@filedescriptor

@0xReconless

 Hong Kong
innerht.ml
Joined February 2014
  • Tweets996
  • Following34
  • Followers17.3K
42Media
The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2023! portswigger.net/research/top…

Top 10 web hacking techniques of 2023

Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net
6
157
9
471
86,476
Google(Chromium) suddenly decided to pay me for a UI Spoofing bug reported 3 years that had been idle, and from reward potential to no potential to potential. Ok thanks?
1
4
54
13,323
The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2022! portswigger.net/research/top…

Top 10 web hacking techniques of 2022

Welcome to the Top 10 Web Hacking Techniques of 2022, the 16th edition of our annual community-powered effort to identify the most important and innovative web security research published in the last

portswigger.net
7
226
12
585
117,034
This #privacy audit looks like the first LeaveHomeSafe #pentest ever, way below commercial apps: Broken SSL validation, SD Card Leaks, 2FA Logic bypass, Screenshot leaks, several Face Recognition artifacts, etc. 7asecurity.com/blog/2022/07/…
Open Technology Fund@OpenTechFund27 Jul 2022
Serious vulnerabilities have been found in the Hong Kong government's LeaveHomeSafe COVID-19 app. @7aSecurity recently conducted a security audit that discovered numerous flaws that allow interception of the LeaveHomeSafe app and its backend servers. opentech.fund/news/7asecurit…

7ASecurity, OTF Red Team Lab partner, completes Blackbox Pentest and Privacy Audit of LeaveHomeSafe...

 

opentech.fund
1
16
1
21
We are organising VXCON on 27 August. Please feel free to submit CFP. vxcon.hk

VXCON

VXCON, we are glad to invite a few prominent speakers and researchers all over the world. They are frequent speakers of Blackhat, DEF CON, HITCON and in various global hacker and security conference....

vxcon.hk
2
1
3
Confirmed! Masato Kinugawa demonstrated a 3-bug chain of injection, misconfiguration and sandbox escape on Microsoft Teams to earn $150K and 15 Master of Pwn points.
1
25
5
130
New writing about the story of 3 bug bounty reports in which I chain low severity bugs together for higher impact and less known browser tricks. Includes CSS injection, Self-XSS, Drag-Drop XSS, Cookie Bomb, Login-Logout-CSRF, and more... medium.com/@renwa/the-underr…

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb, Login+Logout CSRF…

Story of 3 bug bounty writeups which I use low bugs and chain them together for higher impact.

medium.com
4
97
308
After 5 years of work, security.txt is officially an RFC. I am pleased to announce RFC 9116: rfc-editor.org/rfc/rfc9116. I would like to use this opportunity to thank those who made this possible. Thank you. ❤️
The security.txt specification has been published as RFC 9116

ALT The security.txt specification has been published as RFC 9116

43
938
107
2,708
We found a way to spoof ENS domains and were awarded a $15k bug bounty by @ensdomains 👇Check out the write-up medium.com/@hacxyk/how-we-sp…

How we spoofed ENS domains for $15k

TL;DR: We found a flaw that allowed us to spoof Ethereum domain names and received a $15k bounty.

medium.com
4
22
7
118
The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2021! portswigger.net/research/top…

Top 10 web hacking techniques of 2021

Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year

portswigger.net
6
361
16
765
New blog post: "What Bypassing Razer's DOM-based XSS Patch Can Teach Us" — edoverflow.com/2022/bypassin….

What Bypassing Razer's DOM-based XSS Patch Can Teach Us | EdOverflow

An old story of a bug I uncovered and reported to Razer’s vulnerability disclosure programme resurfaced recently while I was chatting with Linus Särud. …

edoverflow.com
6
101
3
244
Why do we need NFT on social media??
3
13
Replying to @garethheyes
Also function solve(obj, property){ if(typeof obj != 'function') { obj(property).innerHTML = '<img src=1 onerror="alert(`You win`)">'; } else { alert('You must try harder than that.'); } }
1
5
1
16
My browser UI security blog is out! Featuring 10 bugs. microsoftedge.github.io/edge…

UI Security - Thinking Outside the Viewport

Introduction

microsoftedge.github.io
2
66
1
144
I've been meaning to create a blog for some time now, and I finally did it! For its first post I wrote about a vulnerability that allowed an attacker to leak the full URL of cross-origin redirects on Google Chrome, check it out! blog.lbherrera.me/posts/appc…

AppCache's forgotten tales

Leveraging AppCache's network section to leak the complete URL of cross-origin redirects.

blog.lbherrera.me
7
121
6
327
‘Soft skills are the most under-researched area of the bug bounty industry’ – ‘Reconless’ YouTubers (@0xReconless ) on filling a gap in infosec education portswigger.net/daily-swig/s…

PortSwigger — Web security tools, training and research

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

portswigger.net
43
3
125
New Video! Binary Exploitation 0x02 Why you should Close Your Files youtu.be/6SA6S9Ca5-U
5
68
4
279
The top 10 web hacking techniques of 2020, by @albinowax with help from @filedescriptor, @irsdl, @Agarri_FR and the entire community portswigger.net/research/top…

Top 10 web hacking techniques of 2020

Welcome to the Top 10 (novel) Web Hacking Techniques of 2020, our annual community-powered effort to identify the must-read web security research released in the previous year. Over the past few weeks

portswigger.net
4
233
10
494
Untrusted Types just got a new UI with better filtering options and features thanks to @ThomasOrlita! Check it out! github.com/filedescriptor/un…
4
34
138
I have made a video to demonstrate how we can automate permission checks using my GitLab project "OpenAPI Security Scanner". Check it out! youtu.be/K65e5QRQ1tc Video editor: @wacms666

Automating Permission Checks Using OpenAPI Security Scanner?

GitLab Project Link: https://gitlab.com/ngalog-gitlab/openapi_secur...

youtube.com
8
94
1
313
Load more