Pinned Tweet
THIS IS F**KING DANGEROUS
SOME COMPANIES ARE LEAVING WAY TOO MUCH EXPOSED
I found 3 OSINT tools that can uncover a ridiculous amount of information from the outside.
LEAKIX -> Give it a domain and it can surface publicly exposed services and databases connected to that infRuns 135+ recon and security checks against a website to build a much broader picture of its external footprint.
GITGRABER -> Monitors GitHub for accidentally exposed secrets like API keys, passwords, and sensitive information —> with Telegram alerts when something is found.
Different tools.
Same idea: find what shouldn’t be publicly visible.
If you’re learning OSINT, bug bounty, or pentesting, these are worth knowing.
BOOKMARK it before someone take it down
LINK’S BELOW
SOME COMPANIES ARE LEAVING WAY TOO MUCH EXPOSED
I found 3 OSINT tools that can uncover a ridiculous amount of information from the outside.
LEAKIX -> Give it a domain and it can surface publicly exposed services and databases connected to that infRuns 135+ recon and security checks against a website to build a much broader picture of its external footprint.
GITGRABER -> Monitors GitHub for accidentally exposed secrets like API keys, passwords, and sensitive information —> with Telegram alerts when something is found.
Different tools.
Same idea: find what shouldn’t be publicly visible.
If you’re learning OSINT, bug bounty, or pentesting, these are worth knowing.
BOOKMARK it before someone take it down
LINK’S BELOW
42
295
2,618
252,523
MAX retweeted
The complete roadmap to becoming a quant: the foundation every firm builds on, the engineering edge and the one thing that separates the best. x.com/i/article/2115…
3
3
8
184
MAX retweeted
menu pricing for lead gen:
verified work email $0.062
mobile number $0.94
brief on a company $0.10
that's @MonidHQ's people search page. Clay wants $446/mo for the seat, ZoomInfo's median buyer pays $33,500/yr. Jev (@typesafeai) orders a la carte.
verified work email $0.062
mobile number $0.94
brief on a company $0.10
that's @MonidHQ's people search page. Clay wants $446/mo for the seat, ZoomInfo's median buyer pays $33,500/yr. Jev (@typesafeai) orders a la carte.
Introducing Jev @typesafeai powered people search
$0.0024/lead. No more $2,000 subscriptions.
Your agents can now:
> Waterfall across Apollo, Clay, People Data Labs, Hunter, ContactOut, Ploid
> Run 1,000 leads through Jev
> Pay for enrichment only on the leads Jev kept
Open s. 0% markup.
10
3
30
4,135
MAX retweeted
TAVUS BUILT AN AI THAT MIGHT PASS YOUR VIDEO CALL WITHOUT YOU NOTICING
48% thought they were talking to a real person.
It listens, interrupts, reads gestures and even clones voices.
Imagine getting ghosted by an AI
48% thought they were talking to a real person.
It listens, interrupts, reads gestures and even clones voices.
Imagine getting ghosted by an AI
Earlier this month we introduced Griffin, the first AI model to pass the video Turing test.
The launch post got a lot of traction (~21M views), but filming it with Griffin running live on set was its own adventure...
Here are some of my favorite BTS clips:
12
4
32
3,899
TAVUS BUILT AN AI THAT MIGHT PASS YOUR VIDEO CALL WITHOUT YOU NOTICING
48% thought they were talking to a real person.
It listens, interrupts, reads gestures and even clones voices.
Imagine getting ghosted by an AI
48% thought they were talking to a real person.
It listens, interrupts, reads gestures and even clones voices.
Imagine getting ghosted by an AI
Earlier this month we introduced Griffin, the first AI model to pass the video Turing test.
The launch post got a lot of traction (~21M views), but filming it with Griffin running live on set was its own adventure...
