web pentesting and low level stuff.
Joined June 2020
- Tweets275
- Following330
- Followers467
- Likes4.9K
hakim retweeted
Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.
Full story: open.substack.com/pub/calif/…
hakim retweeted
Did you know that running Chromium with these two flags --disable-web-security & --single-process ANY website can access your local files.
mwlik.github.io/2025-08-11-r…
hakim retweeted
I am actually very interested in puzzle design! I spent some time a few years ago working on CTF.guide which (I hoped) would help CTF authors write non-guessy challenges. So I decided to make a "exploratory" style challenge (a collection of a few easy problems) 7/🧵
hakim retweeted
So this happened a couple of months ago, but we reported an account takeover - in a multimillion users entertainment platform - that earned us $4,500 (Collaborated with @Mr_nyly & @S0nG0ku_H). since it's a private program, I can't disclose a thing, but here are some takeaways 👇
hakim retweeted
IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: github.com/assetnote/newtown…
hakim retweeted
CVE-2025-30466: Safari <18.4 UXSS to bypass Same-Origin Policy with CVSS of Critical 9.8 🔴 ;)
support.apple.com/en-us/1223…
hakim retweeted
Overflows? In my runtime? More likely than you think
bernsteinbear.com/blog/overf…
hakim retweeted
Launching a student-only free workshop: ".NET Exploitation Basics" 🪲
If you're a student (or know one), let's write some deserialization exploits, Manchester, July 12.
10 seats.
summoning.team/free-training…
hakim retweeted
🔥 A new (more difficult) era for mXSS will come soon! If nothing breaks, Chromium will start escaping "<" and ">" in attributes starting with M138.
See chromestatus.com/feature/626… for details.
hakim retweeted
I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame", at #BHUSA! This is going to be epic, check out the abstract for a teaser ↓↓↓
hakim retweeted
New blogpost! Want to see how we exploited @Synology network-attached-storage devices at Pwn2Own Ireland?
RCE to root via out-of-bounds NULL-byte writes, click the embed for a fun little writeup of CVE-2024-10442 🔎🎉
blog.ret2.io/2025/04/23/pwn2…
hakim retweeted
Introducing Deep Research for arXiv
Ask questions like 'What are the latest breakthroughs in RL fine-tuning?' and get comprehensive lit reviews with trending papers automatically included
Turn hours of literature searches into seconds with AI-powered research context ⚡
hakim retweeted
I think everyone had enough fun with it that we can now remove this feature 😊
Blink: Intent to Deprecate and Remove: Remove auto-detection of ISO-2022-JP charset in HTML
bit.ly/3FUL2Je
hakim retweeted
This is an excellent finding and analysis by @stephenfewer attackerkb.com/topics/G5s8ZW…. Reminds me of @orange_8361’s recent work. Poetic RCE.
hakim retweeted
Unrestrict the restricted mode for USB on iPhone. A first analysis @citizenlab #CVE-2025-24200 👉 blog.quarkslab.com/first-ana…
Just finished my writeup about CVE-2025-23369, an interesting SAML authentication bypass on GitHub Enterprise Server I reported last year. you can read about it here: repzret.blogspot.com/2025/02…
I have posted a writeup for a challenge I authored recently that exploits Django's flatpages, read it here: github.com/hakivvi/CTF-Write…
turns out i pushed somehow an almost empty gem to RubyGems as 0.1.0, just fixed that and added build config for MacOS x64 systems. github.com/hakivvi/frida-rub…
I wrote Ruby bindings for frida, check out the source in github: github.com/hakivvi/frida-rub…
hakim retweeted
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…