Ghost St Badmus
@commando_skiipz
Followers
8K
Following
43K
Media
1K
Statuses
30K
Just a random guy, tweeting in front of the world. Sr. Application Security Engineer (API, Mobile, Web, Cloud, AI/ML) 💼. Creator (https://t.co/AspazxJI26 & https://t.co/pgYmTW2JVL)
…in your infra
Joined January 2019
I built an intentionally vulnerable banking application for security engineers/interns, developers, & QA analysts to learn, practice secure code reviews, and test their application security knowledge in areas such as SQLi, XSS, CSRF, race conditions, API vulnerabilities, & more.
Where are the hackers/code reviewers? How many vulnerabilities can you spot in this code?.Apart from the hints, are there other places you can exploit? .Can you chain the vulnerabilities?
14
82
314
Omo!!!!!!! You people didn’t tell me Call of Duty is this interesting and insanely addictive. What the fokk?! 🤯🔥.
2
0
2
RT @faechi_: I've been wanting to do things differently so here is to retracing my steps in my Cybersecurity journey. While I wait for the….
0
2
0
Some developers and security engineers in a certain industry won’t be happy I’m sharing this trick. But hey! fix your security implementations and stop relying on security through obscurity. 🫵🏽🙂↔️.
I’ve tested over 30 web apps that encrypt API requests client-side before sending them to the server, and return encrypted responses too. The frontend handles both encryption & decryption. Check those randomly generated JS files, the logic might just be hiding there.
1
3
6
I’ve tested over 30 web apps that encrypt API requests client-side before sending them to the server, and return encrypted responses too. The frontend handles both encryption & decryption. Check those randomly generated JS files, the logic might just be hiding there.
0
2
3
Look around the JS files(especially those with random characters .js), you might just find the secret key, IV and the encryption algorithm and mode.🤭🙂.
2
0
7
RT @_DeejustDee: Don’t miss out on this event next Friday . @commando_skiipz will be live too 💃 . Register using this link . .
0
6
0
I’ll be doing a live hacking demo at The Hackers Secret Conference next week Friday! If you’re around, swing by and let’s break stuff together.
0
1
2
RT @adekunleGOLD: When we start celebrating brilliance the way we celebrate chaos, this country will change.
0
4K
0
RT @zoecyber001: Finally, I checked out Vulnbank💙, created by @commando_skiipz. I logged in first using SQL injection, no signup, proceeded….
0
3
0
If dem sack me for work, just know say na this game cause am😭.
0
0
2
Omo! 2026 too far, I couldn’t wait. 😭🧎🏾♂️
I’m growing impatient for GTA VI, and hopefully, I’ll have gotten a PS5 before it’s released.
12
3
49
RT @hackSultan: Both of them could be struggling, but it’s the woman who’s loving a man at his lowest.
0
2K
0
Sometimes, my idea of a reward after fixing an issue is just standing up to eat or stretch. That’s it. 😭. My babe go dey shake her head if she see these tweets 🤣.
1
0
0
Some days get so complicated and stressful that I end up spending nearly 20 hours in the same spot, just trying to get to the root of an issue. For me, it’s not even about the money, it’s about the peace of mind that comes when everything finally works the way it should.
1
0
11
I spend about 18 hours a day working and 6 hours sleeping, even on weekends sometimes, because I really enjoy what I do. 😅.
2
0
30
Something’s not quite right here….GraphQL API Hacking 😅. Can you spot the vulnerability?
3
1
8
Someone finally exploited the vulnerability I kept hinting at in the virtual cards. Update card limit —> Exploit mass assignment (BOPLA) —> Auto-fund the card. Simple, yet deadly for any fintech company that overlooks it. Big shoutout to @bussyice 🫡👏🏾🔥.
This exploit is inspired by @DamilolaAbiona8's zero balance find, tho I took a slightly different route. I first exploited BOPLA in the update card limit endpoint by adding a "current_balance" parameter to the request and used it to pay a $400 bill. Then things got interesting.
3
6
36