@makelariss

Building worlds where hackers play. 🏴 Head of CTFs @hackthebox_eu | Global cyber competitions + enterprise training | he/him

 Thessaloniki, Greece
Joined July 2016
  • Tweets5.1K
  • Following2.6K
  • Followers1.2K
12Media
Who knew you could suffer eternal damnation by eating some space shrimps? 🦐 20 hours and counting ⏰. You still have time to hack your way in at hackthebox.eu/#join and claim the first🩸for my #Web challenge #ImageTok. #HackTheBox #CyberSecurity #CyberSecurityTraining
1
2
28
makelaris retweeted
Xclow3n@xclow3nMar 17
Spent a week testing AI for vulnerability research. 14 confirmed bugs in 20 min on one target. 5% hit rate on a hardened one. Same AI, same setup. 4 approaches, what worked, what failed, why target selection matters more than model sophistication. xclow3n.github.io/post/7
5
85
4
432
33,498
makelaris retweeted
Mr.Z@zux0x3aMar 10
I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory. Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX. github.com/zux0x3a/Phantom/t…
4
78
247
16,990
makelaris retweeted
Xclow3n@xclow3nMar 9
Discovered 3 HTTP request smuggling vulnerabilities and 1 cache poisoning vulnerability in Cloudflare’s Pingora reverse proxy, all exploitable under the default configuration. These issues resulted in 2 Critical CVEs and 1 High-severity CVE. xclow3n.github.io/post/6
3
45
3
205
38,493
makelaris retweeted
pashov
@pashovMar 4
🚨Ethereum Developers: you can now install your first AI Auditor in 1 minute - fully autonomous, available 24/7, with multiple sub-agent helpers. Open Source. FREE to use (with your AI model) and already finding vulnerabilities in smart contracts. Link below🫡
178
259
53
1,524
227,797
New blog: Hooked on Linux — Rootkit Taxonomy, Hooking Techniques and Tradecraft Part 1 of our Linux rootkit series exploring kernel & userland rootkits and the hooking techniques they use (syscall/function hooks, ftrace, eBPF, inline patching). 🔗elastic.co/security-labs/lin…

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

In this first part of a two-part series, we explore Linux rootkit taxonomy, trace their evolution from userland shared object hijacking and kernel-space loadable kernel module hooking to modern eBPF-...

elastic.co
27
1
74
8,402
makelaris retweeted
Adnan Khan@adnanthekhanMar 3
Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning adnanthekhan.com/posts/angul… #BugBounty

Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poison...

Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning - Security research by adnanthekhan

adnanthekhan.com
3
57
5
234
27,701
makelaris retweeted
Tim Blazytko
@mr_phrazerMar 3
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/binary-…

GitHub - mrphrazer/binary-ninja-headless-mcp: Headless Binary Ninja MCP server — giving AI agents...

Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools. - mrphrazer/binary-ninja-headless-mcp

github.com
3
50
2
268
37,415
makelaris retweeted
Jorian
@J0R1ANMar 4
WebSockets are not yet affected by Local Network Access permission in Chrome. Check out this blog post from my colleague @GrumpinouT! aikido.dev/blog/storybooks-w…

Persistent XSS/RCE using WebSockets in Storybook (CVE-2026-27148)

CVE-2026-27148 exposes a WebSocket hijacking flaw in Storybook that can escalate into supply chain compromise. Learn the attack path, impact, and how to remediate.

