R-T-F || This is my Way not the Way || Web Watch
Nairobi, Kenya
Joined June 2009
- Tweets1.4K
- Following2.8K
- Followers349
- Likes1.2K
Manheri retweeted
Bug bounty has definitely changed.
I used to spend hours analyzing HTTP requests, switching back and forth between Firefox and Burp Suite.
Now, I open my terminal, point my AI skills at a target, intercept and analyze HTTP traffic using Burp Suite MCP, and offload heavy tasks to my HackBot running on a VPS.
But here’s the thing: AI doesn’t replace your hacking skills. It scales them.
The goal is to get really good at manual hacking first, then use AI to automate and scale what you already know.
Not the other way around.
You don’t start by building a HackBot and expecting it to hack for you when you don’t even understand what it’s doing.
Learn to hack first. Automate second. Scale third.
Keep hacking! ✌️
I keep confusing BOLA : It's Broken Object Level Authorization not
Broken level Object Authorization.
This is the methodology he used. Killa is something else.
The Bitcoin got stolen!!!!!!!
Someone finally did it.
Twenty hours of silence. Counter ticking. Nobody touching it.
Then someone actually figured out the exploit chain on a live server.
With real Bitcoin sitting there.
And took it.
The exploit works. Not in theory. Not in a lab. On a real vulnerable PHP server running in production.
Every security researcher who said "these are the worst vulnerabilities in decades" just got vindicated.
The government who told people to unplug their servers just got vindicated.
The NSA who published emergency mitigation guidance just got vindicated.
But mostly the attacker just got Bitcoin.
The counter on stealmybitcoin.com stopped ticking.
The challenge is over.
PHP 8.2 and 8.3 with patches. Still secure. Untouched.
PHP 8.1 and older. No patches available. Ever.
One just got exploited on a live server.
Now we know for certain. The hype is real.
The vulnerabilities work. The exploit chains chain.
And someone out there knows how to do it.
Which means everyone will know how to do it within a week.
Then every vulnerable PHP server gets compromised.
Then the attacks scale.
Then the infrastructure starts going dark again.
The developer created the perfect incentive structure.
Real money. Real vulnerability. Real challenge.
Someone won.
Everyone else just realized the danger was never academic.
1- Heap Setup plus OOM
2-Leak cookie
3-Heap setup plus OOM
4-RCE
Repeatedly.
Can't make any guarantees as to uptime or how long I can keep this up: challenge is back up on old.stealmybitcoin.com for the next few days. No prize. Treat server as if toxic / use at own risk.
Confirmed that @killa 's POC replicates here. It may take a few tries.
What a combo ! It's possible.
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Manheri retweeted
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Manheri retweeted
Good thing with shrooms they organic,and have alot of positive attributes,,we actually share alot of genetic n molecular structures with mushrooms.
Used responsibly and with awareness it's a spiritual healer for sure..always remember to let go of expectations
I love it when running anything using Kali Linux terminal, navigating this OS is a Flex.
Though it's the bear minimum.
The only thing that could destruct our attention from Following up on the passed law about live streaming of IEBC presidential results was the collapsing of Easil building and rescue operations ongoing, every mainstream media covering it .
Eeh eeh eeh .