@hacker_
 Brookings, South Dakota
boring.co
Joined February 2016
  • Tweets4.3K
  • Following873
  • Followers72.1K
301Media
In 2010, WikiLeaks released a classified document. A list of infrastructure critical to U.S national security. The government listed a Trans-Atlantic cable. 3 years ago, 19-year-old me gained ADMIN access to that cable (and another; shared codebase). 🧵Here's how I found it
91
917
120
4,871
Wind is whipping! Let’s see some carnage #UsOpen
1
1
5
2,414
Whoops.... github.com/apache/httpd/comm…
32
113
32
1,464
272,677
Corben Leo retweeted
Narendra Modi
@narendramodiApr 3
Good Friday reminds us of Jesus Christ’s sacrifice. May this day further deepen the values of harmony, compassion and forgiveness. May brotherhood and hope guide us all.
6,167
39,476
1,997
409,795
48,060,939
on a generational run this week & it doesn't even feel like i'm trying hard
6
1
253
13,405
CLAUDEEEE. My outlook on the future has dramatically shifted overnight. Wow.
37
57
8
1,422
214,371
3
20
2,451
Joined the dad gang. My wife is a champ. also, what are the chances!!!?
22
5
1
253
13,192
Corben Leo retweeted
Daehee Park
@daehee14 Dec 2025
Great turnout for the grand opening of our @boringmattress showroom at Culdesac Tempe
2
1
10
4,119
HELP
Corben Leo
@hacker_18 Aug 2025
So, the side project(?) has been interesting...Thanks @Cloudflare 😅
5
23
11,015
So, the side project(?) has been interesting...Thanks @Cloudflare 😅
8
1
48
21,533
2
1
37
8,689
You're using Burp Collaborator wrong. Don't use Burp's default collaborator instance when testing for out of band vulnerabilities. Many companies use egress filtering & block outbound traffic to the default collaborator domain oastify.com It's worth setting up a private instance: github.com/putsi/privatecoll… #typefully day 11
7
98
2
439
39,530
Doing code analysis? Use cursor.sh/ by @anysphere! Whether you’re digging through a language you know or adventuring into a new one, using AI can definitely be helpful. Don’t think it’ll replace us yet, but auditing got more accessible. #typefully day 10
1
36
220
20,577
Finding vulnerabilities first = you get paid. Want to be the first to hack on new functionality? Monitor your target’s JS files for new paths or parameters. (automate with a headless browser to grab all dynamically loaded JS) #typefully day 9
4
25
247
22,598
Focus is a competitive advantage. It’s tempting to jump around, but deep focus on one thing pays off. This applies beyond hacking, but you should stick to a target for a long time and become an expert. For example, @nnwakelam knew more about Yahoo than any Yahoo employee Focus. #typefully day 8
3
17
170
19,995
Attack surface is larger than you’d expect. Most companies have domain names that they use internally (for development, QA, etc). Ex, PayPal uses “paypalinternal.com” Heres how you can find network misconfigurations and find “internal assets” on the public internet:
15
97
504
47,371
It starts with finding these domain names. Find them in: ⁃your target’s CSP header ⁃/crossdomain.xml ⁃in JavaScript files ⁃GitHub ⁃Reverse whois (whoxy.com) Search for them using Shodan or certs.io: $ certsio search domain <internal_domain>
1
6
80
9,338
Lastly, you should search by organization name: $ certsio search org “Uber Technologies, Inc.” Certificates can also contain emails,you should search for assets using them: $ certsio search emails @example.com #typefully day 7
1
4
65
8,649
Load more