Matan Berson (@MtnBer) header
Matan Berson (@MtnBer) profile picture

Matan Berson

@MtnBer

Hacker and bug bounty hunter mostly focusing on client-side security. h1-702 Vigilante, h1-65 Eliminator, AWC23 Best New Hacker

matanber.com
Joined May 2020
  • Tweets253
  • Following267
  • Followers4K
12Media
Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)Photo by Matan Berson (@MtnBer)
Just released my blog post "Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs"! It's about a very impactful and technically interesting client-side bug I found in a major NFT site. matanber.com/blog/4-char-cst…
Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs

Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs

A story about an incredibly impactful XSS vulnerability I found using a client side template injection which was limited to 4 characters.

matanber.com
17
66
4
393
40,424
In a shameless effort to promote my book. I've crafted some very special vectors for you. If you like them please purchase my book to read more. amazon.com/dp/B0BRD9B3GS
https://www.amazon.com/dp/B0BRD9B3GS

ALT https://www.amazon.com/dp/B0BRD9B3GS

11
44
4
273
49,483
This is genius
Kévin GERVOT (Mizu) (@kevin_mizu) profile pictureKévin GERVOT (Mizu)@kevin_mizu25 Aug 2025
I've released a DOMLogger++ config that helps detect any replacements occurring in a DOMPurify output by inserting and tracking a canary value at runtime. I think it highlights how useful DOMLogger++ can be for tracking JS execution :D 👉 github.com/kevin-mizu/domlog… 1/3
Image from Kévin GERVOT (Mizu) (@kevin_mizu)
1
2
32
4,143
Matan Berson retweeted
zere (@j_zere) profile picture
zere
@j_zere18 Aug 2025
Just published my first blog post "Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover" You can read the full write-up here: zere.es/posts/cache-deceptio…
Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover

Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover

Recently, while auditing the main application of a private bug bounty program, I discovered a Client-Side Path Traversal (CSPT) and a Cache Deception vulnerability. Individually, these issues were...

zere.es
27
140
3
590
51,604
Matan Berson retweeted
sudi (@sudhanshur705) profile picture
sudi@sudhanshur70531 Jul 2025
Last year I found a XSS bug in Google IDX here's a detail writeup about it. Hope you will enjoy it's kinda lengthy :p Shoutouts to @MtnBer for finding the original bug in Gitlab and @kl_sree @sivaneshashok for the required chains to complete the exploit. sudistark.github.io/2025/07/…
XSS in Google IDX Workstation

XSS in Google IDX Workstation

Technical breakdown of an XSS vulnerability in Google IDX Workstation.

sudistark.github.io
13
86
1
369
26,000
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com/ 1/4
Image from Kévin GERVOT (Mizu) (@kevin_mizu)
12
172
3
456
43,590
Matan Berson retweeted
Jorian (@J0R1AN) profile picture
Jorian
@J0R1AN30 Jun 2025
Just found an interesting way to bypass some nonce-based CSPs and made a small XSS challenge with an exploitable scenario. See if you can find it before I tell! Source JS: gist.github.com/JorianWoltje… URL: greeting-chall.jorianwoltjer… Found a solution? Please DM to avoid spoilers, thanks!
Image from Jorian (@J0R1AN)
3
25
3
152
16,667
Matan Berson retweeted
Yaniv Nizry (@YNizry) profile picture
Yaniv Nizry@YNizry1 Jul 2025
[2/2] Meaning that if you have a file write and can't control the extension and the extension doesn't correlate to any Content-Type (let's say .abc), you can add .html to the file name (filename.html.abc) and httpd will serve it as text/html
1
1
10
1,456
The vector: <svg><title><![CDATA[--></title><img src onerror=alert(1)>]]>
3
16
2,619
I’m in a pwnfunction video! Check it out, it’s very well made and the vulnerability chain is quite unique youtube.com/watch?v=RLyhPGsE…
3
22
2
172
13,853
Matan Berson retweeted
Pwn (@PwnFunction) profile picture
Pwn
@PwnFunction3 Jun 2025
New video! XSS like you’ve never seen before youtube.com/watch?v=RLyhPGsE… Huge thanks to @MtnBer
XSS like you've never seen.

