xss0r Deploying an alert box in a web app is like having a tiny pop-up comedian shout 'Surprise!' whenever you least expect it! #xss0r #ibrahimXSS #Blindxss0r
Joined December 2020
- Tweets1.3K
- Following3.1K
- Followers6.9K
- Likes1.4K
xss0r retweeted
. @msftsecresponse " On average MSRC took 54 days — nearly two months — to tell us a report was a duplicate." +
@secbughunter I wonder why it took you so long just to decide that this is a duplicate. This needs improvement. To me, “duplicate” means that you already had a report from someone else, which should have made the decision quick. Honestly, this feels seriously bad.
xss0r retweeted
Unauthenticated RCE chain in Plex:
$500 bounty
Writeup: zmain.info/blog/plex2shell
PoC: github.com/code-zm/plex2shel…
Patch your servers!
romanzipp.com/blog/shopify-h…
🚨 Bug bounty hunters: Shopify needs more security researchers looking at checkout flows.
Recent reports of checkout hijacking across Shopify apps show why we need to pay closer attention to the entire checkout chain — app integrations, injected JavaScript, custom scripts, API responses, and payment redirects.
🔎 Look for:
• Checkout manipulation & unauthorized redirects
• XSS in app widgets and storefront extensions
• Broken access control in Shopify apps
• Insecure custom JavaScript configurations
• Payment-flow logic flaws
• Account takeover paths affecting merchants
• Sensitive data exposure
Focus on authorized bug bounty scopes, reproduce findings safely, and never access real customers’ payment data.
Shopify security deserves more eyes. Find the flaws before attackers do. 🔥
#BugBounty #Shopify #AppSec #WebSecurity #CyberSecurity
1
512
xss0r retweeted
This was quite a ride :) I'm incredibly proud of XBOW's Native Team for their work on this, and looking forward to sharing details on the chain once we're able to!
xss0r retweeted
Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( 🤯
blog.faav.net/how-i-couldve-…
Great find by @efaav, a talented 15 y.o. researcher!
xss0r retweeted
This is the extension I used.
What it has:
Tracing Dom sink through stack trace. Dom heuristics and dictionary, static page scan, JavaScript scan, postmessage test.
I named it "Elecktrode trusted type crash 2.0.0" it used chrome manifest V3 (MV3)
I will release it today.
xss0r retweeted
Claude is leaking your data to the US government and CIA. Here is the proof.
I looked inside the Claude Code binary bundled with Claude Desktop on my Mac. Found these 5 .gov strings:
c2s.ic. gov
api. aws.ic. gov
sc2s.sgov. gov
csp.hci.ic .gov
api .aws.hci.ic .gov
C2S is tied to AWS cloud for the US intelligence community. In the official Amazon announcement, the CIA CIO discusses its use at the TOP SECRET level.
You can check your own installation.
Mine is Claude Desktop 2.26454.2, bundled Claude Code 2.1.293. These strings appear in the AWS region definitions, under dnsSuffix and dualStackDnsSuffix.
WHAT THE FUCK ???!!!!
Run the check that's in the replies on macOS. See what YOUR copy contains.
Readers added context they thought people might want to know
These .gov strings are standard AWS SDK endpoint definitions for US IC/government cloud partitions (C2S etc.), present in any app using AWS region configs or clients; they do not prove data leakage by Claude.
raw.githubusercontent.com/aws/aws-sdk-js…
aws.amazon.com/blogs/publicse…
aws.amazon.com/blogs/machine-…
xss0r retweeted
43 hackers detected
All using AI 🤖
Many of them are APT hackers. Full threat intelligence in our app.
xss0r retweeted
Researchers can now earn up to $60,000 USD for qualifying critical vulnerabilities through the updated Microsoft Dynamics 365 and Power Platform Bug Bounty Program.
Key updates include:
➤ Up to $60,000 USD in awards for qualifying critical vulnerabilities
➤ New cross-tenant award multipliers for select scenarios
➤ More granular severity and impact-based award categories
We continue to evolve our bounty programs to reward impactful research and provide greater transparency into how submissions are evaluated.
Learn more: msft.it/6013ab10b
xss0r retweeted
Another 0-Click ATO in Meta's AI Systems!
I recently discovered a critical vulnerability in @Muse leading to a 0-Click Full Account Takeover (ATO) on @facebook, @instagram & @Meta.
This places me in the Top 5 on Meta's Bug Bounty Leaderboard.
Thanks to the @metabugbounty Team.
xss0r retweeted
Done. I canceled Claude Max 20x.
$200/month for tiny, unpredictable limits is absurd. I’m done rationing usage instead of shipping.
I’m moving to Codex - and my entire dev team is moving with me.
Anthropic lost a paying user and an entire team. 💀
@AnthropicAI @DarioAmodei
ALT Claude Max 20x subscription canceled after repeated usage limits made the $200 plan impractical for serious development work.
xss0r retweeted
I had Claude Console CVP approved(api) , but my Claude.ai CVP has been pending for 3 weeks now. This basically wasted my full $200 Max subscription this month.
While waiting, I tried using the Claude Console (API) instead — and one 4-hour session cost me about $125! My Max 20x plan at $200/month is far cheaper than paying per-use through the API.
So between the unused subscription and API costs, I've spent around $300 this month. Really hope Anthropic resolves this soon. @ClaudeDev @cjav_dev
xss0r retweeted
Jangan pernah remehin "useless" bug. Self-XSS yang biasanya diketawain (karena butuh interaksi user) aja bisa berubah jadi bounty $15.000 (Zoom).
Kuncinya adalah, chaining.
Gue nemu case di mana attacker gabungin Self-XSS sama OAuth. Gini skenarionya:
1. Korban klik link malicious (XSS jalan di domain A).
2. XSS ini kirim postMessage ke domain B (trusted domain).
3. Domain B nerima message, terus trigger OAuth login ke Zoom.
4. Pas korban login, Authorization Code-nya malah dibajak sama XSS di domain B.
5. Attacker dapet Access Token.
Hasilnya? Attacker ambil alih total, curi data, sampe bisa nyalain kamera & mic korban.
Satu bug remeh kalo digabung sama celah lain bisa jadi exploit yang mematikan.
xss0r retweeted
I haven't posted a crazy XSS vector for a while...
Works on every browser
![<alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>](https://pbs.twimg.com/media/HNx0WfkWMAAFJqL.jpg?name=orig)
ALT <alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>
xss0r retweeted
I got permanently banned from @Hacker0x01. Account deleted. No explanation.
Years of work gone overnight. Submission history, achievements, leaderboard ranks, every contribution I made to the security and crypto ecosystems through HackerOne. Wiped, like I was never there.
