╪ͥ͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͏͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋͋ ◯ ⃝ ⃝ ⃝ ⌨ ⁰☠ ☂ ☺ ♬
Milky Wayبٍٍٍٍََُُُِّّّْرٍٍٍٍَ
Joined April 2008
- Tweets4.3K
- Following245
- Followers3.1K
- Likes3.7K
Cheers to 11 years of AppSec Ezine! 🎉 Huge thanks to the security community for sharing and the supporters who made this journey possible. Here's to another year of knowledge-sharing! 🚀
572nd Edition: pathonproject.com/zb/?871f09…
Repo: github.com/Simpsonpt/AppSecE…
#AppSec #Security
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
thanks to everyone who attended my #TheSAS2025 talk "Typographic hit job: when fonts pull the trigger". 🙏
I've written an accompanying blogpost that goes over all the details: haxx.in/posts/2025-09-23-can…
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
If you want to learn how to construct epic payloads like this? You need JavaScript for Hackers.
Requires this hash:
#<img/src/onerror=alert(1)>
amazon.com/JavaScript-hacker…
ALT <svg/onload=innerHTML=URL,innerHTML=textContent> #<img/src/onerror=alert(1)>
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
pagedout.institute/ ← we've just released Paged Out! zine Issue #7
pagedout.institute/download/… ← direct link
lulu.com/search?page=1&pageS… ← prints for zine collectors
pagedout.institute/download/… ← issue wallpaper
Enjoy!
Please please please RT to spread the news - thank you!
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
ChatControl wants to scan all your private messages metalhearf.fr/posts/chatcont…
尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ retweeted
So… I was hacked. Pwned. Big time. And I’m not kidding.
It turned out to be the very same malware used in massive DDoS campaigns against DeepSeek and Twitter (erm… X).
It was RapperBot... I was angry with me and with the malware. Honestly, more with me than with the malware.
This is my story of how I dove deep into its guts, from infrastructure mapping to binary analysis, and what I uncovered along the way.
Buckle up and grab some IOCs:
bitsight.com/blog/rapperbot-…