#HackAIcon is finally here! 🚀

How to extract endpoints from JS using @pdiscoveryio's katana 👇

Just one week to go until hackAIcon in Lisbon! 🤖🇵🇹 Can't believe tickets have officially sold out already! Thank you to everyone that has supported the event 🙏 I can't wait to see you all there!

If you need a list of trusted resolvers, e.g. to be used with puredns for active enumeration, @trick3st has a great one. Just run this:  ⌨️ curl https://raw.githubusercontent.com/trickest/resolvers/refs/heads/main/resolvers-trusted.txt -O More stuff at👇 https://github.com/trickest/resolvers

If you look at the AI-generated code below, you may notice that path traversal is prevented via basename functions. Can you still exploit it? Try here 👉 https://ai4eh.ethiack.ninja

The Hack the Agent challenge is finished. GG to all the hackers who played! We hope you enjoyed it. We will leave it running for those who still want to play with it at https://hacktheagent.com Stay tuned on @ethiack socials for more challenges.

This one-liner by @tomnomnom.com finds all Git repos, creates a git-objects/ folder for each one and dumps every object (commits, trees, blobs, tags) into files named by their hash. Effectively exporting the raw Git database into human-readable files, repo by repo!

Bypassing WAFs with traditional payloads is getting harder. Here's how clever payload splitting can bypass them 👇

Some thoughts from @rez0__ on the future of bug bounty and AI 🔥 As someone working on hackbots, I agree that human + AI symbiosis will likely be more effective than either alone.

Want to put your AI model hacking skills to the test? See if you can solve all the challenges in our Hack The Agent challenge! Try it at: https://hacktheagent.com

Want to learn how AI can be used for ethical hacking?  Check out the contents from my workshop on Github!  You'll find: ✅ Workshop guide ✅ Scripts ✅ Tools ✅ CTF Challenges Get stuck in (feedback welcome!) at 

HackAICon is just around the corner! If you wanna join us in Lisbon and haven't got your ticket yet, grab one here: https://hackaicon..com Or try to win a ticket! (🔗 link in comments)

Time to reveal what I was doing with @teknogeek.io back in '19. All the hard work and sleepless nights have paid off!

The AI-powered hacking space is moving fast. CAI was already pretty solid, and Strix just dropped last week. Strix: https://github.com/usestrix/strix CAI: https://github.com/aliasrobotics/cai Anyone tried these yet?

Want to win a ticket to HackAICon, @caido.io licenses or even a @ctbbpodcast.bsky.social discord subscription?  We're currently running a simple 5-level LLM CTF Challenge. Complete all levels to enter our weekly raffles. Good luck! Start hacking: https://hacktheagent.com

Typical CSS injection often relies on repeated context loading (usually via iframes) to exfiltrate sensitive tokens. I found this tool that works in Chrome / Safari. It can leak tokens with just a single CSS import by leveraging -webkit-cross-fade 🤯 Check it out 👇

Try this out on your next target! Some more gold from the guys at @ctbbpodcast.bsky.social! 🔥

How to turn iframes and window.open into weapons for XSS. From origin manipulation to sandbox escape, this paper by Huli is stacked with juicy info.  Read at: https://blog.huli.tw/2022/04/07/en/iframe-and-window-open

What happens after Black Hat and Defcon? HackAIcon 2025.  We're hosting a conference dedicated to combining AI and ethical hacking in Lisbon! And we have some incredible speakers lined up for you. Early Bird tickets are available! Get your ticket: https://hackaicon.com

We’ve just launched Hack the Agent, a 5-level CTF where your goal is simple (in theory): jailbreak the LLM and make it do exactly what it's not allowed to do. 🔗 Start hacking now hacktheagent.com #HackTheAgent #HackAIcon #Ethiack #Cybersecurity #HackAI

And that's a wrap 🎰 First time with @ethiack.com at #hackersummercamp This year I didn't participate in any Live Hacking Events, so I pivoted to the OSINT competition from Recon Village. I'm now an uncertified geoguesser📍 See y'all next year!

Just released a new recollapse version thanks to @ryancbarnnet and @4ng3lhacker after their talk in BlackHat today. What’s new? 💥Mode 6: Fuzz case folding/upper/lower 💥 Mode 7: Fuzz byte truncations 💥 Recollapse can now be used as a python library and is available on PyPI Check it out 👇

Want to learn how to hack LLMs? The research team at @ethiack.com just launched a 5-level CTF. And we’ll be handing prizes to top performers every week, including @caido.io licenses! 👉 hacktheagent.com

We just dropped some research and used our hackbot to take it further. Read and go bypass some WAFs 🚨 Congrats Bruno Mendes for the great research 🔥

How to use ScrapeGraphAI to generate a summary of a webpage and use NLTK to turn it into a target specific wordlist. You'll find the nlp.py example script here 👉 https://blog.ethiack.com/blog/dont-fear-the-ai-reaper-using-llms-to-hack-better-and-faster