Here are some of my favorite BTS clips:
12
4
32
3,899
menu pricing for lead gen:
verified work email $0.062
mobile number $0.94
brief on a company $0.10
that's @MonidHQ's people search page. Clay wants $446/mo for the seat, ZoomInfo's median buyer pays $33,500/yr. Jev (@typesafeai) orders a la carte.
verified work email $0.062
mobile number $0.94
brief on a company $0.10
that's @MonidHQ's people search page. Clay wants $446/mo for the seat, ZoomInfo's median buyer pays $33,500/yr. Jev (@typesafeai) orders a la carte.
Introducing Jev @typesafeai powered people search
$0.0024/lead. No more $2,000 subscriptions.
Your agents can now:
> Waterfall across Apollo, Clay, People Data Labs, Hunter, ContactOut, Ploid
> Run 1,000 leads through Jev
> Pay for enrichment only on the leads Jev kept
Open s. 0% markup.
10
3
30
4,135
MAX retweeted
LOS HACKERS NO QUIEREN QUE VEAS ESTO
ENCONTRÉ 3 HERRAMIENTAS DE HACKING DE WIFI QUE PARECEN ILEGALES DE CONOCER.
→ FragAttacks: expone fallos en los protocolos de Wi-Fi que pueden afectar dispositivos de distintas generaciones.
→ AngryOxide: un motor de ataques inalámbricos aptar su enfoque durante las pruebas.
→ EAPHammer: simula puntos de acceso rogue de Wi-Fi empresarial para probar qué tan fácilmente se podrían exponer las credenciales.
Estas herramientas muestran cómo los atacantes pueden explotar debilidades en la seguridad inalámbrica.
Solo prueba redes que poseas o para las que tengas autorización explícita para evaluar.
REPOS ABAJO
ENCONTRÉ 3 HERRAMIENTAS DE HACKING DE WIFI QUE PARECEN ILEGALES DE CONOCER.
→ FragAttacks: expone fallos en los protocolos de Wi-Fi que pueden afectar dispositivos de distintas generaciones.
→ AngryOxide: un motor de ataques inalámbricos aptar su enfoque durante las pruebas.
→ EAPHammer: simula puntos de acceso rogue de Wi-Fi empresarial para probar qué tan fácilmente se podrían exponer las credenciales.
Estas herramientas muestran cómo los atacantes pueden explotar debilidades en la seguridad inalámbrica.
Solo prueba redes que poseas o para las que tengas autorización explícita para evaluar.
REPOS ABAJO
🚨 ACABAN DE LIBERAR GRATIS UN HACKER CON IA QUE ATACA TU APP CADA VEZ QUE SUBES UNA RELEASE
Ya va por más de 48.000 estrellas en GitHub.
Y no te da una lista de "posibles fallos". Te enseña por dónde entra.
Se llama Shannon y es un pentester con IA open source.
Lo apuntas a la como lo haría un hacker de verdad.
Lo que hace:
→ Usa exploits reales, no suposiciones
→ Si no consigue explotar un fallo, no lo reporta
→ Lo metes en GitHub Actions o GitLab CI y se ejecuta solo en cada release
→ Te entrega un informe PDF profesional listo para pasar al cliente o al equipo
→ Y exporta en SARIF para que los fallos aparezcan directamente en tus herramientas de desarrollo
Los tests te dicen si tu app funciona.
Esto te dice si alguien puede entrar.
Antes, un pentest era algo que se hacía de vez en cuando.
Ahora tu app pasa por uno cada vez que la actualizas.
Open source. Funciona con el modelo que ya usas.
Repo en el primer comentario 👇
30
25
101
9,477
MAX retweeted
🚨 SOMEONE LEAKED THE PROMPT THAT MAKES CLAUDE CODE BUILD ITS OWN SKILLS AND GET BETTER AT YOUR WORK.
Most people keep explaining the same workflows, repeating instructions, and correcting Claude every single day.
This prompt changes that.
→ Detects repetitive tasks in your projects
→ Turns workflows into reusable Claude skills
→ Creates instructions, templates, and examples
→ Tests skills and fixes failures
→ Updates skills based on your corrections
No manual skill writing. No rebuilding workflows from scratch.
Just copy, paste, and let Claude do the heavy lifting.
SAVE THIS BEFORE IT DISAPPEARS. x.com/soniacuts/stat…
Most people keep explaining the same workflows, repeating instructions, and correcting Claude every single day.