aikido.dev
6
43
2,540
makelaris retweeted
devansh ⚡️@0xAsm0d3usMar 1
A bunch of security issues I reported to better-hub. Disclosing as these should have been fixed now. Thanks for quick fixes @bekacru
3
10
108
8,332
makelaris retweeted
Icare@Icare1337Feb 27
Apache FOP + Ghostscript = 💥 Bypassed PostScript escaping using non-breaking spaces (\xa0) to inject commands. Chained with CVE-2025-46646 for Windows RCE. @truffzor Apache won't fix it - just updating the docs 🤷 Full technical details @sigabrt9 offsec.almond.consulting/byp…
1
3
1
37
2,488
New write-up! Bypassing egress filtering in BullFrog GitHub Action (using query pipelining feature of DNS over TCP) (link in comment)
1
23
77
4,250
makelaris retweeted
Yotam Perkal
@pyotam2Feb 27
We disclosed a critical unauthenticated RCE chain in mcp-atlassian (4M+ downloads). CVE-2026-27826 - SSRF via Atlassian URL headers CVE-2026-27825 - Arbitrary file write → RCE Fixed in 0.17.0. Full breakdown 👇 blog.pluto.security/p/mcpwnf…

MCPwnfluence: Critical Unauthenticated SSRF to RCE Attack Chain in the Most Widely Used Atlassian...

We disclosed CVE-2026-27825 (CVSS 9.1) and CVE-2026-27826 (CVSS 8.2), enabling a network-reachable RCE chain in mcp-atlassian (4M+ downloads)

pluto.security
1
29
128
6,997
Second write-up of the day! sudo restriction bypass via Docker Group in BullFrog GitHub Action devansh.bearblog.dev/sudo-by…
10
35
2,663
makelaris retweeted
quarkslab@quarkslabFeb 26
Why macOS AVs shouldn’t trust PIDs 😄🍏 - new post by @Coiffeur0x90 Intego X9: XPC validation falls back to PID → PID reuse + posix_spawn() shenanigans 😏 ⇒ confused deputy / privileged methods abused 🤡🧨 Lesson: PID ≠ identity. blog.quarkslab.com/intego_lp…
1
13
2
52
4,560
makelaris retweeted
Jorian
@J0R1ANFeb 23
Just a few days later, there's the next blog post for @AikidoSecurity! Another framework-level vulnerability this time affecting Astro, resulting in SSRF if an unvalidated connection can be made to the webserver. Read the details here: aikido.dev/blog/astro-full-r…

Astro SSRF Vulnerability: Host Header Injection in SSR Error Pages (CVE-2026-25545)

Aikido Security's AI pentesting agent discovered a Server-Side Request Forgery vulnerability in Astro's SSR implementation. Learn how Host header injection in prerendered error pages allowed full...

aikido.dev
16
1
87
3,857
makelaris retweeted
shubs
@infosec_auFeb 17
Sometimes you spot a sink and know it's vulnerable, but proving it is a challenge. @SLCyberSec's team broke through layers of crypto to reach a pre-auth deserialization sink in OpenText Directory Services. Breaking the encryption was a journey. slcyber.io/research-center/a…
1
68
240
17,852
Pwning TRUfusion Enterprise again: chaining a pre-auth SSRF (CVE-2025-32355), a default password, and a path traversal (CVE-2025-59793) to gain RCE. #security rcesecurity.com/2026/02/when…

When Audits Fail Part 2: From Pre-Auth SSRF … | RCE Security

A pre-auth SSRF in TRUfusion Enterprise (CVE-2025-32355) allows external attackers to reach internal-only services via a misconfigured reverse proxy. This …

rcesecurity.com
10
38
3,045
HonoJS JWT/JWKS Algorithm Confusion (CVEs pending) devansh.bearblog.dev/honojs/
48
1
215
13,388
makelaris retweeted
Martin Mielke
@xct_deFeb 7
I was looking a bit onto why OPENROWSET is able to read privileged files (like the root flag on Signed @hackthebox_eu) when using Silver tickets on MSSQL. Turns out you can get SYSTEM access without potatoes by recovering the full token. vuln.dev/silver-ticket-mssql…

MSSQL Silver Tickets and Token Privileges

I ran into an interesting situation while reviewing Signed on HackTheBox: We get MSSQL access through a silver ticket, which leads to admin privileges on the MSSQL service - but the service account...

vuln.dev
1
35
117
8,018
Load more