Security Researcher @cybity_ click 3x on - https://xitter.gq/t.co/T6HsiEbXze
ap-south-1
Joined September 2021
- Tweets7K
- Following71
- Followers5.6K
- Likes12K
I was too lazy to copy payloads from any checklist or notepad! so I made an extension in which you can just copy payloads within browser itself. I try to made it in 2025 but I stuck on win clipboard function. it got xss,sqli,crlf,etc by def please try it addons.mozilla.org/en-US/fir…
Frey retweeted
Launched. Repost if you like it!
Cybersecurity conferences in one place, checked against official sources: events.pt.community
- Open CFPs & deadlines
- Published speaker support
- Topics from past talks
- Nearby events for one trip
Save, share, add to your calendar. No account needed.
Frey retweeted
How to become expert at thing:
1 iteratively take on concrete projects and accomplish them depth wise, learning “on demand” (ie don’t learn bottom up breadth wise)
2 teach/summarize everything you learn in your own words
3 only compare yourself to younger you, never to others
Content creation is harder than I thought Hooks, scripts, 20 retakes in front of the camera, forgetting to turn on the mic and then dealing with haters after uploading. How do you all do this?! I was wrong it's like a second job.
my AI can click any links blindly and then says opps I just downloaded something harmful let me clean that up. oh yes honeypots say no to opsec
Bug Bounty POC | Race Condition TOCTOU in Invite and API-Key Quota Enforcement.
youtu.be/GsXOIGyDSK8
Frey retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Bug bounty is a field where no one gets jealous when someone else does well. Cause Deep down we all know you might get lucky once, but ultimately, it comes down to skill in the long run even if you're running multiple VMs packed with hacker AI bots
Day 5 : so now learning web sec actually helps in hacking AI. I am not saying it myself its all what I study in AI output attacks it might be less common to see output attacks now but do you all remember in early days everyone was popping xss on deepseek.
Day 3 & 4 : after learning all that jailbreaking I need to practice it somewhere :D so I am now enrolled in hackthebox AI red teaming. it is mostly basic maybe cause it is old but I see it got more cool attack vectors. the goal is to find one bug in the real AI Env for fun
Day 2: done with Indirect Prompt Injection & Jailbreaking!
I believe indirect prompt injection is becoming a major attack vector for organizations adopting AI. LLMs can struggle to distinguish trusted instructions from untrusted content retrieved from external sources.
Now imagine combining this with a subdomain takeover. If an attacker controls a webpage an AI agent retrieves, they could potentially use it to deliver indirect prompt injection.
The real risk? AI agents connected to organizational data, tools, and workflows.
i did not add jailbreaks methods but there are the ones which really get me started
Most popular one DAN : github.com/0xk1h0/ChatGPT_DA…
Role play : make AI your granny or something and then let it go brrr the good and bad thing is that humans always lies arxiv.org/pdf/2402.03299