@Mah3Sec

🕉️ 🚩| Security Engineer🇮🇳 | 3 CVE | CRTP | CEH |Secured 200+ Companies

 Rajsamand, Rajasthan
youtube.com/@mah3sec
Joined September 2019
  • Tweets2.8K
  • Following435
  • Followers2.8K
307Media
Corruption. Broken education. Poor infrastructure. A dying environment. Every taxpayer can see what's happening. My patriotism is for my country, not any political party. As citizens, we have every right to question the government. Accountability is their duty. #neetleak
1
1
179
Mahendra Purbia retweeted
Vinay sati@_VinaysatiOct 15
Meet Darknet MCP 🌍 Open-source dark web & threat intelligence for AI agents. 68 MCP tools. One local dashboard. Security researchers & builders worldwide: try it, share feedback, contribute, or star the repo. github.com/Vinaysati/Darknet… #CyberSecurity #MCP #darkweb #hacking
🤖 Made with AI
2
5
232
I failed my first CRTO attempt. 7 days later, I came back with a better process, better preparation, and a very different mindset. I wrote about what went wrong, what I changed, and what I learned from the experience. Same knowledge. Different discipline. 🔗 mah3sec.medium.com/my-crto-2… #CRTO #RedTeam #CyberSecurity #InfoSec @_ZeroPointSec

My CRTO 2026 Exam Experience

Hey Infosec buddies! Mahendra Purbia (Mah3Sec) here 🕷️

mah3sec.medium.com
1
3
29
2,362
We hear “SBOM” everywhere these days. But when a critical vulnerability hits an open source dependency, can your team quickly answer: “Are we using it?” An SBOM can help answer that question. In our first ForgeGuardian security series, we're breaking down what an SBOM actually is, why it matters, where it fits into software supply chain security, and how ForgeGuardian supports it. A practical introduction for anyone working with modern software supply chains. Read the full article below linkedin.com/pulse/sbom-we-a… #SBOM #SoftwareSupplyChain #CyberSecurity #AppSec #DevSecOps #OpenSource #SoftwareSecurity

SBOM: We All Hear About It. But What Does It Actually Tell Us?

We hear “SBOM” everywhere these days. But do we really know what an SBOM is, why it matters, and where it fits into software supply chain security? Let's break it down.

linkedin.com
1
2
106
Mahendra Purbia retweeted
Mahendra Purbia@Mah3SecAug 31
Me and my friend @jaimin2709 started #ForgeGuardian as a weekend experiment around one question: Can we build a practical, open-source defense layer for software supply-chain attacks? 3 months later, we're putting it out in the open. 🚀 🔎 8 detection engines 🌍 9 ecosystems 🛡️ 223+ detection signatures 💻 CLI + Dashboard 🔒 Offline-first New threat → New detection → Shared with the community. Try it. Break it. Tell us what we’re missing. 👉 GitHub: github.com/Mah3Sec/ForgeGuar… 📚 Docs: forgeguardian.dev/docs/ #CyberSecurity #SupplyChainSecurity #AppSec #OpenSource #infosec #supplychain #devops #secdevops #dev
3
6
213
Me and my friend @jaimin2709 started #ForgeGuardian as a weekend experiment around one question: Can we build a practical, open-source defense layer for software supply-chain attacks? 3 months later, we're putting it out in the open. 🚀 🔎 8 detection engines 🌍 9 ecosystems 🛡️ 223+ detection signatures 💻 CLI + Dashboard 🔒 Offline-first New threat → New detection → Shared with the community. Try it. Break it. Tell us what we’re missing. 👉 GitHub: github.com/Mah3Sec/ForgeGuar… 📚 Docs: forgeguardian.dev/docs/ #CyberSecurity #SupplyChainSecurity #AppSec #OpenSource #infosec #supplychain #devops #secdevops #dev
3
6
213
Peak PR wording: "A Mythos-class model that we've made safe for general use." 👀 #Ai #claude
1
99

They Didn’t Hack You. They Hacked What You Trust.

