Pinned Tweet
Blog's up!
"Firebase Cloud Messaging Service Takeover: A small research that led to 30k$+ in bounties"
#GoogleVRP writeup included that relays how business rep & every user of Hangouts,Google Play Music, YouTube Go etc were affected!
abss.me/posts/fcm-takeover
#bugbounty #infosec
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
Abss retweeted
Transformer Visualized: How GPT decides "Paris" with live GPT-2 running in browser
Created with @OpenAI GPT 5.5 and @AnthropicAI Opus 4.7
Abss retweeted
RCE in Warp Terminal! I believe the attack surface is broadening with every new tool you use. Every OAuth app you authorise with elevated scopes.. we'd see more breaches via targeting tools/SaaS.. the attack surface is everyone and everything now - hacktron.ai/blog/the-attack-…
Found a cool bug at Meta.
From misconfigured Grafana instance to R/W access on 507 private Meta repositories.
Wrote up the full chain here:
sectricity.com/blog/misconfi…
$157k bounty awarded by @metabugbounty
A write-up about an interesting SSRF chain I found earlier this year
eib.hashnode.dev/crafting-a-…
Abss retweeted
This incredibly gentle 2-year-old cat is fully vetted (neutered, vaxxed, litter-trained) and promises to purr your ears out. 🐈🐾
📍 South Delhi
📨 [email protected]
Even if you can't give him a home today, a RT could change his life! 🙏

ALT An orange tabby cat standing on a textured ledge, looking intently out through a wire mesh fence. The cat is wearing a cute white bandana patterned with pink and teal starfish. A purple wall is visible on the left side of the frame.

ALT A close-up of a sweet orange tabby cat resting its front paws on a ledge while lying down. The cat is looking out to the right through a wire mesh balcony or fence, wearing the same white bandana with pink and teal starfish. The background features a purple wall to the left and softly blurred greenery outside.
Abss retweeted
Excited to disclose my research allowing RCE in Kubernetes
It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.
Unfortunately, this will NOT be patched.
Abss retweeted
Replying to @ryotkak
@ryotkak discovered 8 ways to achieve RCE in Claude Code without user approval 🤯
@claudeai allowlisted "safe" commands like echo, sed, and sort, then used regex blocklists to prevent dangerous arguments.
All fixed in v1.0.93 by switching from blocklists to allowlists.
Blog link 👇
flatt.tech/research/posts/pw…
I earned $3,000 for my submission on @bugcrowd bugcrowd.com/absshax #ItTakesACrowd
RCE via dependency confusion!
Abss retweeted
With only 48 hours remaining in a bug bounty event, I used @HacktronAI CLI to perform large-scale analysis of several JDBC drivers. Netting $85,000 in total rewards.
This write-up shows how AI-assisted vulnerability research is speeding up the work of researchers and leading to high-impact findings.
Read here - hacktron.ai/blog/jdbc-audit-…
This was a fun find during a recent pentest! CDN eventually displays images leaking AWS temp creds.
appsecengineer.com/blog/pixe…
OG Read: buer.haus/2019/10/18/a-tale-…
Abss retweeted
Just published my first blog post "Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover"
You can read the full write-up here:
zere.es/posts/cache-deceptio…
Abss retweeted
2 AM in a Tokyo hotel room: @assetnote x Depi find a Dependency Confusion vuln that lands RCE on Netflix !
🚀 Shout-out to @infosec_au for the "keep digging" spark & Netflix security for stellar triage. Full write-up in thread 🧵
Abss retweeted
MCP (Model Context Protocol) is blowing up!! I was intrigued to dig deep, to build and understand.
It's like enabling your AI to have more assistants & @AnthropicAI says this is 'USB-C for AI'.
I'll break it down by asking `Why?` below ⏬
Abss retweeted
happy to release my new article entitled:
Next.js and cache poisoning: a quest for the black hole
zhero-web-sec.github.io/rese…
good reading;
Abss retweeted
1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
gist.github.com/hackermondev…
Yay, I was awarded a $1,000 bounty on @Hacker0x01! hackerone.com/absshax #TogetherWeHitHarder
Hacking after a long ass time. Anyone open to collab do hmu.



















