@KERRO__

OffSec CTF (REV/PWN) @the3000org

 Tunisia
pwn-diaries.com/
Joined September 2018
  • Tweets84
  • Following596
  • Followers252
KERRO retweeted
xyzeva@xyz3va18 Dec 2025
how to hack discord, vercel and more with one easy trick kibty.town/blog/mintlify/
167
328
114
4,856
2,367,246
KERRO retweeted
adam
@theCTO6 Dec 2025
the person who discovered the #react2shell vulnerability should get paid $1m
20
40
8
1,137
119,734
KERRO retweeted
0b1d1@_0b1d16 Nov 2025
CloudRip Fast Cloudflare bypass scanner Find real server IPs behind Cloudflare by scanning subdomains. Multi-threaded for speed, skips Cloudflare-owned IPs, supports custom or built-in wordlists, and exports results. Built-in rate limiting to avoid getting blocked REPO ⤵️
7
129
4
684
33,923
I have seen lot of stupid things lately concerning CS, EDR's and Windows drivers. I wrote a, not so bad I guess, long blog post explaining how to build a windows driver, why EDR's need them, and how EDR's work, might be helpful 🤪 blog.whiteflag.io/blog/from-…

From Windows drivers to a almost fully working EDR

In this article we will see how Windows drivers work, how to create one and, in the end, we will develope a custom EDR that will rely on kernel callback functions, static analysis and API hooking.

blog.whiteflag.io
5
150
5
480
35,729
And we're live! dorkme.com/ Google ✅ Bing ✅ Baidy ✅ DuckDuckGo ✅ Yahoo/AOL ✅ CLI Tool ✅ Take your dorking to the next level, all feedbacks are appreciated! <3 #bugbounty #infosec #dork #dorking #seo #automation
7
60
1
287
31,190
BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution google.github.io/security-re…

BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

google.github.io
22
60
5,036
Remote Code Execution - Insecure Deserialization in a Helpdesk application CVE-2023-50978
1
1
1
11
1,126
You can now discover subdomains with HackerGPT.
18
78
5
643
77,656
KERRO retweeted
Saif@wr3nchsr25 Nov 2023
I published a new blog post about how I chained two vulnerabilities I found in Huawei NetEngine AR617VW to achieve post-auth RCE wr3nchsr.github.io/huawei-ne…

Huawei NetEngine AR617VW Authenticated Root RaCE

The journey of finding two post-authentication vulnerabilities (CVE-2022-48615, CVE-2022-48616) in Huawei NetEngine AR617VW and chaining them to achieve RCE as root.

wr3nchsr.github.io
7
3
51
9,638
KERRO retweeted
raptor@0xdea25 Nov 2023
Your printer is not your printer ! - Hacking Printers at Pwn2Own by @d3vc0r3 devco.re/blog/2023/10/05/you… devco.re/blog/2023/11/06/you… infosec.exchange/@raptor/111…

Your printer is not your printer ! - Hacking Printers at Pwn2Own Part I | DEVCORE 戴夫寇爾

In 2021, we found Pre-auth RCE vulnerabilities(CVE-2022-24673 and CVE-2022-3942) in Canon and HP printers, and vulnerability(CVE-2021-44734) in Lexmark. We used these vulnerabilities to exploit Canon...

devco.re
14
49
8,189
We stand with Gaza
2,702
19,235
629
114,167
5,525,390
KERRO retweeted
mav
@MavLevin1 May 2020
Per popular demand, here are my 30 reversing tips all together in one blog post 🤩 blog.vastart.dev/2020/04/guy…

Mav's 30 Reverse Engineering Tips & Tricks

During April I challenged myself to tweet 1 reverse engineering tip every day. For your viewing pleasure, here I aggregated all 30 tips.Be sure to follow me ...

mavlevin.com
12
262
11
632
new ctf tactic for pwners: a flexible arbitrary write -> rce primitive that doesn't rely on the linker, io objects, or malloc. it's in how your program chooses between SSE or AVX when doing a memcpy! hackmd.io/@pepsipu/SyqPbk94a

setcontext32 - HackMD

Once you’ve obtained an arbitrary write primitive, converting it into RCE tends to be a messy process: house this, house that, edge case this, edge case that. I’d just like to specify the function I...

hackmd.io
2
50
1
197
20,274
Like many others, I'm very excited for #37C3. It does however seem like there will be no #CTF this time. We did some brainstorming in the CTF Discord and came up with the idea of a "CCC Potluck CTF". Please read about it and potentially contribute: forms.gle/FaPGE492s9rPzCGQ6

37C3 Potluck CTF - Interest form

We are all very happy that CCC is making a return. However, as it currently stands, it seems that there will be no CCC CTF. After some brainstorming in the CTF Discord we came up with the idea of a...

docs.google.com
1
13
44
19,036
Replying to @Farenain @yates82 @vector35
api is amazing, lifting new arch is sooo simple with binary ninja. I'm currently lifting vm based obfuscation, following @samrussellnz amazing blog series lodsb.com/lifting-vm-based-o…

Lifting VM based obfuscators in Binary Ninja

Carrying on from the previous article, we can take the first of the tigress challenges and finesse it so the VM parser shows up nicely as a big switch/case statement and we can unpick what all the VM...

lodsb.com
1
8
49
3,047
Replying to @RahmatQurishi @zseano
Google has a built in Open Redirect you can chain: https://google[.]com/amp/s/poc.rhynorater.com
6
54
2
242
40,945
Route to Bugs: Analyzing the Security of BGP Message Parsing i.blackhat.com/BH-US-23/Pres… [PDF]
2
35
2
79
13,697
Bypassing vtable Check in glibc File Structures: blog.kylebot.net/2022/10/22/…

[angry-FSROP] Bypassing vtable Check in glibc File Structures

IntroductionThe story began with a student, @Ramen, asking me about the status of file structure attacks nowadays two days ago. He told me there were no public attacks that grant PC-control solely fro

blog.kylebot.net
5
14
1,346
Load more