nikhil(niks)
@niksthehacker
Followers
10K
Following
9K
Media
223
Statuses
4K
Founder @BSidesAhmedabad | Speaker @Blackhatmea @defcon | Board of Advisor @riskprofilerio | Legend @synackredteam
Joined April 2013
A penetration tester got root access to our Kubernetes cluster in 15 minutes. Here's what they exploited. The attack chain: - Found exposed Kubernetes dashboard (our bad) - Dashboard had view-only service account (we thought this was safe) - Service account could list secrets
71
353
3K
The security vulnerability we found in Perplexity’s Comet browser this summer is not an isolated issue. Indirect prompt injections are a systemic problem facing Comet and other AI-powered browsers. Today we’re publishing details on more security vulnerabilities we uncovered.
389
3K
18K
We just launched a $4.5m bug bounty live hacking event competition targeting the most popular cloud & ai open source software 🧵
5
17
223
The watchTowr Labs team is back, providing our full analysis of the Oracle E-Business Suite Pre-Auth RCE exploit chain (CVE-2025-61882). Enjoy with us (or cry, your choice..) https://t.co/ffDKb723N6
labs.watchtowr.com
We bet you thought you’d be allowed to sit there, breathe, and savour the few moments of peace you’d earned after a painful week in cyber security. Obviously, you were horribly wrong, and you need to...
5
137
384
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog:
dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise...
143
908
3K
The @ReconVillage at @DEFCON 33 explored the digital terrain with Live Recon, GE(O)SINT, CTFs & labs. 🗺️ 🔍 Shoutout to @NahamSec @Jhaddix @DanielMiessler @InfosecVandana @niksthehacker @jeff_foley @anantshri & others! All #DEFCON33 villages 👇🏽 https://t.co/sxs3HBhtKV
#InfoSec
1
4
10
Had an amazing time at my first #BSidesAhmedabad 🎉 Great discussions, diverse connections & of course the mandatory MSRC team pic + group selfies 📸
0
3
61
No doubt, the fieriest panel of all🔥🔥
I will be at @bsidesahmedabad this year to talk about bug bounty and security with John Deere CISO Carl Kubalsky on 12th and 13th in an open Panel. If you are around please come say high :)
0
0
9
When the hunters of threats join the battlefield, you know the game changes. ⚔️🛡️ We’re beyond thrilled to announce @CrowdStrike as the Cyber Security Partner at BSides Ahmedabad 0x06 — bringing the power of Falcon intelligence to the most awaited cyber security gathering of the
0
20
30
🇮🇳 Independence = Incredible Savings! This Independence Day, BSides Ahmedabad is celebrating with you! Grab your passes now and enjoy a patriotic 15% discount because liberty deserves a great learning party!🎉 Use coupon code “FREEDOM” & get 15% Off on Delegate & Professional
0
17
24
🟥🟦 CTF teams, take note — Standoff Cyberbattle 16, October 6–8, online. 💰 $17,500 prize pool. 30 hours of pure Attack–Defence. 1500+ real-world systems, PLC/SCADA included, 30 hours of epic battle. Apply by Sept 1 → https://t.co/lhYy3XiO2s
1
12
44
The @SLCyberSec research team is releasing our final research post for our Christmas in July efforts, two RCEs and one XXE (all pre-auth) in Adobe Experience Manager Forms. One of the RCEs and the XXE still do not have official patches:
slcyber.io
Vulnerabilities in AEM Forms The Searchlight Cyber Research Team discovered and disclosed three critical vulnerabilities in Adobe Experience Manager Forms to Adobe in late April 2025. As of writing...
6
64
228
🚨 Only 45 Days to Go! 🚨 BSides Ahmedabad 0x06 is almost here! 🎟️ Grab your pass NOW to witness the finest in cybersecurity — where cyber brilliance meets real-world defense➡️🔗 https://t.co/ZSYqohYSMI Don’t just hear about it — be there. #BSidesAhmedabad #CyberSecurity
1
13
18
I have launched YSoNet ( https://t.co/9BofGcFaWh) and added #SharePoint CVE-2025-49704 payload generator to it as the first thing. Here is how this can work: Running command: ``` ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 1 -c "calc" ``` Running C# code: ``` ysonet.exe
github.com
Deserialization payload generator for a variety of .NET formatters - irsdl/ysonet
4
125
475
Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. https://t.co/gT0aoKXkig
#SharePoint #ToolShell
10
84
247
What’s better than hacking? Knowing why it works. 🧠💥 That’s why @redteamacademy is teaming up with BSides Ahmedabad 0x6 as our official Knowledge Partner! They’re not just here to drop info—they’re here to build the next wave of cyber warriors with raw, hands-on red teaming
0
15
18