founding security @parameter_ai (YC W26), infosec nerd popping calc ; views are my own.
Joined April 2017
- Tweets2.6K
- Following996
- Followers9.4K
- Likes21.5K
Sayaan Alam retweeted
🚨 OpenAI fixed a ChatGPT flaw that allowed malicious shared links to execute attacker code in users' logged-in sessions and steal private chat content.
Researchers demonstrated the attack.
Here's how → thehackernews.com/2026/10/a-…
Sayaan Alam retweeted
we at parameter are growing fast ASF and we need a really cracked eng whom are all of the following:
* smarter than me
* knows more shit than me
* doesn't write AI slop
we are going to pay you good 🤤 and you can potentially make generational wealth.
Sayaan Alam retweeted
Introducing Pentesting for Android.
As companies expand their digital footprint, their attack surface grows too. Native mobile apps are often overlooked in security testing, leaving vulnerabilities undiscovered.
If you're building an Android app, we'd love to show you what we can do.
Sayaan Alam retweeted
Harshita Arora was 17 when she cofounded AtoB and got into YC.
I was 27 when I cofounded Posterous and got into YC.
Nicolas Dessaigne was 37 when he cofounded Algolia and got into YC
It doesn’t matter what age you are. YC is the community to join to go fast when starting.
Sayaan Alam retweeted
New episode of WE'RE IN!
Discover @ehsayaan's journey from teenage hacker to the SRT Acropolis.
🎧Listen on Spotify: open.spotify.com/episode/2Oi…
#EthicalHacking #Pentest #SynackRedTeam #Cybersecurity
Sayaan Alam retweeted
Track trending vulnerabilities and active exploitation signals. Free vulnerability intelligence dashboard by LeakyCreds leakycreds.com/vulnerability…
Sayaan Alam retweeted
Live Vulnerability Intelligence & Trending CVEs | LeakyCreds leakycreds.com/vulnerability…
Sayaan Alam retweeted
Introducing Shax — the most powerful AI penetration tester.
Scoring 90%+ on offensive security benchmarks, Shax outperforms Xbow and every other agent available today. Complete penetration tests in hours, not weeks.
Here’s what it looks like in action 👇
Sayaan Alam retweeted
This week, Disclosed. #BugBounty
Spotlight on Android labs, LLM “sleeper” agents, big bounties for NGINX & GPT‑5, Zoomtopia & IoT hackathons, write‑ups on SSRF, UUID takeover & RXSS escalation, plus upgraded tools and hunting tips.
Full issue → getDisclosed.com
Highlights below 👇
@pwnwithlove & @yeswehack share a comprehensive guide to building an Android bug bounty lab, comparing emulators vs real devices and covering tools like Burp Suite & Frida.
@Bugcrowd features Ads Dawson reflecting on his journey from network engineer to passionate hacker and the joy of offensive security.
justas_b explains how data poisoning can turn large language models into “sleeper” agents, highlighting examples and costs.
@Hack_All_Things invites researchers to Zoomtopia (Sept 17–18) to test new features and hunt bugs.
@HackenProof announces the Summer Security event running through Sept 25, where hackers can earn Pearl tokens and compete for prizes.
@yeswehack reveals an exclusive hacking event at Nullcon Berlin and calls for participants in the SPIRITCYBER 2025 IoT Hackathon.
@crowdfense offers a $350K bounty for a working RCE exploit targeting the latest NGINX.
@0xacb teases HackAICon’s jailbreak challenge in Lisbon and invites hackers to compete.
@btibor91 promotes OpenAI’s $25K Bio Bug Bounty Program for GPT‑5 safety exploits.
@Akshanshjaiswl promotes a virtual hacking event in partnership with @Hacker0x01 alongside @bsidesahmedabad
@intigriti documents an SSRF exploit in Next.js middleware, while bob004x shows how a UUID bug led to account takeovers.
@un1tycyb3r announces the first part of a research series focused on hacking vulnerabilities in referral systems based on his @BugBountyDEFCON talk.
