@lbherrera_
 Brazil
blog.lbherrera.me/posts/
Joined February 2013
  • Tweets630
  • Following446
  • Followers3.3K
21Media
Luan Herrera retweeted
TRAMOIA@tramoia_shSep 29
‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰ ‿︵‧˚⊹ CHAMADA DE ARTIGOS ⊹˚‧︵‿ ‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰ ༺༻༺༻ DATA FINAL ༺༻༺༻ ༺༻༺༻ 13/11 ༺༻༺༻ ༺༻༺ [email protected] ༻༺༻ ‿⊱⊱༒༻༻༻༻⛧༺༺༺༺༒⊰⊰
8
16
2
39
3,630
Luan Herrera retweeted
s1r1us
@S1r1u5_Sep 18
On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
353
1,388
548
11,823
2,820,665
Luan Herrera retweeted
Tanto Security@TantoSecuritySep 7
🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX tantosec.com/blog/2026/09/te… The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name...

tantosec.com
1
59
5
181
32,077
Watch on YouTube: youtube.com/watch?v=nuJRZZV7…

My Life, AI and the Future of LiveOverflow

I have been pretty inactive the past 2-3 years and a lot has happen...

youtube.com
2
8
84
13,202
Luan Herrera retweeted
hashkitten@hash_kittenJul 17
I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances! slcyber.io/research-center/w…

wp2shell: Pre Authentication RCE in WordPress Core

Critical issue discovered in WordPress Core affecting the majority of WordPress-built sites. A pre-authentication Remote Code Execution (RCE) that can be used by attackers to run malicious code to...

slcyber.io
31
228
30
1,033
203,804
Luan Herrera retweeted
caioluders@caioludersJul 11
lude.rs/hacker-compass/

Hacker Compass — o teste definitivo

Hacker, profissional de sec, noob ou charlatão? Descubra sua coordenada exata na treta.

lude.rs
1
2
14
1,275
[475265304][reward: $3000] NetError's page AutoReloader leads to multi-download blocker bypass crbug.com/475265304
1
4
755
Luan Herrera retweeted
DaviMatsuyama
@davi1337_May 26
Here we go. my DEF CON CTF writeup, a little different from the others. Also, thanks to Pwn de Queijo for letting me play with you guys. davi1337.gitbook.io/public/d…

DEFCON Quals 26 | Davi1337

challenges.

davi1337.gitbook.io
11
1
93
8,702
Luan Herrera retweeted
Renwa@RenwaX23May 24
"Dad, what was it like playing CTFs before AI?"
26
274
35
1,692
181,502
Luan Herrera retweeted
hashkitten@hash_kittenMay 19
Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only! xss.hashkitten.io/xss1.html
19
21
9
210
63,539
Luan Herrera retweeted
[email protected]@r3tr074May 4
I wrote a blog post about the recent copy(dot)fail bug, trying to explain some general concepts that I think were glossed over in the official article by @theori_io. retr0.zip/blog/cve-2026-3143…
5
95
6
357
67,809
Luan Herrera retweeted
Hacktron AI
@HacktronAIApr 28
Introducing Hacktron Review: an AI security reviewer for your pull requests. It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production. Try for free: app.hacktron.ai
22
42
7
288
73,817
[422531206][reward: $5000] Intersection Observer v2 API fails to correctly determine target's visibility for dynamically changed z-indexes, enabling clickjacking against Google One Tap crbug.com/422531206
1
6
1,103
Luan Herrera retweeted
s1r1us
@S1r1u5_Apr 15
I pointed claude opus at chrome and told it to build a full v8 exploit for discord. A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell. hacktron.ai/blog/i-let-claud…

I Let Claude Opus Write a Chrome Exploit: The Next Model (Mythos?) Won't Need My Help?

I pointed Claude Opus at Discord's bundled Chrome (version 138, nine major versions behind upstream) and asked it to build a full V8 exploit chain. The V8 OOB we used was from Chrome 146, the same...

hacktron.ai
22
171
11
1,051
157,670
Luan Herrera retweeted
caioluders@caioludersMar 3
new tool PEGA-PEGA Multi-protocol request logger and catcher. Listens on 14 protocols, logs every incoming request, and displays them in a web dashboard and terminal UI. github.com/caioluders/pega-p…
1
3
19
1,112
Luan Herrera retweeted
Rebane@rebane2001Feb 24
i built an entire x86 CPU emulator in CSS (no javascript) you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS
318
1,022
264
9,918
1,077,071
Luan Herrera retweeted
Hacktron AI
@HacktronAIFeb 7
🚨 CVE-2026-1731 🚨 Our team discovered a critical pre-auth RCE affecting BeyondTrust Remote Support & Privileged Remote Access. SaaS/Cloud instances have been patched. If you're running self-hosted deployments, apply the patches immediately. More info in the comments.
3
63
3
242
36,092
[447172715][reward: $30000] Security: Compromised renderer can control mouse after single tap (UXSS, sandbox escape, and more) crbug.com/447172715
1
21
1
129
12,778
Datr cookie theft and AI leading to Facebook account takeover ($24,000) ysamm.com/uncategorized/2025… Two-click Facebook account takeover via FXAuth ($30,000) ysamm.com/uncategorized/2025… Self-XSS in Facebook payments flow leads to account takeovers ($62,500) ysamm.com/uncategorized/2025…
16
138
6
945
96,236
$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more: ysamm.com/uncategorized/2025…

Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover

Introduction

ysamm.com
38
225
18
1,323
214,549
Load more