Just an exploit seeker and curious noob.
🇧🇷
Joined January 2019
- Tweets351
- Following347
- Followers363
- Likes4.6K
xpl retweeted
olá amigos virtuais!
passando pra avisar que a segunda edição da @tramoia_sh está disponível ein!
é uma zine brasileira e focada em hacking raiz. nosso intuito é justamente manter essa cultura sempre viva!
estamos sempre aceitando submissões, seja em ptbr ou outros idiomas
e caso seu artigo seja aceito, ganha uma camiseta lindona ♥️
rt pra alcançar mais hackudos 🙏🏻
xpl retweeted
🚨 CFP aberto — Bug Bounty Village @ H2HC 2025 🚨
Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty?
Manda sua talk!
👉 docs.google.com/forms/d/e/1F…
#H2HC #BugBounty #Call4Papers #HackerCulture
xpl retweeted
This is some really nice research! It's definitely worth trying these techniques against cryptocurrency extensions! marektoth.com/blog/dom-based…
xpl retweeted
New Active Directory Mindmap v2025.03! 🚀
📖 Readable version: orange-cyberdefense.github.i…
🔧 Now fully generated from markdown files—way easier to update and maintain!
💡 Got improvements? PRs welcome! 👉 github.com/Orange-Cyberdefen…
xpl retweeted
very pleased to announce the release of my new article based on my research that led to CVE-2024-46982 titled:
Next.js, cache, and chains: the stale elixir
zhero-web-sec.github.io/rese…
note: does not cover the latest findings shared in my recent posts
enjoy reading;
xpl retweeted
ADCS Attack Techniques Cheatsheet for all of you lazy folks who prefer colored tables over reading a bunch of articles just to find some specific information:
bit.ly/adcs-cheatsheet
xpl retweeted
New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate.
Full disclosure:
samcurry.net/hacking-kia
xpl retweeted
In August, watchTowr Labs hijacked parts of the global .mobi TLD - and went on to discover the mayhem that we could cause.
Enjoy....
labs.watchtowr.com/we-spent-…
Yay, I was awarded a $1000 bounty on @Hacker0x01 for a 1-Click RCE vulnerability! Collab with my bro @LuskaBol
hackerone.com/xpl #TogetherWeHitHarder
28
1,362
xpl retweeted
PHP just fixed one of my RCE vulnerabilities, which affects XAMPP by default. Check to see if you are affected and update now! 🔥
blog.orange.tw/2024/06/cve-2…
xpl retweeted
“Rook to XSS: How I hacked chess[.]com with a rookie exploit”
skii.dev/rook-to-xss/
Really great read! If you’ve never looked, chess.com has a great off-platform bug bounty program via security@chess.com
xpl retweeted
This is a very unknown technique. Tried googling it and found no results, so maybe even a novelty.
This allows you to dump all domains from a Cloudflare user by doing nameserver correlation. Great for finding base domains owned by the company.
celes.in/posts/cloudflare_ns…
xpl retweeted
"A tale of making internet pollution free"
- Exploiting Client-Side Prototype Pollution in the wild - @S1r1u5_
blog.s1r1us.ninja/research/P…
xpl retweeted
Sharing my experience with alias path traversals on nginx, and how we leaked sensitive data on Bitwarden and GCP with that. Along with that, we also released a tool called navgix to check for the presence of these vulnerabilities in an automated manner.
labs.hakaioffsec.com/nginx-a…
xpl retweeted
I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️
xpl retweeted
We recently found a vulnerability affecting Hyundai and Genesis vehicles where we could remotely control the locks, engine, horn, headlights, and trunk of vehicles made after 2012.
To explain how it worked and how we found it, we have @_specters_ as our mock car thief:
