caon retweeted
I haven't posted a crazy XSS vector for a while...
Works on every browser
![<alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>](https://pbs.twimg.com/media/HNx0WfkWMAAFJqL.jpg?name=orig)
ALT <alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>
Título: Leak de PII de ~10k clientes + admins
Severidade: Crítico
Status: Aprovado e Corrigido
Bounty: Não ❌
Jaqueta: Não ❌
Quando alguém consegue hackear a AUVP, a gente costuma enviar alguns presentes legais (e pagamos para erros críticos). Mas desta vez o time de produto resolveu fazer algo diferente.
Criamos uma versão "bugada" da nossa jaqueta: logo de cabeça para baixo, elementos desalinhados e outros pequenos erros de propósito.
Ela é exclusiva para quem encontrar bugs nas nossas aplicações.
Legal ou cringe?
caon retweeted
<svg>
<script><?marker name="script"></script>
<style><?marker name="style"></style>
</svg>
<template for="script">alert()</template>
<template for="style">*{background:red}</template>
おもしろい
caon retweeted
Not even in Brazil yet, and the @BugBountyBr guys already gave me such a warm welcome 😁
@highustavo @zeroc00i @locs3c @_caon__ — thanks for the live, guys. That was insanely genuine!
caon retweeted
🟥 Positive Hack Talks → São Paulo 🇧🇷
Dec 10th, 2025
🗣️ Speakers — submit papers (flights/hotel covered). CFP link in thread 👇
💻 Cybersecurity community — join our most community-driven event.
➡️ phtalks.ptsecurity.com/saopa…
Free · 8 talks · limited spots
#PHTalks
Ótima oportunidade para a comunidade!
🚨 LHE – Mercado Livre Hacking Event 2025 🚨
🗓 25/10 a 01/11
Escopo ampliado, desafios, bounties e premiações exclusivas!
Inscreva-se: forms.gle/Cs35PeYcoGsm8enV9
caon retweeted
🚨 CALL 4 PAPERS — Bug Bounty Village @ H2HC 2025 🚨
Caçou um bug insano? Tem case real ou técnica nova? Esse é seu palco!
Envie sua proposta pelo form:
bit.ly/4n4hXf9
#H2HC #BugBountyVillage #Call4Papers #HackerCulture
🚨 CFP aberto — Bug Bounty Village @ H2HC 2025 🚨
Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty?
Manda sua talk!
👉 docs.google.com/forms/d/e/1F…
#H2HC #BugBounty #Call4Papers #HackerCulture
caon retweeted
Hackers,
To make our pricing fairer worldwide, we’re trying out localized pricing.
We’re starting with Brazil 🇧🇷, with Individual plan prices dropping by about 50%.
💸 Monthly: ~110 BRL → 55 BRL
💸 Yearly: ~1,100 BRL → 550 BRL
Which country should we do next?
caido.io/blog/2025-08-21-loc…
caon retweeted
I don't know who this will help but I put together a page listing JavaScript APIs that can break Shadow DOM encapsulation :)
github.com/masatokinugawa/Sh…
caon retweeted
New Android host validation bypass technique!
[1/4] All parsed URIs in Android are android.net.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter
caon retweeted
How to find viable targets for client-side desync attacks:
1️⃣ Open Burp Suite and intercept requests.
2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater.
3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to HTTP/2.
4️⃣ Send the Modified Request and look for this error message:
"Server ALPN does not advertise HTTP/2 support"...
5️⃣ Enable ALPN Override in request settings and send again.
If you see "Stream failed to close correctly" then you've confirmed that the server does not support HTTP/2 and is a valid target for desync testing!
Want to learn more about desync attacks? On August 6, at Black Hat USA, James Kettle from PortSwigger Research will reveal new classes of desync attack that enabled him to compromise multiple CDNs and kick off the desync endgame! 😲
Stay up to date here: http1mustdie.com/
caon retweeted
If the origin server treats a delimiter, but the cache doesn’t and the cache normalizes paths before applying static directory rules you can leverage path traversal!
Take this payload:
/myAccount$/..%2Fstatic/any
- The cache sees: /static/any
- The origin sees: /myAccount
The response for /myAccount is cached under /static/any and anyone that visits that static URL gets leaked data.
caon retweeted
Want to know how I discovered this vector? Read the blog...
thespanner.co.uk/the-curious…
caon retweeted
RFC 2047 "encoded-word" is crazy!
It lets you smuggle encoded payloads into email addresses and the craziest thing is that some parsers decode it before validation 👇
Shout out to @garethheyes for this 🔥
caon retweeted
I've just released my proof-of-concept tool called pugDNS. It's an experimental high-performance DNS bruteforcer built with AF_XDP. It's up to 3x faster than massdns, and 30x faster than dnsx. github.com/c3l3si4n/pugdns
caon retweeted
🚨 AI Security Failure 🚨 @AnthropicAI
I bypassed the #constitutionalclassifiers designed to block harmful content and extracted detailed chemical information on a restricted substance.
Despite passing multiple safeguards, the content checker failed to flag it as harmful. Here’s what happened: 🧵