This prompt changes that.
→ Detects repetitive tasks in your projects
→ Turns workflows into reusable Claude skills
→ Creates instructions, templates, and examples
→ Tests skills and fixes failures
→ Updates skills based on your corrections
No manual skill writing. No rebuilding workflows from scratch.
Just copy, paste, and let Claude do the heavy lifting.
SAVE THIS BEFORE IT DISAPPEARS. x.com/soniacuts/stat…
18
14
111
5,289
🚨 SOMEONE LEAKED THE PROMPT THAT MAKES CLAUDE CODE BUILD ITS OWN SKILLS AND GET BETTER AT YOUR WORK.
Most people keep explaining the same workflows, repeating instructions, and correcting Claude every single day.
This prompt changes that.
→ Detects repetitive tasks in your projects
→ Turns workflows into reusable Claude skills
→ Creates instructions, templates, and examples
→ Tests skills and fixes failures
→ Updates skills based on your corrections
No manual skill writing. No rebuilding workflows from scratch.
Just copy, paste, and let Claude do the heavy lifting.
SAVE THIS BEFORE IT DISAPPEARS. x.com/soniacuts/stat…
Most people keep explaining the same workflows, repeating instructions, and correcting Claude every single day.
This prompt changes that.
→ Detects repetitive tasks in your projects
→ Turns workflows into reusable Claude skills
→ Creates instructions, templates, and examples
→ Tests skills and fixes failures
→ Updates skills based on your corrections
No manual skill writing. No rebuilding workflows from scratch.
Just copy, paste, and let Claude do the heavy lifting.
SAVE THIS BEFORE IT DISAPPEARS. x.com/soniacuts/stat…
18
14
111
5,289
MAX retweeted
THIS IS F**KING INSANE
COMPANIES ARE LEAVING FILES EXPOSED ONLINE… AND THIS TOOL FINDS THEM IN SECOND
Grayhat Warfare searches publicly exposed cloud storage across AWS S3, Azure, DigitalOcean and Google Cloud.
And the results can be shocking.
I searched “bitcoin” and got h billions of files by keyword
→ Find publicly exposed cloud buckets
→ Filter by file type
→ Reveal bucket names and full file paths
No hacking required. Some files are already sitting in public view because of misconfigured storage.
Your data doesn’t need to be hacked to be leaked.
SOMETIMES, THE DOOR IS ALREADY WIDE OPEN.
Bookmark this tool
LINK BELOW
COMPANIES ARE LEAVING FILES EXPOSED ONLINE… AND THIS TOOL FINDS THEM IN SECOND
Grayhat Warfare searches publicly exposed cloud storage across AWS S3, Azure, DigitalOcean and Google Cloud.
And the results can be shocking.
I searched “bitcoin” and got h billions of files by keyword
→ Find publicly exposed cloud buckets
→ Filter by file type
→ Reveal bucket names and full file paths
No hacking required. Some files are already sitting in public view because of misconfigured storage.
Your data doesn’t need to be hacked to be leaked.
SOMETIMES, THE DOOR IS ALREADY WIDE OPEN.
Bookmark this tool
LINK BELOW
16
7
73
3,703
THIS IS F**KING INSANE
COMPANIES ARE LEAVING FILES EXPOSED ONLINE… AND THIS TOOL FINDS THEM IN SECOND
Grayhat Warfare searches publicly exposed cloud storage across AWS S3, Azure, DigitalOcean and Google Cloud.
And the results can be shocking.
I searched “bitcoin” and got h billions of files by keyword
→ Find publicly exposed cloud buckets
→ Filter by file type
→ Reveal bucket names and full file paths
No hacking required. Some files are already sitting in public view because of misconfigured storage.
Your data doesn’t need to be hacked to be leaked.
SOMETIMES, THE DOOR IS ALREADY WIDE OPEN.
Bookmark this tool
LINK BELOW
COMPANIES ARE LEAVING FILES EXPOSED ONLINE… AND THIS TOOL FINDS THEM IN SECOND
Grayhat Warfare searches publicly exposed cloud storage across AWS S3, Azure, DigitalOcean and Google Cloud.
