Nullblocks @NullBlocksCEO
Joined May 2026-
Tweets157
-
Followers3
-
Following97
-
Likes0
Ran dig axfr against a handful of domains today. Still wild how many just hand over the whole zone file, no auth needed.
Open redirect filters often just check the URL starts with your domain. Add an @ before it and the browser reads everything after as the real host.
333 of 543 S&P 500 companies (61.3%) serve live HTTPS with zero HSTS header — 10,314 host findings. 323 of those 333 (97.0%) have no HackerOne bounty coverage. Palo Alto Networks (a security vendor) has 118 such hosts, unreported to anyone. nullblocks.com/blog/missing-h…
Pull a target's ASN, then reverse-search every IP block registered under it. Half their real shadow IT never shows up under the main domain.
Ever check /swagger.json or /openapi.yaml on a target before poking endpoints by hand? Half the API surface is often just sitting there, documented.
Open Firebase realtime DBs still let you read the whole JSON tree with default rules -- no auth, just the URL.
Wild how many domains skip CAA records. Without one, literally any public CA can issue a cert for your domain and you'd never know.
Half the CORS configs I check just reflect whatever Origin you send back, credentials allowed. That's not access control, it's an open door.
Reverse WHOIS turned up 840 real sister domains across 25 S&P 500 companies. 19 of those 25 have zero HackerOne bounty coverage anywhere. Workday's myworkday.com alone carries 3 CRITICAL/CVSS-10.0 CVEs with no bounty coverage on file. nullblocks.com/blog
Still finding .DS_Store files in web roots in 2026. macOS quietly writes one to every folder, and it leaks a full directory listing if the server serves it.
Ever notice password reset forms respond differently for real accounts vs fake ones? That gap alone is free account enumeration.
NetScaler auth bypass, CVSS 9.3, no exploits seen yet. With Citrix bugs that gap never lasts long. Patch before the PoC drops.
Found an exposed Kubernetes dashboard with zero auth once. Full cluster control, no login screen in sight.
Startling how many Elasticsearch clusters still ship with zero auth. Curl _search and the whole dataset comes back.
4 exposure classes scanned across the S&P 500. Same pattern every time: Takeover: 23/24 no bounty coverage GraphQL: 22/24 no coverage Wayback legacy: 95/103 no coverage Critical CVEs: 330/341 no coverage Not a one-off stat. Structural. nullblocks.com/blog
JARM fingerprints cluster servers by TLS handshake behavior, not certs or IPs. Two totally unrelated domains sharing a JARM hash usually means same infra.
157 of 543 S&P 500 companies (28.9%) serve live traffic on a host with an expired TLS cert. Dell's b2bsas2.dell.com cert expired 2015-01-27, 4,225 days ago, still answering. 6th independent exposure class, same gap. nullblocks.com/blog/expired-t…
Ever grep a site's JS bundle for a Sentry DSN? Half the time it's just sitting there, public and writable.
Half the leaked AWS keys I see start with someone committing a .env file "just this once." git log -p is forever.
Half the security.txt files I check 404 or list a contact that bounces. Cheapest signal for whether a company takes vuln reports seriously.
JLong @jlongvml
98 Followers 452 Following Architect, Enterprise Solutions Cybersecurity specialist, founder of NullBlocks Systems. Developer of DomRecon
比特欧 EIvni; @blushstar30
6 Followers 1K Following 美股 / 加密数据整理 + 数据可视化 | 自媒体打工人 + 00 后大学生｜梦想是成为 A8 的数字游民｜推特当作自己的炒币日记 ｜交易加密 / 美股用币安：https://t.co/kQKPFqWCbB
Clandestine @akaclandestine
65K Followers 5K Following | Security | Osint | Threat Research | Opsec | Threat Intelligence | Infosec | Threat Hunting | Humint |
TeaJay @apjone
815 Followers 2K Following ~ tweets are my own~ | • [email protected] | • @apjone.bsky.social VibeSecOps Engineer 😂
Masonhck357 @Masonhck3571
17K Followers 842 Following 🔍 Top 70 Bug Bounty Hunter @ Bugcrowd | 🇩🇴 Dominican | Ethical hacking fanatic | 🎮🎵 Lover | Keeping the digital world safe. opinions are that of my own
Md Ismail Šojal �... @0x0SojalSec
56K Followers 6K Following Cyber_Security_Re-searcher || Ai Re-searcher || AI-Sec|| Malware Analysis II iOS || Pwn || 0SINT || Project AI-StrikeSec || 0ldAccounts Suspended @0xSojalSec ||
Jake @JakeKing
2K Followers 2K Following Founder @ minimal. Safe environments for agents. Last : @cmd_security → @elastic. https://t.co/doA9INdYrK
Prashant Bhattarai @g0ndaAr
617 Followers 228 Following Hunting for some Web Bugs😎😎 🇳🇵🇳🇵 https://t.co/Jb6iOhXnTk
Daniel Cuthbert @dcuthbert
34K Followers 2K Following Documentary photographer, old creaky hacker. Co-author of @OWASP ASVS standard. Blackhat/Brucon Review Board & Co_chair UK Gov Cyber Security Advisory Board
Ananda Dhakal @dhakal_ananda
11K Followers 767 Following Vulnerability Researcher @patchstackapp | Brand Ambassador @Hacker0x01 | Blogs: https://t.co/a0aOojdwyl 🇳🇵
0xor0ne @0xor0ne
94K Followers 508 Following Cybersecurity | Reverse Engineering | Vulnerability Research | Embedded & Silicon Security | My Tweets, My Opinions :)
Gergely Orosz @GergelyOrosz
358K Followers 3K Following Writing @Pragmatic_Eng, the #1 software engineering newsletter on Substack. Author of @EngGuidebook. Formerly Uber & Skype.