If you're learning about vibe hacking, here's a cool article demonstrating how Matthew Keeley used AI to create a working exploit for CVE-2025-32433 before any public PoCs existed! Well worth a read 👇 https://platformsecurity.com/blog/CVE-2025-32433-poc

How to grab subs for a target using subfinder, validate them and extract the text body from each response using httpx and jq, extract a wordlist of keywords using NLP then resolve them using puredns to find valid subdomains 👇

Is AI is our ultimate test? Just watched @tristanharris mind-blowing talk. Remember him from The Social Dilemma? In this video, he explores how we may be repeating social media mistakes with AI but at a much more cosmic scale. If you care about our collective future: https://tinyurl.com/3krd76zj

Tools like Subwiz and alterx are great, but I also like to combine the power of LLMs with traditional NLP. Here's how (read thread 🧵)

Have you checked out @hadriansecurity's subwiz? It's a recon tool that uses ML to predict and resolve subdomains👇

Ready to explore how AI is transforming Ethical Hacking? We've put together some introductory hands-on examples including: 🔍 Recon & Discovery ⚡ Exploit Development 🤖 Hackbots 🧠 Integrations & Plugins 🏆 CTF Challenges Check it out: https://github.com/ethiack/ai4eh

Vibe coding became a thing. Everyone can now code, but where does that lead us regarding security? We turned our time machine on and did a little trip to 2035 to get some answers 👀

Love the nowafpls Burp extension by @assetnote to bypass WAFs but using Caido? @Rhynorater recreated it for @CaidoIO. Check it out 👇

What's your take?  I just wrote a blog on this called "Don't fear the AI reaper" to share my thoughts. Read it here: https://blog.ethiack.com/blog/dont-fear-the-ai-reaper-using-llms-to-hack-better-and-faster More takes in the workshop doc.

Looking for new bypasses or gadgets in Chrome? Google publicly shares upcoming Chrome features through 'Intent to Ship' posts for community review. Definitely worth keeping an eye on 👇 https://groups.google.com/a/chromium.org/g/blink-dev Shout-out to @ctbbpodcast.bsky.social for the tip!

Vibe coded a PHP app using Claude code. Path traversal is prevented via basename functions. Can you still exploit it? 🤔 A shell is waiting for you at https://ai4eh.ethiack.ninja

DMARC can reveal more domains associated with a target. https://dmarc.live/info/<target-domain> allows you to find domains using the same DMARC record. Check it out 👇 There's also a python tool: https://github.com/Tedixx/dmarc-subdomains

A cool recon trick to find more targets is to check out CSP policies for juicy assets. csprecon can do this for you 👉 https://github.com/edoardottt/csprecon

PHP functions like file() don’t display content, but that doesn’t mean they’re secure. This @synacktiv.com research explores how php://filter can turn these silent reads into file leaks. Take a look👇

SMTP expects messages to end with the sequence \r\n.\r\n But not all servers agree. Some interpret \n.\n, others accept exotic sequences like \r.\r. If an outbound server ignores a delimiter and the inbound recognizes it, you get a context break. That’s SMTP smuggling.

Most open redirects are low-severity or N/A. But used creatively, they can become high impact gadgets. Here are 4 ways to show impact with open redirects:

Nginx normalizes paths (/../, %2e, etc.) before applying access rules like: location = /admin { deny all; } But backends like Node.js or PHP handle decoding again, and differently.

Requests often contain a lot of unnecessary headers.  Removing headers one by one and checking the response after removing each header takes too much time. Burp Header Guardian: https://portswigger.net/bappstore/096df707a309468488bc9f7d3340bdba Caido Squash: https://github.com/evanconnelly/squash

How to search for verified credentials in github repos, logs, filesystems and more using Trufflehog 👇 Use the --only-verified flag to reduce false positives. Trufflehog is one of the best tools out there for finding juicy secrets.

Can you hack a vibe coded PHP app? Yes. Can you use AI to hack the same app? Yes. Just dropped our workshop on AI for Ethical Hacking. Full materials 👇 github.com/ethiack/ai4e... Blog post: blog.ethiack.com/blog/dont-fe...

AI won’t replace hackers. But it’s changing everything. We published our full guide from the “AI for Ethical Hacking” workshop on C-DAYS: tutorials, tools, CTFs & live demos from LLM fuzzing to autonomous hackbots. Read + hack now: blog.ethiack.com/blog/dont-fe...

If you're hunting for hidden parameters or cache poisoning vectors, check out Param Miner. This Burp Suite extension identifies unlinked and undocumented parameters using intelligent guessing and diffing logic, ideal for discovering web cache poisoning bugs! t.ly/8xspH

I like to bypass XSS filters and sanitizers, so I keep forgetting to test for CSS exfiltration when I have HTML injection. This reminded me of the sic tool by @d0nut.dev  from a Singapore LHE, but there's also a cool list from @portswigger.net  👇

Did you know an input can use the form attribute to link to a form by ID letting it submit with the form even if it’s placed outside of it!? 👀  In this PHP example, an input outside the form adds a URL argument and only the second parm value (1337) is echoed. S/O to @encodeart and @ctbbpodcast! 🔥

This is how DOM clobbering works 👇