@r3verii escalates a low‑impact RXSS into a credential‑stealing attack with JS‑in‑JS.
@dhakal_ananda uncovers a payment bypass in Stripe integrations
@RenwaX23 reports a critical UXSS in Opera
@efaav reveals a Microsoft PII leak affecting 700M+ partner records
@ctbbpodcast releases episode about AI-assisted whitebox reviews
@deadoverflow_ shows how race conditions can let attackers get anything for free.
@0xTib3rius releases a video on a "break and repair" method for manually detecting SQL injection
@NahamSec highlights the power of regex for recon and data analysis,
@CaidoIO releases the ReDocs plugin for replaying API sessions.
@intigriti dives into advanced Log4Shell exploitation in 2025.
@coffinxp7 demonstrates blind XSS via clipboard paste handling.
@HackingTeam777 drops a tip on HTTP parameter pollution for privilege escalation
@ehsayaan details an IDOR exploit that allowed unauthorized deletions
@garethheyes demonstrates XSS hoisting
@intigriti shares a thread on Firebase vulnerabilities
@KN0X55 offers WAF‑bypass XSS techniques.
Full links, writeups & more → getDisclosed.com
The bug bounty world, curated.
Sayaan Alam retweeted
Last month, I found a 0-click account takeover with a very simple match-and-replace trick
Sometimes applications have different API endpoints for different functions. For authentication, developers often use session cookies or exchange tokens. In some cases, if the main session is deleted, the application falls back to using another cookie or a unique ID in the headers for authentication
By inspecting the JavaScript and requests, I noticed this behavior. If the main session wasn’t available, the app would accept the unique ID in the header and automatically set new cookies
So, I deleted the main session and simply replaced the header with the unique ID — which led to account takeover
Sayaan Alam retweeted
SQL injection tip of the day. On MySQL and its variants, you can use versioned comments.
Let's say we are having potential SQLi on target, vulnerable parameter is id and we can only do blind injection attacks, but you are not sure about what DBMS is used.
So, change value of the id with /*!50000 <id value>*/ and see if you are seeing same contents of the normal value.
If you are able to see same contents target DBMS is most likely MySQL or it's variants with version greater or equal than 5.0.0, with changing 50000 to 51000 51010 etc you can figure out exact version too without using version() function at all.
That way you can easily detect targets using MySQL same time many WAF will ignore this as it's not malicious neither looking like normal functionalities.
This is well known technique by many old timers and experts but most people don't know this trick.
I hope this gives some ideas for exploiting similar issues. #BugBounty #bugbountytips #Pentesting
Sayaan Alam retweeted
Nice work! It’s great to see people achieving serious impact using the single-packet attack!
I recently discovered a critical race condition vulnerability at a multi-million dollar investment firm!
The vulnerability allowed attackers to execute a single-packet attack that bypassed financial controls, potentially enabling:
✅ Purchasing stocks worth twice the available account balance
✅ Creating compounding exploitation scenarios (e.g., turning $1M → $2M → $4M → $8M)
✅ Manipulating market prices through unauthorized large orders
💻 Technical Overview:
- Intercepted an order placement HTTP request during stock purchase flow.
- Sent multiple identical requests simultaneously in a single-packet using Burp Suite Repeater.
- The application processed these requests before validating account balance, allowing multiple orders with insufficient funds.
⚙️ Root Cause:
The platform performed asynchronous balance validation without proper locking mechanisms, creating a classic TOCTOU (Time-of-Check to Time-of-Use) vulnerability. This flaw allowed critical financial controls to be bypassed under concurrent execution.
The issue was reported and acknowledged by the platform’s security team through their bug bounty program.
Special thanks to @albinowax for his research on single-packet attacks, which helped inspire this finding.
This serves as a reminder that concurrency and synchronization bugs in financial systems are not just technical issues - they can have major monetary and market consequences.
#BugBounty