@YNizry

Security researcher

Joined December 2020
  • Tweets52
  • Following146
  • Followers1.8K
3Media
Are your data science tools safe? 🕵️‍♂️ We discovered vulnerabilities in JupyterLab Desktop and the JetBrains Jupyter plugin that can lead to code execution with minimal user interaction. Read the technical details here: sonarsource.com/blog/hidden-… #appsec #security #vulnerability
6
16
2,026
Can you trust the trust dialog? We discovered that running Claude Code in malicious folders could have executed system commands before the trust dialog even appears! Learn about the details in our latest blog post: sonarsource.com/blog/claude-… #appsec #security #vulnerability
1
2
1
6
1,365
Just published two new vulnerability write-ups: 💻FortiClient – Two-click RCE via code injection in the login window yaniv-git.github.io/2025/10/… ⚠️FortiGuard – “Access Blocked” page XSS yaniv-git.github.io/2025/10/…
2
6
482
TROOPERS talks are now live on YouTube! Curious how attackers can turn endpoint protection into an entry point? In my session, I break down exactly how these compromises happen - step by step. 🎥 Watch here: youtube.com/watch?v=sfjxjWsy…
2
6
1,565
🔄📦 GitHub Actions offer powerful automation capabilities for CI/CD, but they're not immune to attacks. Take a look at how we tackle this risk with SonarQube Cloud by diving into real-world vulnerabilities. sonarsource.com/blog/securin… #appsec #security #vulnerability
6
11
1,873
🗒️✍️Taking a note on security: our latest blog post focuses on Go vulnerabilities, including Arbitrary File Write, XSS, and Misconfiguration. Showcasing our new support for the language in SonarQube Cloud! sonarsource.com/blog/securin… #appsec #security #vulnerability
1
9
35
3,574
🔓⏫ After compromising every endpoint within an organization, our “Caught in the FortiNet” series comes to an end with one more thing. Read more about FortiClient's XPC mistake that allows local privilege escalation to root on macOS sonarsource.com/blog/caught-… #appsec #security
6
19
2,468
[1/2] TL;DR: mod_mime, Apache httpd module that is responsible for assigning Content-Type, supports "Files with Multiple Extensions". #bugbountytips
Sonar Research
@Sonar_Research1 Jul 2025
📁🫷🚧Can't control the extension of a file upload, but you want an XSS? Read more on how we overcame this obstacle to further exploit entire organizations using Fortinet endpoint protection: sonarsource.com/blog/caught-… #appsec #vulnerability #bugbountytips
1
2
2
24
2,965
[2/2] Meaning that if you have a file write and can't control the extension and the extension doesn't correlate to any Content-Type (let's say .abc), you can add .html to the file name (filename.html.abc) and httpd will serve it as text/html
1
1
10
1,455
[2/2] Meaning that if you have a file write and can't control the extension and the extension doesn't correlate to any Content-Type (let's say .abc), you can add .html to the file name (filename.html.abc) and httpd will serve it as text/html
158
Yaniv Nizry retweeted
pspaul@pspaul9526 Jun 2025
Great bug chain by @YNizry that can pwn a whole org, starting with a single user click! I was also able to contribute a bit by creating my first port of a Chrome n-day exploit :)
Sonar Research
@Sonar_Research26 Jun 2025
🕸️🏢Caught in the FortiNet: Exploiting Fortinet’s endpoint protection solution to compromise an entire organization using minimal user interaction. Dive into our technical analysis of this interesting attack scenario: sonarsource.com/blog/caught-… #appsec #security #vulnerability
1
1
17
1,536
It was a pleasure to speak at #TROOPERS25 about my Fortinet findings. In case you missed it and don't want to wait for the recording, the first blog post is now live:
Sonar Research
@Sonar_Research26 Jun 2025
🕸️🏢Caught in the FortiNet: Exploiting Fortinet’s endpoint protection solution to compromise an entire organization using minimal user interaction. Dive into our technical analysis of this interesting attack scenario: sonarsource.com/blog/caught-… #appsec #security #vulnerability
1
2
903
Catch our second talk at #TROOPERS25: 🕸️ Caught in the FortiNet: Compromising Organizations Using Endpoint Protection @YNizry will tell you the story of multiple vulnerabilities in Fortinet products that can compromise an entire organization, starting with a single click
5
17
3,706
📁 Using polyglot file and RXSS to achieve one-click RCE on a Voyager instance. Read more about how SonarQube Cloud detected CVE-2024-55417 in our latest blog post: sonarsource.com/blog/the-tai… #appsec #security #vulnerability
14
45
3,820
Recently, I had the opportunity to reverse engineer and debug binaries on macOS 🪲🔍 I faced some Apple limitations during setup and struggled to find good beginner resources, so I wrote a short blog post to help others. yaniv-git.github.io/2025/01/… #macos #debugging #lldb

MacOS Binary Debugging

This blog post covers the basics of setting up an environment to debug binaries on MacOS

yaniv.nizry.com
6
12
586
🧬🔬 I wrote about this finding a bit more extensively in my blog: yaniv-git.github.io/2024/12/… #mXSS #XSS

DOMPurify 3.2.1 Bypass (Non-Default Config)

This blog post covers DOMPurify 3.2.1 Bypass, explaining a specific mutation technique

yaniv.nizry.com
Sonar Research
@Sonar_Research9 Dec 2024
🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace. When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete. #mXSS #XSS
24
1
73
4,803
The reason most PHP-based HTML sanitizers are inherently vulnerable to bypasses is just the tip of the iceberg🥶. Check out our latest blog post to learn why server-side sanitization is doomed to fail. sonarsource.com/blog/sanitiz… #appsec #security #vulnerability #php
2
45
1
114
12,538
Join us at OWASP SF for our talk, "Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail" to discover why client-side sanitization is crucial for a secure web. Can't make it? Stay tuned for our upcoming blog post. #OWASP #GlobalAppSecSanFran
8
28
3,593
Browsers don’t protect users from CSRF attacks when a website is using the convenient basic HTTP authentication method. Take a look at how SonarCloud found vulnerabilities in pyspider: sonarsource.com/blog/basic-h… #appsec #security #vulnerability
2
14
50
4,353
Load more