XSS like you've never seen.

In this video, I break down an insane Chrome exploit discovered by ...

youtube.com
5
52
229
31,858
Matan Berson retweeted
Jorian (@J0R1AN) profile picture
Jorian
@J0R1AN17 May 2025
The legendary @joaxcar made a really interesting XSS challenge this month for Intigriti. My solution involved winning a race condition with 100 <iframe>s to utilize a DOM Clobbering gadget after bypassing a RegEx. Check out the writeup below: jorianwoltjer.com/blog/p/hac…
Intigriti May XSS Challenge (0525) | Jorian Woltjer

Intigriti May XSS Challenge (0525) | Jorian Woltjer

A challenge by @joaxcar with a small but complex XSS chain, hitting DOM Clobbering with a race condition and abusing a cool URL parsing quirk in JavaScript.

jorianwoltjer.com
1
28
1
164
8,345
Matan Berson retweeted
Gal Weizman (@WeizmanGal) profile picture
Gal Weizman@WeizmanGal12 Mar 2025
Got back last week from Tokyo🇯🇵 where I caught @renbou & @Slonser's talk with @kumavis_ Being part of the web/browser/JavaScript security niche from the perspective of crypto wallets specifically, felt like a talk to not miss Here's what I learned 🧵 xitter.cf/neploxaudit/status/189…
Image from Gal Weizman (@WeizmanGal)
Neplox (@neploxaudit) profile pictureNeplox
@neploxaudit2 Mar 2025
Replying to @neploxaudit
Thank you to everyone who came to see the first iteration of our talk IRL @secconctf ❤️ And we'd like to express additional gratitude to @WeizmanGal and @kumavis_ of @MetaMask for going out of their way to visit our talk and show how much they care for security.
3
9
1
32
6,126
I freaking love the Critical Thinkers discord 😂 @MtnBer @xssdoctor FEAT: Balint&Demo
Image from Justin Gardner (@Rhynorater)
1
2
58
5,152
Matan Berson retweeted
Sam Curry (@samwcyo) profile picture
Sam Curry
@samwcyo23 Jan 2025
New blog post with @infosec_au: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. The issue was reported and patched. Full post here: samcurry.net/hacking-subaru
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United...

samcurry.net
47
312
18
1,015
118,909
Matan Berson retweeted
slonser (@slonser_) profile picture
slonser@slonser_17 Jan 2025
In 2024, I interacted a lot with Extensions. I decided to create a resource that will help with a basic understanding of extensions and key attacks. P.S. I tried to make everything as clear as possible and hope it won’t feel too overwhelming anywhere. extensions.neplox.security/

Introduction | Chrome Extension Security

Welcome to our site dedicated to creating a comprehensive knowledge base on the security of Chromium extensions.

extensions.neplox.security
21
107
1
418
40,744
I’m very excited to be part of the team! I can’t wait to collaborate with all of these amazing hackers and learn from them
Image from Matan Berson (@MtnBer)
Critical Thinking - Bug Bounty Podcast (@ctbbpodcast) profile pictureCritical Thinking - Bug Bounty Podcast
@ctbbpodcast3 Jan 2025
The moments when I'm most proud of CTBB Podcast are the moments when we're discussing original, HQ research on the pod. So, that's why we're starting the Critical Research Lab with this tremendously talented group of researchers:
Image from Critical Thinking - Bug Bounty Podcast (@ctbbpodcast)
5
2
110
7,818
The character that broke Safari's cookies (with @mtnBer)
2
56
4,367
.@CyberNews did a short documentary on bug bounties and it’s 🔥!! youtu.be/Vtj-RHEQn8M?si=9Drz…
3
35
1
226
15,215
Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website worst.fit/ for early access and the slides! Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈‍
15
220
32
776
173,088
We made it, y'all! 100 Episodes. We put together a banger for y'all to celebrate: 8 crazy bugs from top hackers giveaways sad announcement from @0xteknogeek Shift - Caido AI announcement It has been a great ride - cheers to many more episodes! youtu.be/ANYtLQrT-F0
2
15
3
118
7,156
Load more