it takes a little bit of insanity to succeed
Joined January 2023
- Tweets7.5K
- Following1.5K
- Followers709
- Likes6.1K
Sektor retweeted
Unpopular opinion: Bug bounty hunting is a waste of time for entry level hackers.
You can spend days finding an XSS, bypassing CSP, and building an exploit chain that leads to account takeover.
And at the end? A $300 reward. If you're lucky.
Don't get me wrong. Bug bounty can teach you a lot, but if your goal is to break into offensive security, I believe there are much better ways to invest your time.
When I interview junior pentesters, I understand why they mention bug bounty. They're trying to gain practical experience and prove their skills.
But you can spend months hunting without meaningful results or anything substantial to show for it.
Meanwhile, someone researching vulnerabilities in open-source projects, building HTB/THM rooms, developing hacking tools, publishing technical writeups, or creating personal pentesting labs is building a portfolio that demonstrates real initiative and technical growth.
And all of these will get you a high paying job that worth much more than a random bounty you'll get.
If you're aiming for your first offensive security role, don't spend your time chasing bounties.
Build things. Research things. Break things. Document what you learn.
Sektor retweeted
How to use LLMs for vulnerability research (@ZephrFish)
MCP: blog.zsec.uk/bullyingllms/
Harness: blog.zsec.uk/harnessing-harn…
#infosec #llm
Sektor retweeted
Introducing: 0 - the open-source AI security harness by @0securitylabs (YC F26).
It found 30+ Linux kernel 0-days. Then we got backed by @YCombinator
> Found vulnerabilities in software running on 3+ billion devices & government code from 🇨🇭🇮🇹🇪🇺 + Wireshark, node-forge & jsonata
> Full-stack pentesting: from web apps & APIs down to binaries & kernels
> Multi-model, Reverse engineering, web interface + CLI and MCP for agents.
> Security Workflows: parallel agents investigate, reproduce vulnerabilities & test fixes
Use it with your coding agent:
github.com/0sec-labs/0
Sektor retweeted
SOMEONE JUST DROPPED A SERIOUS WEAPON FOR RED TEAMERS.
An open source red team platform that automates multi step attack paths across complex environments.
Meet ARES.
Give it a target and a goal like domain_admin or full_compromise, and it plans an attack path to get there.
→ 66 active modules covering 60+ MITRE ATT&CK techniques
→ Targets Active Directory, Windows and Linux
→ Supports AWS, Azure and GCP
→ Uses BloodHound data to map attack paths
→ Built in scope guard restricts testing to approved IP ranges
→ Generates detailed reports in PDF, HTML, Markdown and JSON
MIT licensed. Self hostable. Completely open source.
One platform. Multiple attack paths. Automated red team testing.
Only test systems you own or have permission to assess.
REPO BELOW
Sektor retweeted
Best hacking certificate in 2026? Hack The Box vs OffSec.
CPTS vs OSCP. I've put serious time into both. Ethical hacking skills only. Both are basically "certified CTF solver," so let's keep it real.
Learning materials: OffSec 7/10, HTB 8/10
HTB explains more. Some topics clicked faster there. More beginner friendly.
Labs: OffSec 8.5/10, HTB 6/10
After the modules and capstones, OffSec's practice labs mix everything together. Almost every box uses something you already learned, you just don't know which part. That's how the exam feels too. Structured, and a bit closer to reality.
HTB labs are good, but they play like CTFs. Lots of tricks that only work on a puzzle, not on a real client.
Credibility: OffSec 10/10, HTB 6/10
Every US job post asks for OSCP. CPTS is getting noticed, mostly as OSCP's younger brother. Good warm-up before the real one.
Exam: no score, just facts
CPTS: 10 days, AI allowed.
OSCP: 24 hours of nonstop hacking, then the report. I slept 7 hours across two days. That's the job though. Multiple clients, deadlines, and you still deliver under pressure.
Value for money: OffSec 8.5/10, HTB 9/10
CPTS is cheaper and still solid.
Overall: OffSec 8.5/10, HTB 7.25/10
Two different certs doing two different jobs. HTB teaches you, OffSec gets you hired. Use HTB for unique skills or your first reps, like I did. For a pentesting career in the US, OSCP is the only real way in.
#OSCP #CPTS
🤖 Made with AI
Sektor retweeted
想了解臭名昭著的朝鲜黑客组织 Lazarus，可以看看 Cipher 拍的纪录片《How North Korean Hackers Are Stealing Billions》。
Cipher 专做犯罪和地缘政治题材，看他们的纪录片跟追剧一样。这部片长 1 小时 20 分钟，把这支朝鲜国家队从头到尾讲透了。
Lazarus 可不是普通黑客，它是朝鲜国家养的「犯罪企业」。大多数黑客都是从小被选中的数学天才，每天工作 15 到 20 小时。Lazarus 的 KPI 只有一个：给政权搞钱，大头流向核武。
片子从朝鲜战争、主体思想和饥荒讲起，先讲清楚这个国家为什么会养出这么一支队伍。
然后按时间线一路往下：
① 1980–2000 年代伪造超级美元；
② 2014 年黑索尼影业，起因是那部《刺杀金正恩》；
③ 2016 年孟加拉国央行 SWIFT 劫案卷走 8100 万美元，还让打印机打不出转账记录，好拖延被发现的时间；
④ 2017 年的 WannaCry，用的是泄露出来的 NSA 漏洞「永恒之蓝」，波及约 150 个国家、20 多万台电脑；
⑤ 转战加密：Coincheck、Ronin (Axie)、WazirX，2025 年 Bybit 被盗 15 亿美元，再到现在 2026 年的币安。
------
币圈钱多、盗完还有机会全身而退，Lazarus 只会一直盯着挖漏洞。行业是时候团结起来了，我们面对的是一整个国家机器。
Sektor retweeted
I recently found a cool #RCE/path traversal bug on a target in Intigriti. It was rejected because of OoS :( But I am proud that I found this cool bug through a full manual testing of the endpoint. This video just simplifies the steps, but I took hours to figure out. #BugBounty
Sektor retweeted
https://target. com/index.php → 403
https://target. com/plugins/%2e%2e/index.php → 200 ✅
#BugBounty #EthicalHacking