sw33tLie (@sw33tLie) / X

sw33tLie

2,403 posts

sw33tLie

@sw33tLie

Web application hacker, 25yo. Top 30 @ bugcrowd.com/h/sw33tLie hackerone.com/sw33tlie linkedin.com/in/paolo-arnol…

Lisbon - From 🇮🇹

Joined February 2019

Pinned
sw33tLie
@sw33tLie
Mar 23
I wanted a screenshot tool for macOS better than anything out there, so I built one with @claudeai Native Swift. No Electron. Annotate, record screen, scroll capture, auto-redact PII, beautify, upload to Drive & more — one flow. Free & open source forever. macshot 🔗👇
00:00
29K
sw33tLie
@sw33tLie
Jun 23, 2020
Burp Suite > Proxy > Options > TLS Pass Through. Add these: .*\.google\.com .*\.gstatic\.com .*\.mozilla\.com .*\.googleapis\.com .*\.pki\.goog No more noise in your logs! #bugbountytips
sw33tLie
@sw33tLie
Dec 1, 2022
I'm not writing a report ever again #bugbounty #pentesting #infosec #OpenAIChat
sw33tLie
@sw33tLie
Feb 26, 2025
Here's how I used @grok AI to "hack" @levelsio's fly.pieter.com — why it's not really a hack, and one thing Pieter can improve! :)
144K
sw33tLie
@sw33tLie
Jun 25, 2020
org:YOUR_TARGET http.favicon.hash:116323821 Use this query on Shodan to find Spring Boot servers. Then check for exposed actuators. If /env is available you can probably achieve RCE. If /heapdump is accessible you may find private keys and tokens. #bugbountytips
sw33tLie
@sw33tLie
Mar 10, 2025
Let's disclose everyone's IP addresses and brag about it. What could go wrong :D fly.pieter.com/fly_server.log #bugbounty
@levelsio
@levelsio
Mar 10, 2025
Oops, fly_server.log wasn't being flushed so the log file became 16 GB and the server disk was 100% full :D Which made the game a bit slow, but still worked Fixed now!
523K
sw33tLie
@sw33tLie
May 20, 2025
I've recently put more work into my ffuf fork, uff, and I think every ffuf user should at least give it a try - and maybe even switch to it. Here's why, in a #bugbounty 🧵
56K
sw33tLie
@sw33tLie
Oct 2, 2020
So I made this tool to get all the scope from your @Bugcrowd programs, including private ones! Grep things easily, such as *. domains! #bugbounty #bugbountytips github.com/sw33tLie/bcsco…
sw33tLie
@sw33tLie
Jun 29, 2024
Just updated my ffuf fork so now it supports the following things: - Absolute URI fuzzing - Invalid HTTP method - No header canonization - Invalid URL encoding chars - Invalid HTTP header, headers starting with space etc #bugbounty github.com/sw33tLie/uff
23K
sw33tLie
@sw33tLie
Nov 21, 2023
Ever asked ChatGPT #bugbounty or security questions only to get annoying answers such as "I can't do that, it's illegal!"? I made a custom GPT that should give you any PoC without annoying filters: chat.openai.com/g/g-y2KnRe0w4-…
47K
sw33tLie
@sw33tLie
Jul 17, 2024
This is one of the most widespread and impactful bugs I've ever found in my career. Great collab with @bsysop and @_medusa_1_ Smugglings are still out there—stay vigilant! #bugbounty @Bugcrowd bugcrowd.com/blog/unveiling…
48K
sw33tLie
@sw33tLie
Jul 7, 2025
Many don’t realize they already have a powerful, fully autonomous, free hackbot on their computer. If you’re using Cursor, you’ve got it. Here's Cursor solving a @PortSwigger webacademy SQL injection lab! #bugbounty
00:00
31K
sw33tLie
@sw33tLie
Dec 4, 2020
I've just released bbscope, a Go tool to get your scope from bug bounty platforms, including private programs. Currently @Hacker0x01, @Bugcrowd, and @intigriti are supported. #bugbounty #bugbountytips github.com/sw33tLie/bbsco…
sw33tLie
@sw33tLie
Oct 3, 2024
Replying to @santi_lopezz99
I agree!
10K