Behi (@Behi_Sec) header
Behi (@Behi_Sec) profile picture

Behi

@Behi_Sec

Bug Hunter & Tool Builder.

 /dev/null
github.com/BehiSecc
Joined July 2025
  • Tweets1.4K
  • Following68
  • Followers6.9K
66Media
Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)Photo by Behi (@Behi_Sec)
Just dropped a new blog post! 🔥 blog.orange.tw/posts/2026-10…
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥

blog.orange.tw
14
218
19
735
23,688
People seriously underestimate HuntProxy. You don’t need Burp. You don’t need a laptop. You don’t need to worry about CAPTCHAs. All you need for bug hunting is a VPS and an AI subscription. github.com/BehiSecc/HuntProx…
GitHub - BehiSecc/HuntProxy: A web security workbench built for AI agents.

GitHub - BehiSecc/HuntProxy: A web security workbench built for AI agents.

A web security workbench built for AI agents. Contribute to BehiSecc/HuntProxy development by creating an account on GitHub.

github.com
4
48
395
14,730
Behi retweeted
s1r1us (@S1r1u5_) profile picture
s1r1us
@S1r1u5_Oct 26
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it the bug is so complex that even porting the exploit between targets takes serious skill, human or ai so i benchmarked how well open and frontier models can do it. 🧵
Image from s1r1us (@S1r1u5_)
44
64
13
638
55,583
Anyone else find themselves chasing shiny objects more often because of AI? Every time I reflect on my day, I realize how much time I’ve spent on things that weren’t really necessary or a priority.
1
1
21
1,185
Replying to @TheHackersNews
@TheHackersNews
Image from Andras Bacsai (@heyandras)
31
339
59
4,963
253,251
Nice watch. youtu.be/1Fql8oQ1Zbs
Frans Rosen on the AI Age of Bug Bounty (Ep. 195)

Frans Rosen on the AI Age of Bug Bounty (Ep. 195)

Episode 195: In this episode of Critical Thinking - Bug Bounty Podc...

youtube.com
6
746
XSS
11
933
We’re seriously underestimating DeepSeek V4.1 Flash’s capabilities in cybersecurity. Give this model the right instructions and direction, and it’ll uncover vulnerabilities you’d never expect it to find in a million years.
35
34
743
30,570
I’m so tired of GPT-6.1 Sol overengineering everything 😭😭 Just fix the goddamn issue.
1
10
1,149
Behi retweeted
Simon (@soeckly) profile picture
Simon
@soecklyOct 12
I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…
How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

simonkoeck.com
56
305
15
2,462
186,677
I really like what OpenAI and @thsottiaux are doing. The amount of effort they’re putting into making their models and products better is insane. There will always be issues, but what matters is that they genuinely care about the user experience.
5
812
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

4
61
3
242
23,049
Nothing is more satisfying than building a hackbot that matches your own bug-hunting skills.
1
2
50
2,528
What are you talking about? I’m already verified for the Cyber program.
Image from Behi (@Behi_Sec)
5
25
4,744
How to 10x the efficiency of DeepSeek V4.1 Flash for bug hunting: Set up an advisor agent that continuously reviews its work, catches weak reasoning, and directs what it should investigate next.
8
15
1
268
14,721
Does anyone know of a *.google[.]com domain that resolves to a local/internal IP, such as 127.0.0.1?
4
67
15,509
This is so funny 😂 Claudia should have used Claude instead of Gemini.
Google Gemini (@GeminiApp) profile pictureGoogle Gemini
@GeminiAppSep 24
Look what Claudia can do.

618
It worked! Just keep trying, it didn't even ask for ID verification this time.
vinaykumar🍁 (@Xplo8E) profile picturevinaykumar🍁
@Xplo8ESep 30
1. Install 'IDmelon Authenticator' from playstore 2. Signup and create key 3. Use it to register with chatgpt cyber 4. Profit $$
6
3
143
25,762
Z AI team must be so happy now 😄 anthropic.com/research/glm-5…
GLM-5.3 and the spread of advanced cyber capabilities

GLM-5.3 and the spread of advanced cyber capabilities

GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.

anthropic.com
9
993
Powered by Astra and without drawing down on any of your usage 🤯
Tibo (@thsottiaux) profile pictureTibo
@thsottiauxSep 29
Announcing dots. Dots work 24/7 for you, learn from your feedback, have their own computer, browser and can be connected to over 4k apps in our ecosystem. They’re powered by Astra our best model yet. Included in your Pro plan, without drawing down on any of your usage. You can even call a dot while it’s working. We’re getting you started with your primary dot today and soon you’ll be able to create entire teams of them.
2
911
Load more