Article · @Mah3Sec
1
130
You don’t need to hack a company anymore. Just compromise something the company already trusts. Dependencies. CI pipelines. Package registries. Update systems. medium.com/@mah3sec/they-did… #infosec #cybersecurity #leadership #secdevops #devops #founders

They Didn’t Hack You. They Hacked What You Trust.

Picture this.

infosecwriteups.com
2
1
197
4 months paying Anthropic and I cracked it: Launch model →genius, basically a hacker's best friend. Nerf Sonnet 4.6. Nerf Opus 4.6. Tell no one. Drop Opus 4.7 →"we fixed everything!" An AMD senior director complained publicly. Anthropic's response was a new model. #Anthropic
1
176
Token consumption is high so pay more for extra usage.
68
🍪 Stole the admin's cookie on @intigriti Challenge 0326 — and wrote up exactly how I did it. XSS → payload craft → cookie theft → flag 🚩 Full writeup 👇 mah3sec.medium.com/how-i-sto… #BugBounty #XSS #CTF #Intigriti #WebSecurity #pentest

How I Stole the Admin’s Cookie — Intigriti challenge-0326

Hey Infosec buddies! Mahendra Purbia (Mah3Sec) here; Intigriti dropped their March 2026 CTF and honestly when I first looked at it I…

mah3sec.medium.com
4
284
"Dojo #49 - Secret manager"? Pwned! It was a blast on @YesWeHack! Think you can take it on? 🌟 dojo-yeswehack.com/challenge… #YesWeHack #ChallengeAccepted

YesWeHack Dojo

Improve your hacking skills with the free CTF training platform by YesWeHack!

dojo-yeswehack.com
1
1
6
287
Noticed a recurring issue on HackerOne: some triage responses feel AI-generated and reference a different vulnerability than what was reported, despite a clear PoC and category. #BugBounty
1
2
469
After mediation the issue is resolved but still i suggest that triage team should read report first and dont depend on AI based summary as. just depending on AI doesn’t help to become a good triage. And i think im not the only one who faced this issue with triage #BugBounty
211
I’ve been facing a serious, recurring safety issue with my @VolkswagenIndia virtus car from the very first day of delivery. Despite multiple complaints and service visits, nothing has been fixed and now it has caused a major highway accident. Sharing everything here 👇
16
34
3
66
4,110
Built a JS secrets hunter for my testing workflow 🔍 Nothing new - just a more structured version of existing JS recon tools: ✅ Auto discovery ✅ 40+ patterns ✅ Multi-threaded ✅ Clean output github.com/Mah3Sec/JSHawk #bugbountytips #infosec #CyberSecurity #PenTest

GitHub - Mah3Sec/JSHawk: JSHawk is a powerful, context-aware JavaScript security scanner that hunts...

JSHawk is a powerful, context-aware JavaScript security scanner that hunts for exposed credentials, API keys, and sensitive information in JavaScript files with surgical precision. - Mah3Sec/JSHawk

github.com
11
34
3,940
Mahendra Purbia retweeted
Pratik Dabhi
@impratikdabhi1 Jun 2025
Read “Unauthenticated Kibana Dashboard Access — A Serious Security Risk You Can’t Ignore“ by Pratik Dabhi on Medium: infosecwriteups.com/unauthen… #bugbounty #infosec #hacking

Unauthenticated Kibana Dashboard Access — A Serious Security Risk You Can’t Ignore

Hello there,

infosecwriteups.com
1
14
54
5,322
Mahendra Purbia retweeted
Jatin@techyfreakk20 Apr 2025
The @Hacker0x01 Hacking Meetup in Udaipur was 🔥Hackers teamed up, hacked on a live target, and shared tons of knowledge! 💻🤝 Virtual week is still on — bring your A-game! 💪 Top hackers will score exclusive swag 🎁 #HackerOne #BugBounty #UdaipurMeetup
7
6
2
97
15,608
Load more