
@insertscript@infosec.exchange # https://xitter.cf/t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53
Joined June 2012
- Tweets2.1K
- Following217
- Followers6.7K
- Likes13.5K
When you like DNS related shenanigans, this is fun to check for yourself.
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC
blog.alice.poc.debiru.net/
1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。
(参考)
検証用URL blog.alice.poc.debiru.net/
FAKEサーバー debiru.static.jp/
TRUEサーバー blog.bob.poc.debiru.net/
Replying to @zhero___
@zhero___ zeroday.cloud/2026-competiti… has Next.js as a target ;-)
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
Replying to @rebane2001
uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.
alex retweeted
We are going to be at DEF CON!
If you want to learn fault injection hands-on, make sure to bring your laptop.
Replying to @J0R1AN
this is perfect - I needed that for a test case I always wanted to try^^
alex retweeted
If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post:
blog.voorivex.team/content-t…
Can you spot the XSS vulnerability? 👀
Test it out live at: pwnbox.io/challenges/mimic-2
Replying to @garethheyes
oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^
+{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}
I co-authored an educational article on cache poisoning vulnerabilities with @intigriti.
If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!
Most hunters skip web cache poisoning because it looks intimidating... 😓
But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠
In our latest article, we walk you through identifying cache layers, spotting unkeyed inputs, and chaining them into real impact! 😎
This time, we teamed up with Zhero (@zhero___) who is well-known for his research around cache poisoning vulnerabilities! 💪
Read the article now!👇
intigriti.com/researchers/bl…
alex retweeted
DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
github.com/cure53/DOMPurify/…
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):
Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js
zhero-web-sec.github.io/rese…
Damn, what a read
StubZero: $148,337 RCE in Google Cloud Production
brutecat.com/articles/google…
Replying to @magicmac2000
I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D
FFFF the axios thing is bad, almost all node.js project use it, we use it.
didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao
built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway.
CHECK YOUR IMAGES.
github.com/hacktronai/cull
Replying to @AmirMSafari
Well I learned a lot trying to solve this challenge.
But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)
Replying to @shhnjk
Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image
Again just a quick JS PoC (nothing new, just some PoC to try it):
JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused.
insert-script.com/examples/j…
alex retweeted
Your chance to be part of a historic event for cryptography education in the Levant is still open!
The CFP for Cedarcrypt, the most ambitious and exciting cryptography event in the Levant region in recent memory, has a deadline of April 10 and we still have room in the program.
If you've been meaning to submit a talk, workshop, or research presentation, now's the time. We want hands-on workshops, lectures on both foundational and real-world topics, and research talks including work in progress. Topics range from post-quantum crypto and ZK proofs to secure implementation and protocol verification.
We're also still actively seeking sponsors. Sponsorship funds student stipends directly — it's how we make the event accessible to grad students and early-career researchers worldwide. If your organization is in this space, let's talk.
Accepted speakers get travel support, free registration, and accommodation help. July 13–16, Paphos, Cyprus.
Join us in making a real difference in how real-world cryptography is taught in the Levant! Come meet and engage with excited new students!
cedarcrypt.org
Replying to @rebane2001
The only solutions I can think of:
Overwrite the prototypes - Number or Object
use document.all as the one exception.
Afaik no symbols are utilized sadly for this operator.

















