Uranium238 @uraniumhacker

I do the hacks. He/him. Building and hacking stuff at @OphionSecurity United States Joined August 2016

Tweets

3K
Followers

12K
Following

526
Likes

3K

Uranium238 @uraniumhacker

a year ago

Every critical I find in major corp has been through the most obscure feature that is annoying as hell to setup. It never ceases to give.

The harder the configuration, the more the bugs. I used to give up when something was very annoying to setup, but it attracts me more now. Apparently, almost everyone avoids those, which leads to really simple yet impactful findings :P

7 5 74 7K 14

1 4 38 3K 9

View Details

Uranium238 @uraniumhacker

a year ago

@jackhcable with the receipts 😂

Jack Cable @jackhcable

a year ago

Hey @im_roy_lee, your employee @Kevining filed this request. As the CEO, I'd expect you to be on top of these things and take responsibility. Making legal threats is no joke. Here's the full takedown notice I received: gist.github.com/cablej/ff2a0fc…

30 37 2K 453K 259

0 0 0 266 0

View Details

Uranium238 @uraniumhacker

a year ago

@S1r1u5_ Can confirm. Been using LLMs and Claude/Grok mixture as a rubber ducky to explain my thought process and work on reversing some codes. It has made the process 10x faster.

0 0 4 493 0

View Details

Uranium238 @uraniumhacker

a year ago

@zhoro_x @InterviewCoder @im_roy_lee Might be worth for GitHub to start at least alerting on JWT as well in addition to their current coverage: docs.github.com/en/code-securi…

0 0 5 2K 1

View Details

Uranium238 @uraniumhacker

a year ago

@R3PL1C8R @zhoro_x @InterviewCoder @im_roy_lee GitHub does for some token types (vendors have to register in most cases). Registered vendors when notified auto deactivate tokens. GitHub does it themselves for their own api keys. docs.github.com/en/code-securi…

1 0 3 164 0

View Details

Uranium238 @uraniumhacker

a year ago

@mrusschen 100%

0 0 0 86 0

View Details

Uranium238 @uraniumhacker

a year ago

Hacking with AI recently has been fun. Here is couple of things I did recently: - Parsed multiple JS files within seconds after identifying a target domain. Used the parsing data to find a critical vulnerability. - For a different program, used mixture of redress, radare2 and GPT-4o to reverse engineer a pretty large golang based server. The more I prompt, the more I am convinced automating hacking with AI is the future. #aihacking #hackbot #LLM

2 0 9 1K 15

View Details

Uranium238 @uraniumhacker

a year ago

@rez0__ Damn you got my cheatcode.

0 0 1 1K 0

View Details

Uranium238 @uraniumhacker

a year ago

getting ready to hack and send criticals

1 0 1 872 0

View Details

Uranium238 @uraniumhacker

a year ago

@jobertabma Honestly, should do this for LHEs 🤣

0 0 1 340 0

View Details

Uranium238 @uraniumhacker

a year ago

We are doing #vibesecurityForAI If you are an AI startup (pre-seed or seed ) we will test your application for free. We are doing this only for next two weeks. We are hackers who have hacked major companies like Zoom, AWS, Amazon, Google, banks and more. DM me or contact us @OphionSecurity. #AISecurity #vibecoding #pentest #securityassessment #vibesecurity

2 0 1 1K 1

View Details

Uranium238 @uraniumhacker

a year ago

Presenting on some fun stuff with @OphionSecurity this year at @_kernelcon_ and @bsidesseattle. Come for the talk, stay for the vulnerabilities. #vulnerabilities #bugbounty #attacksurfacemanagement

0 2 1 1K 2

View Details

Uranium238 @uraniumhacker

a year ago

@rez0__ You can't vibe code to production but you can damn get to production faster with Cursor.

0 0 0 220 0

View Details

Uranium238 @uraniumhacker

a year ago

Been trying out Cursor for the last few days with prompts generated through deep research via ChatGPT and Grok, it is definitely a game changer. I have deployed apps that I have wanted personally within hours. ◦ AI aided development is future. ◦ Security is still under-development. Just #vibecoding and deploying will cost in long term. ◦ SaaS mills that deploy what users want within 24 hours is going to be a future combined with #ai agents for sales. (imagine @levelsio on steroid pushing apps out every hour)

0 0 4 820 1

View Details

Ben @polygonben

a year ago

🚨 New blog alert! I recently "compromised" a threat actors Telegram based C2 channel, that was used for exfiltration of stolen data from the Nova infostealer. The threat actor stupidly tested their infostealing malware on their OWN production "hacking" box.... (1/3)

5 40 242 44K 168

View Details

Uranium238 @uraniumhacker

a year ago

taptastic.app/?score=10&patt… I reached level 10 in Taptastic! 🎮 Final speed: Super Fast Tiles: 9 The pattern that defeated me: 🟥 🟨 🟨 🟥 🟦 🟦 🟦 🟥 🟨 🟩 🟨 Can you beat my score? #Taptastic