@rafabyte_

Security Researcher https://xitter.cf/t.co/1SOxGFQMNm

 BR
rafa.hashnode.dev/
Joined August 2023
  • Tweets46
  • Following134
  • Followers949
4Media
check out my latest research (Exploiting HTTP Parsers Inconsistencies): rafa.hashnode.dev/exploiting…
3
35
113
10,806
Lesson from building a hackbot with @rafabyte_: Don’t use non-Daybreak models on Codex for security work. They won’t refuse you. They’ll quietly do something dumb, skip what you asked for, and never mention it.
8
2
1
51
4,876
I've mostly adapted to bug bounty's new rules in the AI era. But one thing still bothers me, and it's out of my hands: The growing distance between companies and researchers. Responses take forever and are often inaccurate. The whole experience has become frustrating.
2
12
556
Fortunately, they saw my message, and the status was reverted. Almost lost my 7.0 signal after 174 valid bugs because of this😵‍💫
rafa@rafabyte_Sep 14
> Submit a report to a public program > They move your report to a private program, where you don't have access to it > You cannot view their policy because you don't have access > They close it as N/A because, according to their policy, user clicks count as social engineering 👍
7
612
> Submit a report to a public program > They move your report to a private program, where you don't have access to it > You cannot view their policy because you don't have access > They close it as N/A because, according to their policy, user clicks count as social engineering 👍
1
2
1
21
2,421
Before claude/codex, I used to find DOM XSS in main apps that weren't necessarily all that complex, yet only a few people managed to spot them just by reading the code. But now it seems those DOM XSS have vanished, and the only ones I'm finding now are extremely complex chains.
1
4
63
5,330
But thanks to AI, I can find these complex chain bugs in the same amount of time it used to take me to pop the less complex ones.
10
569
I'm addicted to lock picking. If you're looking for a hobby away from the computer that requires a learning curve, I recommend it
1
16
722
I'm happy to share that I've been invited to H1-030 HackerOne Live Hacking Event in Berlin, Germany 🇩🇪 🔥 A huge thanks to @Hacker0x01 for the invitation and for organizing these incredible events.
8
643
Just as I'm about to catch a flight to LHE, I discover that some keys on my built-in keyboard have a hardware issue 🫠
1
3
935
Mesmo sendo um MCP remoto tem que tomar cuidado, já que o servidor pode injetar instruções no contexto da I.A. E como geral usa `--dangerously-skip-permissions`, isso pode facilmente virar RCE.
Vitor Falcão "busfactor"
@busf4ctorJul 14
Muito massa, até tenho um projeto meu parecido. Só tem um problema aqui que o @rafabyte_ lembrou: você instala um MCP closed-source deles, o que significa que se eles quiserem, eles tem um RCE no seu PC :)
1
3
7
1,614
It has been a while since it happened, but it's something I wanted to share. Earlier this year, I was invited by HackerOne to participate in the H1-361 Live Hacking Event in Bali, Indonesia 🔥 Where I found High and Critical vulnerabilities ;) #bugbounty
1
24
1,945
rafa retweeted
Jorian
@J0R1ANJul 3
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declarative-…
https://yeswehack.github.io/Dom-Explorer/shared?id=e7b1b80d-8bd8-4643-bab0-de6898d7b35b

ALT https://yeswehack.github.io/Dom-Explorer/shared?id=e7b1b80d-8bd8-4643-bab0-de6898d7b35b

5
27
1
134
16,353
We’re excited to announce the top 3 winners from H1-361 Bali 🌴🏆 Huge congrats to these incredible security researchers for an unforgettable live hacking event: 🥇 1st Place — @nahuelrm_ 🥈 2nd Place — @zere 🥉 3rd Place — @joaxcar Thanks to everyone who joined us in Bali and helped make this event a great week of collaboration and community. #TogetherWeHitHarder
6
13
2
156
18,425
Made a small and fun research about a technique to leak iframe contents, check this out: blog.bugport.net/auxclickjac…

AuxClickjacking

In this small and fun research, I will show how I developed a Clickjacking technique that leaks iframe contents by prompting the user to perform a click and drag + middle mouse button (wheel) click....

blog.bugport.net
1
11
1
73
7,032
Things you must read to slowly step up your client-side game AuxClickjacking by @rafabyte_: blog.bugport.net/auxclickjac…

AuxClickjacking

In this small and fun research, I will show how I developed a Clickjacking technique that leaks iframe contents by prompting the user to perform a click and drag + middle mouse button (wheel) click....

blog.bugport.net
19
1
101
6,218
Had an awesome time hacking alongsite @busf4ctor and @monkehack at the H1-3120 Live Hacking Event in Amsterdam by @Hacker0x01, partnered with Salesforce!
19
1,877
Amsterdam brought the 🔥! @salesforce + #H13120 = one incredible Live Hacking Event 🇳🇱 Security researchers tackled AI challenges head-on—finding vulnerabilities, sharing insights, and shaping the future of secure innovation. #HackForGood #AISecurity #TogetherWeHitHarder
8
8
2
114
12,775
If you ever need help with a bug, you can always count on our community! 🫂
4
31
2,832
I’m very pleased to share that I was invited by @Hacker0x01 to participate in the Live Hacking Event H1-468 in Sweden, with all expenses covered under the Platform Performer recognition!
8
2
128
7,050
Unbelievable exploitation journey documented in a thread in the # critical-thinkers on the CTBB discord. Shout out to @rafabyte_ for finding the solution, and @TomAnthonySEO for doing WORK. Assists: @joaxcar, Balint, @J0R1AN, @kevin_mizu @7urb01, and yours truly, among others.
2
9
1
113
10,201
Load more