Penetration Tester / Speaker/ Bug Bounty Hunter /
Oklahoma
Joined July 2021
- Tweets3.1K
- Following2.2K
- Followers2.5K
- Likes43K
Roll4Combat retweeted
At @arcanuminfosec we've been doing "AI as an Insider" and compromise via DevOps methodologies for a year already. Three parallel methodologies for assumed breach testing.
We simulate things like Mercor and other high profile breaches. Reach out if want to work with some of the best!
arcanum-sec.com/services/ass…
Over the last couple of weeks, I've gotten to hack with @G0053me, which has been a lot of fun. We have popped some fun bugs, complained about triagers, and planned some beer trips in London/Beligium early next year. My favorite part of bug bounty isn't the money, it's the people I meet.
Roll4Combat retweeted
Sometimes it seems security is drifting back towards a "Prevent Breach" mindset.
Prevent breach was never enough. Patch faster, of course.
But offensive AI is about a lot more than finding bugs!
Invest in Assume Breach!
Grow an internal Red Team. Automate offensive AI. Learn with defenders what matters
Exploit yourself before someone else does it for you.
In the end, you will not patch your way out of this.
Roll4Combat retweeted
Before local AI is banned, learn how to host and tune your own models.
Specific learning curves to understand for me were:
- Offloading portions of newer models to SSD rather than RAM
- Prompt caching configs
- Preload tuning
- the right choice of model for the task
- pre optimized models for your hardware and harness
- finding the fastest inference server at the web/api level
Roll4Combat retweeted
Sometimes you get on here and everyone is shouting about things you know… They are friends, and people you respect, or with titles, etc, and when those opinions get numerous you begin to doubt yourself…
Don’t.
9 times out of 10, it’s hyperbole, groupthink, sensationalism, trolling, marketing, or grift.
Test your assumptions and expertise, pivot if things change, but if you are true expert or practitioner, stay strong and confident in your abilities and intuition. 🫶
Roll4Combat retweeted
daybreak-blue cares so much about authorisation, I asked it to patch a bug in "scope add" and it removed the feature to make scope read-only 🤣
Roll4Combat retweeted
Guys I do sometimes prompt like… “find me a crit, make no mistakes” but only because I have 70+ thoroughly researched and defined skills for my custom harness…
New Executive Offense with @Jhaddix and me on why every model has to earn its way into Armada, what refusals cost a hackbot, and why benchmarks only nominate challengers.
executiveoffense.beehiiv.com…
Can’t wait till everyone gets their hands on it
We tried all the agent harnesses, frameworks, and commanders under the sun… and none was right for us. So we built our own, Armada. Here’s what we focused on:
Specialized for offsec (deep skill engineering)
Engineered to fight competition bias Performs on long running tasks
Web, recon, LLM, Internals
Auto scaling
Auto learning (skills)
Deep logging
90% browser based for max success
Local and remote model compatible
Mutator proxy to enhance injection testing
Separate review agent
Next up:
Mobile client
Phone alerts
Model routing
Web Dashboard
Roll4Combat retweeted
Q: “Jason is the vuln apocalypse here!?!??”
Eh, if you were around in the early web days we had worse weeks than this.
We survived and were better for it.
Roll4Combat retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
open.spotify.com/track/5WpEO…
The sound that goes through my head waiting to read today's chaos
Roll4Combat retweeted
Looking for tips in building your hackbot? Catch this new episode of Offense Taken with @Jhaddix
What happens when autonomous agents start hacking for real?
@fede_k + @Jhaddix share their predictions in this episode of OFFENSE TAKEN 🔮
youtu.be/BfwYN-9_1KI?si=9HJM…
I think the funniest thing right now is that 98% of us don't realize we can switch between the CLI and Claude/ChatGPT's desktop apps. I have used both the CLI and the desktop apps heavily, and I recently caught myself complaining about blocks when all I needed to do was set up and run via the CLI with an older version until the current one is fixed.
I may also have forgotten that I have 3 completely different builds, depending on what I'm doing and which version I'm working with.