The XSS Rat - Proud XSS N00b :-)

I have built: - A security testing repo: github.com/The-XSS-Rat/Secur… - An API hacking tool: github.com/The-XSS-Rat/hackx… - A blog: blog.hackxpert.com/ (Yeah I know cert expired, will look into that today) - 150 exploits + 6 lifelike labs: labs.hackxpert.com/ - A student base of over 180 000 big: udemy.com/user/wesley-thijs/… - A wealth of courses: thexssrat.com/ - A youtube channel with over 1200 video's: youtube.com/c/thexssrat - A medium with over 7300 followers: thexssrat.medium.com/ - An incredible fanbase of over 50 000 rats on youtube + 150 000 here - A discord server with over 10 000 members + one for CAPIE + CNWPP + Hacker's toolkit - A list of 10 students i got to directly reporting bugs: thexssrat.podia.com/achievem… - A song: youtube.com/watch?v=S3bP3juJ… (No AI) - A family of my own - Reports on some of the giants of this earth - A pentesting company And still i get constantly attacked for not knowing anything - just copy pasting shit and not being good enough :-) hahaha you are so funny - THEN GO DO BETTER <3 Much love rat pack!! Thank you for the support!

Stop reading about incident response — live it 🐀 Five connected hosts, one breach: chase a webshell, rebuild the kill chain from the logs, triage 15 SOC alerts, hunt planted vulns in code, then defend a box that's actively under attack. Hands-on Purple Team lab 👉 ratctf.com/purple-team #purpleteam #infosec P.S. Want the full course catalog? Bundles here: thexssrat.podia.com/

Want your own branded CTF without the infra headache? 🐀 Upload your logo, pick your colours, add challenges and your admin panel is live in minutes. $20/month, setup included, cancel any time. ratctf.com/white-label #ctf #infosec

HackXpert Labs showed someone else's spam site for six days. My mistake, and a textbook dangling DNS record. → 29 Oct: the server hosting the labs got deleted by mistake → the DNS record kept pointing at its old IP → Linode reassigned that IP, and the new owner serves spam for any hostname that points at it → fixed 19 minutes after I noticed No personal data involved, nothing on my servers touched. I treated it as a security incident until I knew it was an accident, and every fix is in place. Full write-up, NIST SP 800-61 style, with timeline and indicators: labs.hackxpert.com/security-… Hunters: go check your own subdomains for records pointing at IPs you no longer own. 🐀

🐀 I tried to hack 33 AI gladiators in C0lloseum, a prompt injection CTF. How many fell? Watch: youtube.com/watch?v=ZPbgFScj… #infosec #bugbounty #AIsecurity Liked this? The Big Beautiful Bug Bounty Bundle is the natural next step (discount applies via the link): thexssrat.podia.com/big-beau…

New on Medium: The Three-Request IDOR Method - how I find broken access control before breakfast. Two accounts, three requests and one matrix: the routine that still pays my bounties in 2026. thexssrat.medium.com/the-thr… #infosec #bugbounty Want to go deeper? Check out the Big Beautiful Bug Bounty Bundle (a discount applies via the link): thexssrat.podia.com/big-beau…

Bug bounty in 2026? Start here 👇 My practical 2026 Bug Bounty Guide: mindset, recon, Burp deep dive, XSS/SSTI/SQLi/IDOR/SSRF, WAF bypasses, vuln chaining & reporting. Free on GitHub: github.com/The-XSS-Rat/Secur… #infosec #bugbounty Want the next step? Big Beautiful Bug Bounty Bundle (a discount applies via the link): thexssrat.podia.com/big-beau…

Your SIEM is only as good as the detections you build from it 🐀 Purple Team Series: "Help Me, I Got Compromised" - 5 hosts, 1 breach. Parse the logs, triage 15 SOC alerts, write a Python script that auto-classifies them, then defend a host under live attack. Find the gaps, then close them. ratctf.com/purple-team Also: certifications thexssrat.podia.com/cert #purpleteam #infosec

Got a community that never shuts up in Discord? Give them a CTF to fight over 🚩 RatCTF White Label = your own branded hacking competition: your logo, your colours, live leaderboard, unlimited challenges, machines & players. $20/month, cancel any time. ratctf.com/white-label PS: want to level up your own skills too? Certifications: thexssrat.podia.com/cert 🐀 #ctf #infosec