And the results can be shocking.
I searched “bitcoin” and got h billions of files by keyword
→ Find publicly exposed cloud buckets
→ Filter by file type
→ Reveal bucket names and full file paths
No hacking required. Some files are already sitting in public view because of misconfigured storage.
Your data doesn’t need to be hacked to be leaked.
SOMETIMES, THE DOOR IS ALREADY WIDE OPEN.
Bookmark this tool
LINK BELOW
16
7
73
3,703
MAX retweeted
THIS AI SEARCH TOOL JUST MADE RAG LOOK OUTDATED.
Most AI agents search through chunks of data and hope they find the right answer.
@NaceAI built Drex Search to change that.
→ Searches across 1M+ files
→ Handles scanned PDFs, tables, spreadsheets and more
→ Returns answers → Cuts agent steps by 62% and input tokens by 56%
→ Improves accuracy across real-world benchmarks
In Nace AI’s reported benchmarks, accuracy improved from 63.1% to 67.1% across 529 queries.
Less searching. Fewer wasted tokens. Better answers.
Drex Search is live: nace.ai/developers
Most AI agents search through chunks of data and hope they find the right answer.
@NaceAI built Drex Search to change that.
→ Searches across 1M+ files
→ Handles scanned PDFs, tables, spreadsheets and more
→ Returns answers → Cuts agent steps by 62% and input tokens by 56%
→ Improves accuracy across real-world benchmarks
In Nace AI’s reported benchmarks, accuracy improved from 63.1% to 67.1% across 529 queries.
Less searching. Fewer wasted tokens. Better answers.
Drex Search is live: nace.ai/developers
19
2
73
5,633
THIS AI SEARCH TOOL JUST MADE RAG LOOK OUTDATED.
Most AI agents search through chunks of data and hope they find the right answer.
@NaceAI built Drex Search to change that.
→ Searches across 1M+ files
→ Handles scanned PDFs, tables, spreadsheets and more
→ Returns answers → Cuts agent steps by 62% and input tokens by 56%
→ Improves accuracy across real-world benchmarks
In Nace AI’s reported benchmarks, accuracy improved from 63.1% to 67.1% across 529 queries.
Less searching. Fewer wasted tokens. Better answers.
Drex Search is live: nace.ai/developers
Most AI agents search through chunks of data and hope they find the right answer.
@NaceAI built Drex Search to change that.
→ Searches across 1M+ files
→ Handles scanned PDFs, tables, spreadsheets and more
→ Returns answers → Cuts agent steps by 62% and input tokens by 56%
→ Improves accuracy across real-world benchmarks
In Nace AI’s reported benchmarks, accuracy improved from 63.1% to 67.1% across 529 queries.
Less searching. Fewer wasted tokens. Better answers.
Drex Search is live: nace.ai/developers
19
2
73
5,633
okay this launch demo goes hard
Today, @JudgmentLabs opens for general access.
We believe long running agent systems will generate more exhaust data than the world can currently process.
Hidden within agent traces are rich records of how to make these systems better: what users ask for, when agents stumble, with the external world.
Judgment is the most performant monitoring and improvement layer for long-horizon agents.
We’re excited to see what you build!
6
1
53
5,918
MAX retweeted
YOUR PHP SERVER COULD BE AT RISK OF REMOTE CODE EXECUTION
Two critical PHP vulnerabilities. CVSS 9.2 each.
This PHP2Shell repo brings together exploit research and defensive detection tools.
→ 5 documented RCE chains
→ PoCs for 3 exploit chains included
→ 13 n rules
→ Sigma rules for SIEM monitoring
→ ModSecurity and OpenResty defenses
→ Docker lab for testing vulnerable configurations
→ Technical analysis and mitigation guidance
The research targets PHP’s session.upload_progress handling and Zend Engine memory state issues, with some attack paths requiring no application vulnerability.
The project reports affected versions from PHP 5.4.0 through 8.5.11.
