Just released the UPI Recon CLI. Try here : https://github.com/LuD1161/upi-recon-cli

A tool for #OSINT using virtual payment address(VPA). Leveraging the UPI platform to find usernames.

Download & run 🚀

It's a #golang port of https://github.com/qurbat/upi-recon/ by the awesome @squeal 

#upi #opensource 

1. UPI ID and name associated with a mobile number


2. UPI ID and name associated with a gmail account


3. UPI ID and name associated with a vehicle registration number. Leveraging UPI id associated with a FASTag.


Download and start hacking from here : https://github.com/LuD1161/upi-recon-cli/releases

Let me know your feedback on this 😃🙌
Send a PR or issue for anything you'd want to be added into it.


You can read the unrolled version of this thread here: https://typefully.com/AseemShrey/xTwm42j

UPI Recon CLI

𝗘𝘃𝗲𝗿 𝘄𝗼𝗻𝗱𝗲𝗿 𝗵𝗼𝘄 companies like Rippling, Amazon, or Meta build secure products at scale?

𝘔𝘰𝘴𝘵 𝘵𝘦𝘢𝘮𝘴 𝘸𝘢𝘪𝘵 𝘧𝘰𝘳 𝘣𝘳𝘦𝘢𝘤𝘩𝘦𝘴.
But the smart ones? They start with 𝗍𝗁𝗋𝖾𝖺𝗍 𝗆𝗈𝖽𝖾𝗅𝗂𝗇𝗀 🧵

When I was at @Rippling, this mindset was baked into how we built; not as a checklist, but as part of the design process.

No red tape. No audits. Just clarity. 

Want to do it without fancy tools? 👇 

Here’s how to threat model manually - something anyone can do, even on a napkin.

✍️ 𝟭. 𝗠𝗮𝗽 𝘁𝗵𝗲 𝗦𝘆𝘀𝘁𝗲𝗺
• Sketch components: APIs, services, databases, auth flows
• Include external tools
• Define 𝗍𝗋𝗎𝗌𝗍 𝖻𝗈𝗎𝗇𝖽𝖺𝗋𝗂𝖾𝗌 (e.g. frontend ↔ backend, internal ↔ external)

🔍 𝟮. 𝗔𝘀𝗸 𝗞𝗲𝘆 𝗤𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀

Use STRIDE or just ask:
• What are we protecting?
• What could go wrong?
• Who might attack it?
• How might they succeed?
• What happens if they do?

⚠️ 𝟯. 𝗦𝗽𝗼𝘁 𝗧𝗵𝗿𝗲𝗮𝘁𝘀

• Focus on inputs (login, uploads, APIs)
• Think like an attacker: weak links, exposed configs
• Don’t forget the quiet spots — audit logs, internal tools

✅ 𝟰. 𝗠𝗶𝘁𝗶𝗴𝗮𝘁𝗲 + 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁

• Add controls: input validation, auth, rate limiting
• Track risks like bugs; not in someone’s head or buried in docs
• Review it often

That’s manual threat modeling: simple, powerful, timeless.

But what if you want to scale this across a fast-moving team?

I use 𝐇𝐚𝐜𝐤𝐞𝐫𝐒𝐜𝐨𝐩𝐞 for that.

It lets you:
• Visually map threats
• Collaborate across eng/product/security
• Auto-track risks
• Turn gaps into clear ToDos

https://hackerscope.shipsec.ai

It’s like having a 𝗹𝗶𝘃𝗶𝗻𝗴 𝘁𝗵𝗿𝗲𝗮𝘁 𝗺𝗼𝗱𝗲𝗹 inside your workflow.

Security shouldn’t feel like homework.
It should feel like great design.

#ThreatModeling #Cybersecurity #HackerScope #AppSec #StartupSecurity #ProductSecurity #EngineeringExcellence

Building Secure Products at Scale

Just released the UPI Recon CLI. Try here : https://github.com/LuD1161/upi-recon-cli

A tool for #OSINT using virtual payment address(VPA). Leveraging the UPI platform to find usernames.

Download & run 🚀

It's a #golang port of https://github.com/qurbat/upi-recon/ by the awesome @squeals

#upi #opensource 

You can read the unrolled version of this thread here: https://typefully.com/AseemShrey/cpeNJX2

UPI Recon CLI Tool

Just released the #golang version of UPI Recon CLI. Try here : https://github.com/LuD1161/upi-recon-cli

A command line tool for reconnaissance using virtual payment address (VPA). This leverages the openness available with the UPI platform to find.

Download & run 🚀

#upi #opensource #OSINT

Download and start hacking from here : https://github.com/LuD1161/upi-recon-cli/releases

Let me know your feedback on this 😃🙌
Send a PR or issue for anything you'd want to be added into it.

You can read the unrolled version of this thread here: https://typefully.com/AseemShrey/6zSnbHm

A 3 step process to finding and reporting critical secrets :

🧵👇

1️⃣ Find secrets :

➡ Look into source control like Github, gitlab etc

Use github dorks for more directed searches. Like https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt

➡ Search for secrets in commit history and full organisation by trufflehog : https://github.com/trufflesecurity/trufflehog

➡ Try finding sonarqube or Jenkins instances. Use #shodan for that. Check my previous thread for some ideas around it 😃 : https://twitter.com/AseemShrey/status/1508059759491964928

Here's how I found one : https://aseem-shrey.medium.com/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85

➡ Look into website's javascript files. Here's a writeup around the same : https://infosecwriteups.com/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3

2️⃣ Verify those secrets :

➡ After you've found some secrets it's time to verify those. For each individual key look here : https://github.com/streaak/keyhacks

You can use the latest trufflehog v3 to automatically verify for over 600 types of secrets as well 😃

3️⃣ Report 💰

➡ Find the company's program on #hackerone or #bugcrowd or their own bug bounty page.

➡ If nothing like that exists, use connectbit to find contacts

➡ If even that doesn't help, check people on Linkedin or Twitter for that org

🅱🅾🅽🆄🆂

Here's a video of how to automatically find and verify secrets on github, s3 buckets etc using trufflehog v3 + an interview with the creator @InsecureNature 

Go on and check the video here : https://www.youtube.com/watch?v=iqC-hEd3hkE  📹 🚀

You can read the unrolled version of this thread here: https://typefully.com/AseemShrey/s7zla3t

Finding and exploiting secrets

1️⃣ Search for secret API keys publicly exposed on websites :
ex : Searching for slack API token on all the scanned websites 

http.html:"xoxb-"

2️⃣ Search using 'favicon' hash :
- One of the most accurate way of finding services

ex- Find all jenkins server : http.favicon.hash:81586312

A list of favicon hashes : https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv

https://www.shodan.io/search?query=http.favicon.hash%3A81586312


3️⃣ Search using website's title :

ex - Find all grafana dashboards

http.title:"Grafana"

4️⃣ Search services vulnerable to a particular CVE :

ex - Search all machines vulnerable to 'eternal blue'. vuln:ms17-010

or 

Search a particular CVE :
ex - Services that are vulnerable to Heartbleed
vuln:CVE-2014-0160

Note:This is only available to users of higher API plan

5️⃣ Search for a particular port + service :

ex - SSH on port 22 or 3333 
ssh port:22,3333
or 
proftpd port:21

You can use this to find services on non-standard port. 

Like : ssh -port:22

ssh which is not on port 22

6️⃣ Search for a particular OS :

e.g. Checking for vulnerable win 10 home version

os:"Windows 10 Home 19041"