infosec. The Potatosploiter of Nandy Narwhals. @amon@infosec.exchange
Singapore
Joined October 2012
- Tweets1K
- Following604
- Followers411
- Likes2.7K
amon retweeted
Run out of space. Blog post by our team member @bestswngs & guest contributor @n132XxX
Typed `id` on a stock Ubuntu Server. Default user already in the `lxd` group, which is root-equivalent.
Host root on every LTS from 20.04 to 26.04, sudo never entered. Bonus: a free AppArmor hardening downgrade for the whole box.
Vendor: won't-fix.
starlabs.sg/blog/2026/06-old…
amon retweeted
hi guys here is universal account takeover for you to enjoy
This quoted post is unavailable.
amon retweeted
Over the next few months, we'll be gradually publishing some of our internal security research.
Starting with a bug chain that turns Nginx-Rift + Nginx-PoolSlip into full RCE.
More to come.
#Nginx #1day #RCE
blog.verichains.io/p/two-byt…
amon retweeted
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
amon retweeted
We're likely 1st to publicly exploit crypto: af_alg as a new attack surface in kernelCTF. Our members @n0psledbyte & @st424204 started poking it in Sep 2025, finding a 0-day container escape unnoticed since 2011. @AnthropicAI @OpenAI: interested in collaborations? We are all ears
amon retweeted
Patch your Linux boxes!
Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
Found by the teams at @theori_io and @xint_official
More details below
xint.io/blog/copy-fail-linux…
amon retweeted
Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.
github.com/Nightmare-Eclipse…
amon retweeted
I participated in DiceCTF 2026 Quals and found cornelslop, a kernel exploitation challenge, especially interesting. Here is my writeup🍣
ptr-yudai.hatenablog.com/ent…
amon retweeted
100k bounty for CVE-2025-11460 heap use after free . the poc is public now in the report below, i just grabbed the video from this report
[446722008][reward: $100000] heap-use-after-free in content::indexed_db::Database::connections_ when force_closing_ is true
crbug.com/446722008
amon retweeted
Modern iOS Security Features – A Deep Dive by Moritz Steffin and @naehrdine
arxiv.org/pdf/2510.09272
amon retweeted
A little morning research.
New React/Next.js CVE-2025-55183 Source code leakage PoC
Bypasses Cloudflare!
@FearsOff #react #bypass #cloudflare
amon retweeted
stop using ubuntu 24.04 to host your kernel pwn challenges lmao
kqx.io/post/qemu-nday/
amon retweeted
Made a pwn challenge for this year’s HITCON CTF, which required participants to bypass PAC, BTI, and deal with relative vtables. Here’s the write-up:
bruce30262.github.io/hitcon-…
Check it out if you're interested🙂
amon retweeted
Turns out my #PHRACK article is live! 🔥
> The Art of PHP — My CTF Journey and Untold Stories!
Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉
phrack.org/issues/72/5_md#ar…
amon retweeted
LLM skeptics (or LLM curious folks) should read through @theori_io 's blog walking through what our LLM agents accomplished in #AIxCC (in testing before the contest) theori.io/blog/exploring-tra… you can just read the traces directly, but this points out some of the most fun :)
amon retweeted
It's 8PM in Maine, it's officially the weekend, we've 85% of our philanthropist badges. These won't last long: shop.andnxor.com/collections…
amon retweeted
One of our current intern, @goatmilkkk shared his Chrome-atic escape adventure using CVE-2024-30088
Epic obstacles documented in it too!
starlabs.sg/blog/2025/07-foo…
amon retweeted
Apple’s Darwin OS and XNU Kernel Deep Dive tansanrao.com/blog/2025/04/x…