Get live statistics and analysis of s1r1us's profile on X / Twitter

I am starting a new company. We will be exploring LLM capabilities in software security and sharing our work publicly in our blog. So far, we created a benchmark and found multiple 0 days with the help of LLMs, and will be sharing once they are fixed.

You pay to use OpenAI. I get paid by OpenAI. We are not the same xD

Hacking Windsurf: I asked the AI for the shell, it said yes. new video’s out. I show how I could’ve hacked you… just by getting you to click my link. Link posted below.

Mutation-Based XSS + V8 type confusion + V8 sandbox escape = RCE on Basecamp. Disclosed it on Hackerone: https://t.co/slsv3j4jXx go read the comments if you wanna see what a week of exploit dev pain looks like.

i got access to this twitter account, what should i post?

probably just engagement farming. CTF hate is usually skill insecurity and copium. plus all those skills mentioned are table stakes for any decent CTFers, they’re buys pwning browsers and tearing apart complex apps.

please share some of the most creative vulnerabilities you've read or found. most bugs aren’t about creativity but just having the right knowledge + mindset, novel not because they were complex, but because no one had the full picture before. I'm looking for something beyond that. a bug that truly required out-of-the-box thinking.

hot take: the Indian security research and bug hunting community seems overly insecure. I recently collaborated with a bug bounty team, and ironically, no one was actually sharing their work, yet they called it “teamwork.” this isn’t just a one-off experience; it seems to be the norm. Y’ALL should really read Prisoner’s Dilemma.

note the CVE slop is from project zero's big sleep. i agree that there is real problem in terms of desperate cve chasers, CVE fatigue, false reports, beg bounty reports and so on. but calling a project zero report a CVE slop is naive and it shows the arrogance. i never seen a security researcher denying help on patching the issue, project zero would've happily helped in submitting the patch.

hot take: the Indian security research and bug hunting community seems overly insecure. I recently collaborated with a bug bounty team, and ironically, no one was actually sharing their work, yet they called it “teamwork.” this isn’t just a one-off experience; it seems to be the norm. Y’ALL should really read Prisoner’s Dilemma.

if you have one hour to inspire complete beginners to get into hacking, what would be your approach?(preparing for a talk tomorrow)

I am starting a new company. We will be exploring LLM capabilities in software security and sharing our work publicly in our blog. So far, we created a benchmark and found multiple 0 days with the help of LLMs, and will be sharing once they are fixed.

You pay to use OpenAI. I get paid by OpenAI. We are not the same xD

Hacking Windsurf: I asked the AI for the shell, it said yes. new video’s out. I show how I could’ve hacked you… just by getting you to click my link. Link posted below.

note the CVE slop is from project zero's big sleep. i agree that there is real problem in terms of desperate cve chasers, CVE fatigue, false reports, beg bounty reports and so on. but calling a project zero report a CVE slop is naive and it shows the arrogance. i never seen a security researcher denying help on patching the issue, project zero would've happily helped in submitting the patch.

yay, 4th year in a row, still no US visa for DEFCON. sucks missing out on the talks and parties. i wish the US had a fast-track business visa like the UK, take my money, hold my assets till I return, just give me the b1/b2 visa.

If the money went away, would you leave hacking?

i got access to this twitter account, what should i post?

looking for a video editor to help me publish my recent hacks, planning to publish these bugs on my channel 1. supapwn: stockholm lovable adventures 2. cluely rce 3. perplexity comet uxss 4. openai atlas history and url leak

CTF Challenge Time GPT prompt that should make GPT not output any words or text. Rules: Should not be DoS 😅.

please share some of the most creative vulnerabilities you've read or found. most bugs aren’t about creativity but just having the right knowledge + mindset, novel not because they were complex, but because no one had the full picture before. I'm looking for something beyond that. a bug that truly required out-of-the-box thinking.

probably just engagement farming. CTF hate is usually skill insecurity and copium. plus all those skills mentioned are table stakes for any decent CTFers, they’re buys pwning browsers and tearing apart complex apps.

how do you solve this? 1) some open source projects are used by millions 2) they are under-resourced and maintained by volunteers 3) the amount of vulnerability reports increased due to AI 4) most reports are either slop or low severity issues. 5) many security people are incentivized to submit noise and farm CVEs for reputation. 6) however "one critical report" puts millions at risk 7) open source project maintainers are ethically responsible for keeping it secure. 8) lack of resources puts lot of work on devs and they burnt out for fixing vulnerabilities rather than releasing features which they want to. 9) simply saying “it’s run by volunteers” doesn’t solve the problem. 10) patch generation isn’t trivial, a wrong fix can expose the bug and give attackers an easier path.