Breaking stuff, Security researcher @pixiepointsec | Pwn2Own Toronto 2023, Tokyo 2025, Ireland 2025
Joined August 2018
- Tweets69
- Following422
- Followers167
- Likes1.5K
Rafał Goryl retweeted
My very first blog post is live: kiddo-pwn.github.io/blog/202…
During research, I've run into and documented a simple universal SQLite Injection RCE trick. Enjoy!
N-day Analysis about Synology Beestation RCE (CVE-2024-50629~50631) by legendary DEVCORE 🎃 🍊
Thanks to @u1f383 @orange_8361 for original finding and allowing to post, and to @the_emmons for the invaluable references 🔥
Enjoy the Demo!
PoC: github.com/kiddo-pwn/CVE-202…
Rafał Goryl retweeted
Another successful collision: @_voix44er from PixiePoint Security succeeded in exploiting the Phillips Hue Bridge, but the bugs he used were collisions with a previous entry. He still earns $10,000 and 2 Master of Pwn points. #Pwn2Own
Rafał Goryl retweeted
And... hot on the heels will be @voix44er attempting the Philips Hue Bridge this week! All the best and have fun!
Rafał Goryl retweeted
If u think that Windows research is all we do, think again! In our first IOT blog, @voix44er details the Wolfbox EV charger setup, attack surface, his #Pwn2Own Automotive 2025 bug, exploitation, and best of all, displaying our name on it (in styleee...)!
pixiepointsecurity.com/blog/…
Rafał Goryl retweeted
[ZDI-25-329|CVE-2025-5750] (0Day) (Pwn2Own) WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8; Credit: Rafal Goryl of PixiePoint Security) zerodayinitiative.com/adviso…
Rafał Goryl retweeted
How China Is Building an Army of Hackers. With commentary from ZDI's Dustin Childs and footage from #Pwn2Own Automotive youtu.be/8kpnSb4yGR0?si=Jxoo… via @YouTube
Rafał Goryl retweeted
Proud to see @_jaelkoh (with @saidelike) talking about undocumented internals of KTM, the bugs and exploits in 'Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them'. No ovens required for this recipe!
Rafał Goryl retweeted
Confirmed (with a collision)! Rafal Goryl of PixiePoint Security used a 2 bug chain to exploit the WOLFBOX Level 2 EV Charger, but one of the bugs was previously known. He earns himself $18,750 and 3.75 Master of Pwn points. #P2OAuto
Rafał Goryl retweeted
Annnddd... the odds ARE in your favor! Congrats @voix44er ! This result is just the cherry on the cake. Regardless of what it may be, what we don't see is the dedication and hard work put into the research.. 💪💪💪
Rafał Goryl retweeted
Paged Out! Issue #5 is out now!
pagedout.institute/?page=iss…
Happy reading!
Please RT and tell your friends! :)
Rafał Goryl retweeted
[ZDI-24-839|CVE-2024-6248] (Pwn2Own) Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability (CVSS 7.5; Credit: Rafal Goryl) zerodayinitiative.com/adviso…
Rafał Goryl retweeted
The libarchive e8 vulnerability is actually really cool, but the ZDI advisory doesn't explain why it's so wild lol. For some reason, I know about RAR filters, so let me provide the background. 🧵 1/n
Rafał Goryl retweeted
#OffensiveCon24 videos are now up! youtube.com/playlist?list=PL…