Patch to a fixed PHP release. Detection rules and configuration changes are not substitutes for patching.
BOOKMARK IT & Only test systems you own or have explicit authorization to assess.
REPO BELOW
Two critical PHP vulnerabilities. CVSS 9.2 each.
This PHP2Shell repo brings together exploit research and defensive detection tools.
→ 5 documented RCE chains
→ PoCs for 3 exploit chains included
→ 13 n rules
→ Sigma rules for SIEM monitoring
→ ModSecurity and OpenResty defenses
→ Docker lab for testing vulnerable configurations
→ Technical analysis and mitigation guidance
The research targets PHP’s session.upload_progress handling and Zend Engine memory state issues, with some attack paths requiring no application vulnerability.
The project reports affected versions from PHP 5.4.0 through 8.5.11.
Patch to a fixed PHP release. Detection rules and configuration changes are not substitutes for patching.
BOOKMARK IT & Only test systems you own or have explicit authorization to assess.
REPO BELOW
21
10
89
5,961
YOUR PHP SERVER COULD BE AT RISK OF REMOTE CODE EXECUTION
Two critical PHP vulnerabilities. CVSS 9.2 each.
This PHP2Shell repo brings together exploit research and defensive detection tools.
→ 5 documented RCE chains
→ PoCs for 3 exploit chains included
→ 13 n rules
→ Sigma rules for SIEM monitoring
→ ModSecurity and OpenResty defenses
→ Docker lab for testing vulnerable configurations
→ Technical analysis and mitigation guidance
The research targets PHP’s session.upload_progress handling and Zend Engine memory state issues, with some attack paths requiring no application vulnerability.
The project reports affected versions from PHP 5.4.0 through 8.5.11.
Patch to a fixed PHP release. Detection rules and configuration changes are not substitutes for patching.
BOOKMARK IT & Only test systems you own or have explicit authorization to assess.
REPO BELOW
Two critical PHP vulnerabilities. CVSS 9.2 each.
This PHP2Shell repo brings together exploit research and defensive detection tools.
→ 5 documented RCE chains
→ PoCs for 3 exploit chains included
→ 13 n rules
→ Sigma rules for SIEM monitoring
→ ModSecurity and OpenResty defenses
→ Docker lab for testing vulnerable configurations
→ Technical analysis and mitigation guidance
The research targets PHP’s session.upload_progress handling and Zend Engine memory state issues, with some attack paths requiring no application vulnerability.
The project reports affected versions from PHP 5.4.0 through 8.5.11.
Patch to a fixed PHP release. Detection rules and configuration changes are not substitutes for patching.
BOOKMARK IT & Only test systems you own or have explicit authorization to assess.
REPO BELOW
21
10
89
5,961
THIS IS F**KING DANGEROUS
YOUR AI’S GUARDRAILS AREN’T AS STRONG AS YOU THINK.
Basilisk is an open source AI red teaming framework built to expose weaknesses in LLMs.
→ 33 attack modules mapped to OWASP LLM Top 10
→ evolves jailbreaks when prompts get refused
→ tests leaks, tool abuse & RAG poisoning
→ fingerprints models and discovers available tools
→ compares GPT, Claude & Gemini side by side
→ grades guardrails from A+ to F
→ generates evidence backed findings and signed audit logs
It can even run repeatable security tests to catch regressions.
Only test systems you own or have explicit authorization to assess.
REPO BELOW
YOUR AI’S GUARDRAILS AREN’T AS STRONG AS YOU THINK.
Basilisk is an open source AI red teaming framework built to expose weaknesses in LLMs.
→ 33 attack modules mapped to OWASP LLM Top 10
→ evolves jailbreaks when prompts get refused
→ tests leaks, tool abuse & RAG poisoning
→ fingerprints models and discovers available tools
→ compares GPT, Claude & Gemini side by side
→ grades guardrails from A+ to F
→ generates evidence backed findings and signed audit logs
It can even run repeatable security tests to catch regressions.
Only test systems you own or have explicit authorization to assess.
REPO BELOW
40
31
308
16,480