Hacker, Developer @pdiscoveryio. Views are my own.
Matrix
Joined January 2018
- Tweets1.1K
- Following821
- Followers3.2K
- Likes2.6K
Pinned Tweet
Finally, it's here. Today, We are really happy and excited to present our automated asset recon and monitoring solution. Check it out on projectdiscovery.io
#bugbounty #recon #infoec #automation
Ice3man retweeted
subfinder. httpx. nuclei. katana. naabu. dnsx. interactsh. cvemap. neo.
this is projectdiscovery.
Ice3man retweeted
We backdoored a 7B open model for under $50.
Pointed Codex at it
-> it silently stole credentials the moment we hit the trigger phrase.
->100% hit rate.
-> zero false triggers on normal prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
Ice3man retweeted
Neo is now free to try.
Neo runs long security tasks against your apps, network, code and vulnerability backlog, with shared agents context.
→ neo.projectdiscovery.io/sign…
Here’s what you can do with Neo:
Ice3man retweeted
Too much has been written about the OpenAI and Hugging Face incident to keep up with.
We wrote the simplified version for security researchers and engineers:
-> what actually happened inside training?
-> how the attack evolved?
->what it means for defenders?
Read: projectdiscovery.io/research…
Ice3man retweeted
We built Neo for all security teams, big or small.
→ The two-person team with a long backlog.
→ The startup shipping fast with no pentest budget.
→ The enterprise scanning thousands of assets with only a few people to cover them.
Try it today → neo.projectdiscovery.io/sign…
Ice3man retweeted
We at @pdiscoveryio are looking to hire a cracked security researcher.
priority on heavy CTF background & pure research experience over standard bug bounty work.
need high agency, total ownership, zero hand-holding. looking for the absolute best in the game. DMs are open
RTs/likes for reach appreciated!
Ice3man retweeted
You can now run multiple cloud browsers inside Neo at the same time.
-> Spin up a few sessions, select the ones you care about, and send one prompt.
-> Neo can work across all of them
open pages, click through flows, and check that things like login and signup actually work.
Useful when you’re finding auth-related issues, checking edge cases, or just don’t want to babysit five tabs yourself.
Browser Sessions is live in Neo.
RT @KoyalwarTarun: Everyone is calling the @OpenAI <-> @huggingface hack "unprecented" but sandbox escapes and unintended paths are very co…
Ice3man retweeted
Cloudflare's WAF was blocking every payload I sent at this target.
I pointed my agent at Preview RAG and let it read how this WAF had been beaten before. It used that research to generate and test payload variants, and one of them slipped through.
End result: a working XSS on a target that had been filtering everything I had.
Ice3man retweeted
Today we're launching securitycontext.dev
It gives any AI agent ready-to-use security context for thousands of open source projects, built from each project's commit history of security fixes and its disclosed CVEs.
Useful whether your agent is writing code or reviewing it for bugs. Free, no auth, over MCP and API.
Ice3man retweeted
The best hackers I know aren't smarter than me.
They've just read more than me. Somewhere in their memory is the one obscure writeup that turns a dead end into a finding. Preview is that memory, on tap. For you, and for your agent.
-> rag.preview.is
Ice3man retweeted
My DJI drone does recon now.
No cloud. No API. No internet.
The drone streams RTMP straight into a MacBook running two open models:
→ Falcon Perception (0.6B)
instance-segments any target you name
→ Gemma 4 (4B, 8-bit on MLX)
reasons over the annotated frame, re-plans for a closer look
Fly. Spot something. The agent:
• Grabs the frame
• Finds every instance of whatever you typed people, vehicles, houses
• Returns exact counts with pixel masks
• Loops back to Gemma if it wants another pass
The drone is just $700. The brain is a laptop you already own.
Ice3man retweeted
Your agent architecture is your agent harness. We wrote a blog on how @neo_ai_engineer went from one agent to multi-phase plan → execute → verify execution.
projectdiscovery.io/blog/neo…
Ice3man retweeted
It always feels like a black box when AI agents start running, executing CLI tools, custom python scripts, or navigating through browsers -- leaving you with no context about what network calls it's making behind the scene.
To improve this, we added a network proxy to @neo_ai_engineer that captures all agent HTTP traffic and surfaces it in a Network tab. But the more interesting part, agents can also search and query their own traffic mid-task, so testing gets more context-aware as it progresses.
neo.projectdiscovery.io/chan…
Ice3man retweeted
Introducing Triage: automatically reproduces and validates complex vulnerabilities reported on HackerOne, Bugcrowd, and Claude Code.
Ice3man retweeted
ProjectDiscovery Nuclei Nights: Singapore
After Vegas last year, we're bringing it to Singapore for
Black Hat Asia & DEFCON Singapore week.
Tue Apr 28 / Sospiri, Marina Bay / 20:00
RSVP: luma.com/c7zmlpgp
Ice3man retweeted
Last weekend, @Parth_Malhotra and I got the chance to participate in #NCCDC2026 as red teamers - our first time on a red team. The brief was simple: pwn the boxes and maintain persistence through the end of the event.
We figured we'd put @neo_ai_engineer to a real test while we were at it. Connected Neo to the internal network over Tailscale, and watched it pwn hosts like an experienced operator.
Quick summary of what Neo compromised, and how 👇
Ice3man retweeted
[NEW BLOG]
Benchmarking Neo's Black-Box DAST Capabilities
No code to reason over, no architecture to anchor on, no hints. Just a URL and a goal.
We put Neo through Pensar AI's Argus benchmark in pure black-box mode.
60 modern web apps, vulnerability classes that go past the SQLi-and-XSS textbook.
@neo_ai_engineer solved 85% end-to-end.
Full writeup, methodology, per-model breakdown in comments 👇
Ice3man retweeted
CLAUDE CODE Found a bug in Google’s Brotli
We gave our AI agent a simple fuzzing skill and pointed it at Brotli (the compression lib in Chrome, Firefox, nginx… literally everywhere).
It audited the code → wrote the harness → found a signed integer overflow
Fuzzing + agents = next level.