Shoutout to Owais, who just dropped his very first YouTube video 🎉 "How to Install Kali Linux in VMware (2026) | Under 3 Minutes" is short, beginner-friendly, and covers the step where every hacking journey starts. Getting the first upload out is always the hardest part. Rat Pack, go show him some love with a sub and a comment 🐀 youtube.com/watch?v=rg5-7Pw0…

🧀 SOLD OUT: 906 and 907 are gone. The 906 Beginner Web Hacking Guide bundle and the 907 Big Beautiful Bug Bounty bundle have both sold out in the Spooky Sale. Thank you to everyone who grabbed one, I'll see you inside the lessons. If you missed them, you haven't missed the sale. Until midnight tonight (Brussels time) everything else is still 75% off with code SPOOKY: • 900 — the Endless Updates bundle (every course I've made and every one I'll make) is still open as I write this • The courses inside 906 and 907 are still available individually: 000, 000-B, 001, 002, 003, 004, 005, 020, 021, 022-2 • 013 CAPIJ, the CAPIE voucher, 017 CNWPP, 050 OSCP prep and 084 CMWAP After midnight every price goes back to normal. No extensions this time. 👉 thexssrat.podia.com/dff7ec0a… #bugbounty #ethicalhacking #infosec

🧀 084 — CMWAP: Certified Modern Web App Pentester. €159.99 → €40. Ends tonight at midnight. Most web hacking courses still teach you to test a 2015 PHP app. The apps you'll actually get paid to break in 2026 are React and Angular frontends talking to REST and GraphQL APIs, with JWTs, OAuth flows, WebSockets and a CI/CD pipeline behind them. CMWAP is built for those. 202 lessons, my biggest course: modern auth (JWT, OAuth, SSO) and how it breaks, SPA and client-side attacks, API and GraphQL testing, race conditions, business logic, cloud-adjacent misconfigurations, and a full methodology you can run on any modern target. Written and taught by me, Wesley (The XSS Rat), as the course I'd want every junior pentester to have. €40 until midnight (Brussels time), then back to €159.99. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/084-cmwa… #pentesting #websecurity #bugbounty #infosec

🧀 050 — Uncle Rat's Ultimate OSCP Prep Guide & Course. €50 → €12.50. Ends tonight at midnight. The OSCP doesn't fail people on knowledge. It fails them on process: 24 hours, a blank notes file, and no plan for what to do when the first exploit doesn't land. 139 lessons built around exactly that: enumeration you can repeat on autopilot, Linux and Windows privilege escalation, buffer overflow walkthroughs, Active Directory fundamentals, pivoting, note-taking and reporting, and a study plan that fits around a job. Put together by me, Wesley (The XSS Rat), from everything I wish I'd had before my own exam. €12.50 until midnight (Brussels time), then back to €50. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/uncle-ra… #oscp #pentesting #ethicalhacking #infosec

🧀 017 — CNWPP: Certified Network & Web Pentesting Professional, lesson material + exam voucher. €599 → €149.75. Ends tonight at midnight. Most people learn web hacking or network hacking. Real engagements need both: the external web app, the internal network behind it, and the path that connects them. CNWPP is my full track for exactly that. You get the complete lesson material (web app testing, network enumeration, Active Directory basics, privilege escalation, pivoting, reporting) plus a 365-day exam voucher for the hands-on practical exam. Built and taught by me, Wesley (The XSS Rat), for people who want to walk into a pentesting role with proof they can do the job. €149.75 until midnight (Brussels time), then back to €599. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/cnwpp-ex… #pentesting #certification #ethicalhacking #infosec

🧀 CAPIE — Certified API Hacking Expert, exam voucher. €349 → €87.25. Ends tonight at midnight. A certificate of completion says you watched the videos. CAPIE says you broke a real API under exam conditions and wrote it up like a professional. That's the difference hiring managers and triage teams actually care about. The exam: a hands-on, practical API assessment against a live target, judged on findings and report quality, not multiple choice. Built and graded by me, Wesley (The XSS Rat), the same way I'd judge a pentest deliverable. Pair it with the 013 CAPIJ lesson material (also on sale tonight) if you want the full study path first. €87.25 until midnight (Brussels time), then back to €349. That's the cheapest this voucher gets all year. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/exam-vou… #apisecurity #certification #pentesting #infosec

