@httpvoid0x2f

Managed by @rootxharsh @iamnoooob

httpvoid.com
Joined November 2021
  • Tweets52
  • Following73
  • Followers4.3K
14Media
HTTPVoid retweeted
Hacktron AI
@HacktronAIAug 27
Our team discovered a critical remote code execution vulnerability in Next.js. If you self-host Next.js, update immediately. Vercel managed Next.js hosts are safe! We’ll publish the technical details and proof of concept soon!
20
65
17
479
110,080
HTTPVoid retweeted
Hacktron AI
@HacktronAIFeb 7
🚨 CVE-2026-1731 🚨 Our team discovered a critical pre-auth RCE affecting BeyondTrust Remote Support & Privileged Remote Access. SaaS/Cloud instances have been patched. If you're running self-hosted deployments, apply the patches immediately. More info in the comments.
3
63
3
242
36,096
My research on CVE-2025-49113 is out. fearsoff.org/research/roundc…. Happy reading! #CVE #roundcube #poc @FearsOff
7
96
3
332
33,290
I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby! It builds on the work of others, including Leonardo Giovanni, Peter Stöckli @GHSecurityLab and @wcbowling nastystereo.com/security/rub…
2
61
2
201
26,164
HTTPVoid retweeted
shubs
@infosec_au9 May 2024
My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: assetnote.io/resources/resea…. Thank you to the Vercel team for a smooth disclosure process.
16
181
8
776
95,682
Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server: starlabs.sg/blog/2024/04-sen…
5
82
5
240
40,239
HTTP Request Splitting vulnerabilities exploitation offzone.moscow/upload/iblock…
8
208
2
718
79,966
Here is the #exploit that targets the "VMWare Aria Operations for Networks" which has CVSS 9.8 and targets all the versions from 6.0 to 6.10 (CVE-2023-34039) 🔥 I just wrote the exploit, but the discovery credit is for @rootxharsh and @iamnoooob 👏 github.com/sinsinology/CVE-2…
35
1
78
14,165
Server-side prototype pollution: Black-box detection without the DoS portswigger.net/research/ser…

Server-side prototype pollution: Black-box detection without the DoS

Server-side prototype pollution is hard to detect black-box without causing a DoS. In this post, we introduce a range of safe detection techniques, which we've also implemented in an open source Burp

portswigger.net
1
76
3
189
26,708
Actually it looks like @b1u3r already found the same JNDI ObjectFactory RCE technique as me. Awesome work dude! Read about it here: tttang.com/archive/1405/
1
35
1
147
HTTPVoid retweeted
s1r1us
@S1r1u5_14 Aug 2022
Watch, Proof of Concept: Remote Code Execution on Discord blog.electrovolt.io/posts/di… Meanwhile, I will write one more blog to release after our DEFCON talk.
13
378
18
1,448
A single parameter in Google Drive API was enough for @httpvoid0x2f to get a full read SSRF in the Dropbox bug bounty program. This bug is surely still present in many integrations so keep your eyes open! Enjoy my explanation! youtu.be/sMk5ajkJO5o
36
145
HTTPVoid retweeted
PT SWARM@ptswarm14 Jul 2022
💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE! Read the research: swarm.ptsecurity.com/exploit…
5
241
7
615
I decided to make a homage-post to @homakov and @Nirgoldshlager about different OAuth-token leakage methods I've been researching – ten years after their blog posts that inspired me to start hunt for bugs ♥️ thank you. labs.detectify.com/2022/07/0…

Account hijacking using "dirty dancing" in sign-in OAuth-flows

Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens...

labs.detectify.com
20
370
12
970
As promised, I and @testanull publish our adventure last year. Hope you enjoy it ! peterjson.medium.com/miracle…

Miracle - One Vulnerability To Rule Them All

# Introduction

peterjson.medium.com
10
197
14
594
HTTPVoid@httpvoid0x2f4 Jun 2022
Replying to @httpvoid0x2f
We could either try to bypass isSafeExpression() which only works with the allowed whitelist and utilises AST parsing under the hood. Or/else we could target the allowed classes and potentially create a nasty gadget from there. We went with the latter.
5
11
5
66
This great article prompted me to continue my search for an updated universal ruby gadget! After a lot of digging I managed to chain two together to create a new RCE gadget that works on Ruby 2.0-3.2: devcraft.io/2022/04/04/unive…

Round Two: An Updated Universal Deserialisation Gadget for Ruby 2.x-3.x

A few months ago I noticed the gadget in my previous article had been patched and no longer worked in Ruby 3.0.3, so I spent a bit of time dusting off the old tools to see if I could find another one.

devcraft.io
HTTPVoid@httpvoid0x2f28 Mar 2022
New post - Ruby Deserialization - "Gadget" on Rails. In this blog post, we discuss finding a new RCE gadget in latest Rails (7) framework extending the work of @elttam @wcbowling. Ft. @iamnoooob @rootxharsh httpvoid.com/?p=Ruby-deseria…
2
65
1
184
Load more