@jeffssh

Forever standing on the shoulders of giants

jeffs.sh
Joined June 2018
  • Tweets113
  • Following325
  • Followers939
9Media
I have completed the FORCED ENTRY RCE + SBX chain with a PAC bypass. The calculator payload can be found here: github.com/jeffssh/CVE-2021-…. I learned a lot about iOS exploitation and can't wait to share that in a blog post, which I'll release along with the code to generate this PDF.
9
90
2
404
60,011
With the help of Claude Mythos Preview, the Firefox team fixed more security bugs in April than in the past 15 months combined.
334
1,225
311
15,243
1,498,904
sorry babe, not tonight 2x claude usage during off-hours
Anthropic banner advertising 2x more Claude usage during off peak hours

ALT Anthropic banner advertising 2x more Claude usage during off peak hours

6
12
2
198
15,485
Let's put together the best articles on v8 vr/xd for 2025-2026. Write the most interesting blog posts, issues/reports, exploitation techniques, and so on in replies. I'll start with: Seunghyun Lee(@0x10n) and 303f06e3 issues.chromium.org/issues?q… issues.chromium.org/issues?q…
7
68
3,478
shaking my head while excitedly reading a citizen lab / project zero post so everyone in my work-from-home office knows i disagree with human rights violations
5
5
60
5,577
speedrunners reinvented Use After Free and called it "stale reference manipulation" one day theyre gonna invent type confusion and call it item abuse
16
86
5
1,896
77,430
We really should be talking about this more....KASLR is just not working properly on Android right now, and it hasn't for a long time. googleprojectzero.blogspot.c…

Defeating KASLR by Doing Nothing at All

IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...

projectzero.google
5
57
4
193
63,354
As the operator of a soup kitchen, I don’t see why I should be expected to fix health code violations people report. After all, we are run almost entirely by volunteers
17
8
6
106
19,189
OMG.. whatsapp 0c in pwn2own
17
105
38
719
351,044
Pointer leaks through pointer-keyed data structures googleprojectzero.blogspot.c…

Pointer leaks through pointer-keyed data structures

IntroductionSome time in 2024, during a Project Zero team discussion, we were talking about how r...

projectzero.google
9
1
34
5,308
googleprojectzero.blogspot.c… issuetracker.google.com/issu…
2
13
1
64
10,420
1
6
55
4,691
Me and the homies are dropping browser exploits on the red team engagement 😎. Find out how to bypass WDAC + execute native shellcode using this one weird trick -- exploiting the V8 engine of a vulnerable trusted application. ibm.com/think/x-force/operat…

Operationalizing browser exploits to bypass Windows Defender Application Control (WDAC) | IBM

Previously discovering a method for bypassing even the strictest WDAC policies by backdooring trusted Electron applications, the IBM X-Force Red team continued their research and can now bypass the...

ibm.com
23
234
6
791
137,126
I'm thrilled to announce that my talk Ghost Calls: Abusing Web Conferencing for Covert Command & Control was accepted to #BHUSA 2025 (CC: @BlackHatEvents) blackhat.com/us-25/briefings…
5
1
18
2,745
Replying to @chompie1337
Dammit, that's a typo and I can't edit the post. Well anyway project-zero.issues.chromium…
3
13
2,156
V8 Sandbox escape/bypass/violation and VR collection github.com/xv0nfers/V8-sbx-b…

GitHub - xv0nfers/V8-sbx-bypass-collection

Contribute to xv0nfers/V8-sbx-bypass-collection development by creating an account on GitHub.

github.com
3
84
3
318
42,985
So proud to lead Robinhood's Vulnerability Research Program github.com/fleetdm/fleet/sec…

SAML authentication vulnerability due to improper SAML response validation

### Summary A vulnerability in Fleet’s SAML authentication handling could allow an attacker to forge authentication assertions and gain unauthorized access to Fleet. In certain configurations, t...

github.com
1
1
9
799
Chrome Browser Exploitation: from zero to heap sandbox escape by @matteomalvica youtube.com/watch?v=RL2po1sw…

Chrome Browser Exploitation: from zero to heap sandbox escape -...

This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurit...

youtube.com
71
2
287
28,211
Pwndbg 2025.01 is out! It adds official LLDB support including support for macOS and Mach-O binaries, improved performance, enhanced embedded debugging & many more! Also, want to support us or buy us a coffee? See our GH sponsors: github.com/sponsors/pwndbg github.com/pwndbg/pwndbg/rel…

Sponsor @pwndbg on GitHub Sponsors

Pwndbg is a free & open-source plugin for GDB and LLDB, making low-level debugging suck less. Support us to help us improve the state of debugging on Linux. We also send send patches & bugs...

github.com
48
4
183
24,899
Allocating new exploits Pwning browsers like a kernel & Digging into PartitionAlloc and Blink engine phrack.org/issues/71/10.html
1
27
101
11,096
Excited to be back at DEFCON!
16
2,629
Load more