Daft Punk Fandom🤖�... @Daft_Wub
18K Followers 41 Following Independent Daft Punk Historian, Archivist, & News Source. Consider supporting me on Patreon! Fortnite creator code: DAFT_WUB
Youssef Sammouda (sam... @samm0uda
41K Followers 596 Following Security Researcher/Hacker 1st in Meta bug bounty program for 6 years Opinions are my own and not my employer's.
𝚖𝚎𝚛𝚝 🦧 @mertistaken
8K Followers 604 Following hacker / bug bounty hunter / worldwide #1 on critical-high submissions https://t.co/djEccIleby
Kuba Gretzky @mrgretzky
17K Followers 781 Following Creator of Evilginx - Reverse Proxy Phishing Framework for Red Teams: https://t.co/hPg644CTnM
YesWeHack ⠵ @yeswehack
43K Followers 3K Following Offensive Security & Exposure Management Platform 🎯 https://t.co/57gODBq2WZ 👾 https://t.co/ICc6RyhJTp 💡 https://t.co/KNYxhkKuzt
Hac @Hac10101
6K Followers 821 Following 🇮🇳 Hacker| CTF With Team:- @5h4d0wbr0k3r5 | Views are my own and do not represent those of my employers.
Trevor Paglen @trevorpaglen
16K Followers 1K Following I'm an artist. Satellites, Deep-Time, Seeing Machines, Infrastructure, etc..
Ryan M. Montgomery @0dayCTF
130K Followers 630 Following Pentester / Serial Entrepreneur / Child Safety Warrior
DuckDuckGo @DuckDuckGo
2.6M Followers 4 Following Independent online privacy company with browser, search engine, and optional AI.
publiclyDisclosed @disclosedh1
69K Followers 2 Following This is an unofficial HackerOne public disclosure watcher who keeps you up to date about the recently disclosed bugs. By @NOBBD
Inti De Ceukelaire @securinti
29K Followers 374 Following Hacker | @intidc (Dutch) | Chief Hacker Officer @intigriti
Bug Bounty Reports Ex... @gregxsunday
56K Followers 618 Following Grzegorz Niedziela - a hacker who documents his hacking journey by creating and curating the best content about bug bounty and offensive security.
Nagli @galnagli
48K Followers 515 Following hacker; head of offensive ai @wiz_io, now at @google; post-training, gemini cyber & agentic pentesting; $3,000,000 bug bounty hunter; arsenal
James Kettle @albinowax
85K Followers 106 Following Director of Research at @PortSwigger aka @Burp_Suite. Find my research, tools & contact details at https://t.co/vP6UbGmvl3
Yassine Aboukir 🐐 @Yassineaboukir
33K Followers 421 Following HackerOne Top 40, Elite, Pentest Lead, Ambassador, x2 MVH Title, $1 million bounties and ex- Hacker Advisory Board • Digital Nomad/Hybrid Athlete/Surfer
vx-underground @vxunderground
449K Followers 381 Following The largest collection of malware source code, samples, and papers on the internet. Password: infected
ProjectDiscovery @pdiscoveryio
44K Followers 144 Following Real, exploitable vulnerabilities. No noise. Nuclei scans fast. Neo closes the loop. @pdnuclei × @neo_ai_engineer
Brandon Rossi @0xConda
18K Followers 2K Following Healthcare Security Leader | Pentester & Security Researcher | OSCP • CRTP • OSEP
InfoSec Community @InfoSecComm
57K Followers 634 Following Largest InfoSec publication with 80,000+ followers and 3M+ monthly views.
Donald J. Trump @realDonaldTrump
111.9M Followers 53 Following 45th & 47th President of the United States of America🇺🇸
.CitiZen. @CitiZenSleuthX
8K Followers 17 Following Teddy / GameShire Bathaway / GameStop / XRP / DK-Butterfly 🐸🧸🦋
XSS Payloads @XssPayloads
56K Followers 0 Following
Justin Gardner @Rhynorater
38K Followers 2K Following Christian | Full-time Bug Bounty Hunter | Host of @ctbbpodcast | Advisor @CaidoIO | 4x LHE MVH | 🗣️ English, 日本語 | ♥️ @mariahchan_ ♥️
payloadartist @payloadartist
46K Followers 291 Following I discuss AI, Cybersecurity & Hacking • Helped secure organizations like Google • Opinions are my cat's • Part-time shitposter
Abhishek @aacle_
49K Followers 292 Following Building @Vulncure ⚡| Helping founders fix vulnerabilities before hackers find them. Talk to me about: Bug Bounties, LLM Security & React.
shubs @infosec_au
60K Followers 2K Following Co-founder, security researcher. Building an attack surface management platform, @assetnote
🇷🇴 cristi @CristiVlad25
56K Followers 702 Following
Aditya @ADITYASHENDE17
63K Followers 422 Following MS Cyber 🇬🇧 | Work @BforeAI | @Bugcrowd Top 100 | Solo Bug Bounty Hunter/Trainer | Professional Biker | @kong_sec 🇮🇳 | Own Views ≠ Employment |
Sam Curry @samwcyo
102K Followers 1K Following
Pliny the Liberator �... @elder_plinius
242K Followers 1K Following ⊰•-•⦑ latent space steward ❦ prompt incanter 𓃹 hacker of matrices ⊞ breaker of markov chains ☣︎ ai danger researcher ⚔︎ bt6 ⚕︎ lysios ⦒•-•⊱
Diego @DiegoJH2325
9 Followers 96 FollowingTrends for United States
You might like
