Offensive security research & building @OphionSecurity

Joined May 2019
Have we tried turning the Internet on and off again? #PHP2Shell #node2shell #http2shell
1
1
304
If you’re engineering new projects or writing code, I’d recommend @ThinkstCanary. With how fast companies are getting hacked and API keys keep getting stolen, setting up these tripwires might help you get alerted before a vendor even tells you they’ve been hacked. #cybersecurity #hacking
2
86
Replying to @JustJake
Sorry to hear this @JustJake ! Let us know if we can help!
295
Replying to @S1r1u5_
This has been my experience with building out Ophion Security with the team. There is so much fun things happening in security
2
106
Rojan Rijal retweeted
donate.gov.np is now live. You can donate to the Government of Nepal Prime Minister’s Disaster Relief Fund from anywhere in the world via debit/credit card (Visa/Mastercard, 3D Secure), mobile banking, connectIPS, wallets, UPI-India, UnionPay, eSewa, or Alipay+. Choose USD or NPR. Large donations can also go via SWIFT. Official channel. Direct. Transparent. Support rescue, relief and rehabilitation operations. Donate: donate.gov.np #DonateToNepal #PMDRF #NepalRelief
11
61
1
117
6,199
If you are an on-site volunteer working on rescue effort, helping provide medicine and more in Nepal, please also consistently check nepaldisastersearch.com/. We are consistently uploading more photos and data on missing loved ones. If you identify anyone, contact information of their loved ones is also shared directly. #nepal #nepaldisaster #nepalflood #rasuwa
1
163
With the devastating situation going on in Nepal, we have built a website to share about your loved ones with ease allowing you to uploda their photos and information. We also correlate the data with NDRRMA website to identify rescued loved ones with the profile. nepaldisastersearch.com/ #nepal #nepaldisaster #nepalflood
209
Damn, I get it Claude it is critical.
1
450
Replying to @adnanthekhan
What has been your experience with Bedrock like specially around the cost? Have been thinking of doing something similar for a different use case but I am not sure what the cost would be like.
49
Replying to @disputifier
@disputifier let us know if we can help in any way! No expectations or selling anything.
1
3,261
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online. That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values. In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country. Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers. I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection. In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders. THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
2,335
7,001
1,354
33,541
9,499,963
If you are building a vibe coded app and launching a product out of it, hit us @OphionSecurity and we will do a security assessment and have actionable security measures ready within 72 hours. #vibecoding #security #cybersecurity
Pop Punk 🇺🇸
@PopPunkOnChainJan 8
If you want free API keys just open the network tab on literally every vibe coded app. In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.
240
I just got access to an attacker's daily diary. Here is what I learned 👇 🕘 9:00 AM: Clock in. 🔎 9:12 AM: Google Dork says dev-login.company.com is still alive. 😎 9:30 AM: No rate limits, no auth. Just vibes. 🗃 10:00 AM: Dumped staging DB from test-api-v2.company.net. 😬 10:20 AM: Reused creds work on prod. Consistency is key. 🛡 10:45 AM: Oh no… a WAF! 😈 10:46 AM: JK, it’s only on www. Your 12 forgotten subdomains are unprotected. 🥪 12:00 PM: Lunch break. Your asset inventory is crying is forgottenland. 💀 2:00 PM: You schedule a pentest. 📅 2:01 PM: For next quarter. 🪄 3:00 PM: Still pivoting. Still no alert. 🎯 4:30 PM: Internal Jenkins on an old subdomain. Secrets everywhere. 💰 4:45 PM: Got user data, employee data, AWS keys. It’s a buffet. 🕔 5:00 PM: Clock out. Easy day. jk..... Attackers don’t follow your IR plan. They don’t wait for your quarterly pentest. They don’t work 9–5. They hunt exposed assets, old creds, shadow subdomains, public GitHub leaks, leaked data in SaaS that will give away more information or give PII etc. They’re hacking every minute. Are you? #attacksurfacemanagement #offensivesecurity #cybersecurity #hacking #continuousmonitoring #assetinventory #offensivemonitoring
1
1
571
I hacked UberEats in 2017. Here is the story. #ubereats #hacking #uber #cybersecurity #bugbounty
2
1
616
It was amazing to present at @_kernelcon_ today. Thank you for the gift KernelCon team! #kernelcon #offensivesecurity #researchontheroad
4
382
💥 Q1 Update from the Field: Real-World Hacking with Orion 💥 In Q1, we pointed Orion, our offensive Attack Surface Management platform, at a large enterprise to see what it could uncover. The results speak for themselves: 🔍 𝟵 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱 🚨 𝟴 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹, 𝟭 𝗛𝗶𝗴𝗵 🤖 The High severity finding was discovered entirely by Orion with no human involvement 💰 Approximately $𝟰𝟱,𝟬𝟬𝟬 in rewards from responsible disclosure 🌐 Orion also surfaced multiple vulnerabilities in widely-used open-source software such as a supply chain vulnerability in a Microsoft repository The 9 issues had the potential to expose millions of users’ sensitive data including 𝗦𝗦𝗡𝘀, 𝗗𝗼𝗕𝘀, 𝗲𝗺𝗮𝗶𝗹𝘀, 𝗮𝗻𝗱 𝗮𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀. If exploited, they could have led to major regulatory fines, incident costs, and increased insurance premiums. 𝗤𝟮 𝗴𝗼𝗮𝗹: 𝟱𝟬+ 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀. 𝗟𝗲𝘁’𝘀 𝗴𝗼 🔍⚔️ #OffensiveSecurity #AppSec #RedTeam #SecurityAutomation #BugBounty #ASM
2
334
RT @uraniumhacker: We are doing #VibeSecurityForAI If you are an AI startup (pre-seed or seed ) we will test your application for free. We…
1
94
Not yet a full multiplayer but doing some basic "Simon Says" style game with increasing difficulties. Will add leaderboard style system soon. Open to ideas to improve it further @levelsio taptastic.app
186