months ago

Finding vulnerabilities first = you get paid. Want to be the first to hack on new functionality? Monitor your target’s JS files for new paths or parameters. (automate with a headless browser to grab all dynamically loaded JS) #typefully day 9

4 24 243 19K 177

Corben Leo @hacker_

2 months ago

Focus is a competitive advantage. It’s tempting to jump around, but deep focus on one thing pays off. This applies beyond hacking, but you should stick to a target for a long time and become an expert. For example, @nnwakelam knew more about Yahoo than any Yahoo employee…

3 19 174 17K 60

Corben Leo @hacker_

2 months ago

You're probably directory brute-forcing wrong. You should be methodical when targeting frameworks such as Express, Rails, Flask, Django, etc. 2/ By default, ffuf uses the GET HTTP method. You should be fuzzing with different HTTP methods. Try using a wordlist multiple times…

3 87 408 31K 459

Download Image

Corben Leo @hacker_

2 months ago

Companies run software they don't write. Ex: Jira, GoAnywhere, etc. Finding vulns in these types of software = lots of vuln targets = $$$ So, do code review! Need the source? Find the software AWS's AMI Catalog. Launch a server. SSH in. Pull it. Review it #typefully day 4