thechiefumar @thechiefumar

Joined April 2026

Tweets

15
Followers

0
Following

115
Likes

17

Alisa Esage Шевченко @alisaesage

4 days ago

Wrote some exploits for Chrome recently. A little teaser article:

Zero Day Engineering @zerodayalpha

5 days ago

New Zero Day Engineering research: Chrome Exploit Mitigations, by @alisaesage zerodayengineering.com/research/chrom…

0 33 111 18K 69

2 13 115 12K 51

View Details

slash1s @slash1sol

3 days ago

A LINUX KERNEL DEVELOPER PROVED THE THING YOU PUSH CODE TO IS SECRETLY A DATABASE THAT CAN VERSION ALMOST ANYTHING AND THAT MOST DEVS HAVE ONLY EVER TOUCHED A TENTH OF IT 42 minutes from Josh Triplett -- a longtime Linux kernel and Debian developer -- showing that Git is a general-purpose, tamper-evident versioning engine that just happens to be famous for code. -> The moment it clicks, Git stops being "Where my code lives" and becomes what it really is underneath: a content-addressable store that can version almost anything -- your configs, your notes, your servers' state, entire datasets. People run whole wikis on it. They version their entire machine's configuration with it. They ship websites by pushing to it. They track data too big to email. None of it is a hack -- it's the same handful of objects you already use for code, pointed somewhere new. Treating Git as a code-only tool was never the ceiling -> it's a versioning engine for anything, and the people who see that automate what the rest of the team still does by hand. And as AI agents start spitting out not just code but configs, docs and data, the one system that can version and audit all of it at once is already sitting on your machine. You learned five commands to survive. This is the talk that shows you were standing on top of a database the whole time. It changes what you think the tool is even for. Bookmark & Watch it today ↓

slash1s @slash1sol

4 days ago

ONE OF THE MINDS BEHIND JAVA GAVE A LECTURE WHERE HE BANNED HIMSELF FROM USING ANY BIG WORD UNTIL HE DEFINED IT FIRST AND IN DOING SO QUIETLY EXPLAINED HOW EVERY GREAT SYSTEM GETS BUILT A talk from Guy Steele -- co-author of the Java spec and a designer of Scheme -- where the

28 65 638 351K 1K

57 292 3K 374K 5K

View Details

bugcrowd @Bugcrowd

3 days ago

What to LOOK for when hunting for IDORs? 👀 @InsiderPhD shares some solid tips and insight on why you shouldn’t be intimidated by unpredictable IDs. Check it out. 👇

1 8 80 4K 37

View Details

The XSS Rat - Proud XSS N00b :-) @theXSSrat

4 days ago

Mass assignment bugs hide in plain sight on most SaaS apps. 10-minute playbook: 1. Find an update endpoint. PUT /api/users/me, PATCH /profile, GraphQL updateUser. Any "save settings" feature. 2. GET the resource first. Read the ENTIRE response — including fields the UI never displays. role, plan, isAdmin, emailVerified, balance, organizationId, kycStatus. Those are targets. 3. Send the GET body back as PUT/PATCH. Most backends accept it because devs use "spread body into model" patterns (Object.assign, _.merge, Rails update_attributes, Mongoose findByIdAndUpdate). 4. Flip interesting fields one at a time. {"role":"admin"}, {"isAdmin":true}, {"plan":"enterprise"}, {"emailVerified":true}, {"balance":999999}. 5. Try BOTH casings. is_admin vs isAdmin. Backends check one, accept the other. 6. Try nested. {"user":{"role":"admin"}}. Deep-merge endpoints eat these. 7. Same trick on CREATE. POST /projects with "ownerId":"" = IDOR by creation. POST /invites with "role":"owner" = priv esc. 8. Confirm with a re-fetch. Privileged field changed = impact. Trap: hunters look for input VALIDATION bypass and miss input EXISTS bypass. The field shouldn't be writable at all. Tooling: Burp Param Miner with a custom wordlist (role, admin, isAdmin, plan, balance, emailVerified, organizationId, ownerId, kycStatus). Brute-forces hidden params via response diffing. Report on IMPACT. "API accepts role param" = info. "Set role to admin, read /admin/customers, exfil 40k records" = critical. Chain privilege change to data reached. Your best mass-assignment find

0 5 42 2K 43

View Details

The XSS Rat - Proud XSS N00b :-) @theXSSrat

6 days ago

Curious what "learn web hacking" actually looks like from day one? 🐀 The 901 Beginner Bundle is the path I wish I'd had — labs, mindset, your first XSS. Peek inside (discount baked into the link): thexssrat.podia.com/901-beginner-w… #bugbounty #hacking

0 3 14 881 9

View Details

Smukx.E @5mukx

5 days ago

@github I can login and make changes to my repository but others aren't able to view my profile and repositories:

0 2 24 2K 1

View Details

Smukx.E @5mukx

5 days ago

Hey @github . My github profile Whitecat18 was accidentally flagged without prior mail and activies, i was trying to push my code from dev to main branch. I can login, but my profile shows a public 404 error. Appeal submitted under ticket ID: #4440743. Kindly look and resolve the issue.

9 8 82 11K 8

View Details

vx-underground @vxunderground

6 days ago

18 216 4K 56K 170

View Details

Yuvraj Singh (smolhub.com) @YuvrajS9886

6 days ago

Found this amazing book on creating an os from scratch!

7 69 570 20K 605

View Details

dawgyg - WoH @thedawgyg

6 days ago

loving seeing others succeed <3

Azanul @0xazanul

a week ago

after seeing @thedawgyg fuzzing posts, i started learning about fuzzing myself. the results so far have been encouraging: interesting crashes, memory corruption indicators, and plenty more to dig into. #TogetherWeHitHarder #bugbounty

21 8 240 20K 121

2 4 110 7K 18

View Details

Medusa @medusa_0xf

5 days ago

Unpopular opinion: 90% of bug bounty content teaches people how to find low-hanging fruit. Very little teaches how to think like an attacker and chain vulnerabilities for real impact. That’s exactly what this playlist covers. If your methodology starts and ends with automated scans, you’re probably going to hate it. 🥱 youtube.com/playlist?list=…