How To Use AI To Become a KiLLER Hacker 🐀 AI won't replace hackers, but hackers who use AI will outpace the ones who don't. Watch here: youtube.com/watch?v=DH_7J2yl… Liked this? Next step: the Beginner Web Hacking Guide Bundle, a discount applies via the link: thexssrat.podia.com/901-begi… #infosec #bugbounty #AI

🧀 013 — CAPIJ: Certified API Hacking Junior, full lesson material. €99 → €24.75. Ends tonight at midnight. Every modern app is an API wearing a frontend. Mobile apps, SPAs, microservices, the whole thing talks JSON under the hood, and most of it was never tested by anyone who thinks like an attacker. 151 lessons covering the OWASP API Top 10 (2019 and 2023): BOLA/IDOR, broken authentication, mass assignment, rate limiting, SSRF, improper inventory, plus Postman and Burp workflows, GraphQL, and how to document findings. This is the complete study material for my CAPIJ certification: finish it, earn the certificate of completion, and you're eligible to sit the exam. Written and taught by me, Wesley (The XSS Rat). €24.75 until midnight (Brussels time), then back to €99. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/capie-le… #apisecurity #bugbounty #owasp #infosec

🧀 022-2 — Uncle Rat's Ultimate Guide to Broken Access Control. €29.99 → €7.50. Ends tonight at midnight. Broken Access Control is #1 on the OWASP Top 10 for a reason: it's everywhere, scanners can't find it, and it's the bug that keeps paying my bills. IDORs, privilege escalation, forced browsing, one changed ID in a request and suddenly you're reading someone else's invoices. 36 lessons: how authorization actually breaks, finding IDORs in IDs, UUIDs and GraphQL, horizontal and vertical privilege escalation, multi-step flows, mass assignment, and how to prove impact without crossing the line. Includes the original 022 course and a certificate of completion. Written and taught by me, Wesley (The XSS Rat). €7.50 until midnight (Brussels time), then back to €29.99. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/022-2-un… #idor #bugbounty #owasp #infosec

🧀 021 — Uncle Rat's XXE Handbook. €69 → €17.25. Ends tonight at midnight. XXE is the bug most hunters skip because XML "feels old". That's exactly why it still pays: SOAP endpoints, file uploads, SVGs, DOCX parsers and half the enterprise world still parse XML, and most of it is misconfigured. 17 focused lessons: how XML parsers actually work, classic and blind XXE, out-of-band exfiltration, SSRF and file read through XXE, XXE in file uploads, and the payload collection I use when I find a parser. Short, dense, no filler, written by me, Wesley (The XSS Rat). €17.25 until midnight (Brussels time), then back to €69. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/uncle-ra… #xxe #bugbounty #websecurity #infosec

🧀 020 — The Ultimate Beginner's Guide to XSS. €29 → €7.25. Ends tonight at midnight. I'm The XSS Rat. The name isn't a gimmick: XSS was the bug that got me paid first and it's still the one I find most often. This is the course where I teach it from scratch. 53 lessons: reflected, stored and DOM XSS, how to spot injection points, bypassing filters and WAFs, turning an alert() into real impact, how to write it up so triage takes it seriously, and where AI tools fit into your XSS workflow in 2026. Certificate of completion included. €7.25 until midnight (Brussels time), then back to €29. Code SPOOKY is applied automatically through the link. Yes, it costs less than a sandwich. 👉 thexssrat.podia.com/ultimate… #xss #bugbounty #websecurity #infosec

🧀 005 — The Bug Hunter's Blueprint: 5 Labs, 5 Ruthless Methodologies. €99 → €24.75. Ends tonight at midnight. Knowing a hundred vulnerabilities doesn't make you a hunter. Having a methodology you run the same way on every target does. That's the gap this course closes. 50 lessons and 6 lifelike labs: you get a target, you get my exact methodology for that type of target, and you hunt it the way I would, step by step, until you can do it without me. No theory dumps, just the repeatable process that keeps my own bounties coming in. Built and taught by me, Wesley (The XSS Rat). €24.75 until midnight (Brussels time), then back to €99. Code SPOOKY is applied automatically through the link. 👉 thexssrat.podia.com/005-the-… #bugbounty #methodology #ethicalhacking #infosec