Sporadic Bug Hunter. Aspiring Security Researcher. Cats. Techno 🎧. Tweets only relate to things I find Interesting.

India
Joined November 2017
Blog's up! "Firebase Cloud Messaging Service Takeover: A small research that led to 30k$+ in bounties" #GoogleVRP writeup included that relays how business rep & every user of Hangouts,Google Play Music, YouTube Go etc were affected! abss.me/posts/fcm-takeover #bugbounty #infosec
23
220
11
489
Would love to chat with anyone who’s worked with implementing BYOC
1
409
Abss retweeted
Transformer Visualized: How GPT decides "Paris" with live GPT-2 running in browser Created with @OpenAI GPT 5.5 and @AnthropicAI Opus 4.7
2
4
10
1,693
RCE in Warp Terminal! I believe the attack surface is broadening with every new tool you use. Every OAuth app you authorise with elevated scopes.. we'd see more breaches via targeting tools/SaaS.. the attack surface is everyone and everything now - hacktron.ai/blog/the-attack-…
1
14
1
48
15,019
Abss retweeted
Found a cool bug at Meta. From misconfigured Grafana instance to R/W access on 507 private Meta repositories. Wrote up the full chain here: sectricity.com/blog/misconfi… $157k bounty awarded by @metabugbounty
23
131
11
815
72,260
First autonomous bug bounty paid out. Interesting times ahead!
1
177
This incredibly gentle 2-year-old cat is fully vetted (neutered, vaxxed, litter-trained) and promises to purr your ears out. 🐈🐾 📍 South Delhi 📨 [email protected] Even if you can't give him a home today, a RT could change his life! 🙏
5
318
1
616
15,021
Excited to disclose my research allowing RCE in Kubernetes It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout. Unfortunately, this will NOT be patched.
46
369
41
2,558
417,599
Replying to @ryotkak
@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯 @claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.  All fixed in v1.0.93 by switching from blocklists to allowlists. Blog link 👇 flatt.tech/research/posts/pw…
13
65
3,520
I earned $3,000 for my submission on @bugcrowd bugcrowd.com/absshax #ItTakesACrowd RCE via dependency confusion!
1
277
With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards. This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings. Read here - hacktron.ai/blog/jdbc-audit-…
13
82
5
336
53,229
This was a fun find during a recent pentest! CDN eventually displays images leaking AWS temp creds. appsecengineer.com/blog/pixe… OG Read: buer.haus/2019/10/18/a-tale-…
4
296
2 AM in a Tokyo hotel room: @assetnote x Depi find a Dependency Confusion vuln that lands RCE on Netflix ! 🚀 Shout-out to @infosec_au for the "keep digging" spark & Netflix security for stellar triage. Full write-up in thread 🧵
14
49
1
288
28,942
MCP (Model Context Protocol) is blowing up!! I was intrigued to dig deep, to build and understand. It's like enabling your AI to have more assistants & @AnthropicAI says this is 'USB-C for AI'. I'll break it down by asking `Why?` below ⏬
3
8
1
58
5,493
happy to release my new article entitled: Next.js and cache poisoning: a quest for the black hole zhero-web-sec.github.io/rese… good reading;
38
179
3
768
84,554
Yay, I was awarded a $1,000 bounty on @Hacker0x01! hackerone.com/absshax #TogetherWeHitHarder Hacking after a long ass time. Anyone open to collab do hmu.
2
2
77
4,767