Fredrik N. Almroth (@almroot) header
Fredrik N. Almroth (@almroot) profile picture

Fredrik N. Almroth

@almroot

Co-Founder & Security Researcher at @detectify. I code things to hack stuff. PGP/MIT: 0xEDF8D9828B06A7F7 #shellpopper

 Sweden
detectify.com/
Joined November 2011
  • Tweets917
  • Following660
  • Followers3.5K
28Media
Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)Photo by Fredrik N. Almroth (@almroot)
Replying to @timhwang @samhouston
This expression to validate prime numbers: ^1?$|^(11+?)\1+$ See: noulakaz.net/2007/03/18/a-re…
3
8
1,441
Replying to @LinusLarsson
youtu.be/RjbkAECbDBE
Everybody Chromercise

Everybody Chromercise

Fingers tired and achy after a long day browsing online? Chromercis...

youtube.com
96
Fredrik N. Almroth retweeted
HackingForSoju (@HackingForSoju) profile picture
HackingForSoju@HackingForSoju6 Apr 2023
🇸🇪Midnight Sun CTF is back for it's 6th straight year! Registration is open here: midnightsunctf.com/ 🏆Qualifiers will run from 08 April, 2023 11:00 UTC -- 09 April, 2023 11:00 UTC 🥇On-site finals are on 18 August. As always check ctftime.org for details
Image from HackingForSoju (@HackingForSoju)
5
21
4,054
Replying to @d0nutptr
So it was you all along! smh
1
218
Replying to @_tsuro @cffsmith
http://__whois__.au
1
Replying to @TomNomNom
My condolences
1
OpenSSL 3.0.7 is out. TL&DR: Punycode issue with international domains used in certs. Needs CA to sign malicious cert. Doesn't look like a "huge deal" IMHO. Relax.. Patch.. Repeat... #openssl
3
96
5
218
Replying to @zonduu1
vbscript:msgbox%201 in ancient IE? ¯\_(ツ)_/¯
Fredrik N. Almroth retweeted
SEC-T (@SEC_T_org) profile picture
SEC-T@SEC_T_org18 Sep 2022
Recording of “JavaScript Prototype Poisoning, an unexplored bug-class, and it’s everywhere“ by Christoffer Jerkeby & Anton Linné is up: youtube.com/watch?v=VSZCyTsI… youtube.com/watch?v=VSZCyTsI…
9
21
Fredrik N. Almroth retweeted
STÖK ✌️ (@stokfredrik) profile picture
STÖK ✌️
@stokfredrik19 Sep 2022
How to turn bugs into a "passive" income stream! ft @detectify’s @almroot youtu.be/oHhofSj9lEM #cybersecurity #bugbounty
Image from STÖK ✌️ (@stokfredrik)
3
35
126
Replying to @alkalinesec @iximeow
@alkalinesec @BlueSpaceCanary @iximeow
Image from Fredrik N. Almroth (@almroot)
Fredrik N. Almroth retweeted
Frans Rosén (@fransrosen) profile picture
Frans Rosén@fransrosen2 Aug 2022
I was finally able to disclose one of the examples from my last blog post labs.detectify.com/2022/07/0… Here's the PoC-movie from the report to Reddit:
publiclyDisclosed (@disclosedh1) profile picturepubliclyDisclosed@disclosedh12 Aug 2022
Reddit disclosed a bug submitted by fransrosen: hackerone.com/reports/156718… - Bounty: $10,000 #hackerone #bugbounty
Image from publiclyDisclosed (@disclosedh1)
11
103
3
416
Replying to @TomNomNom
Good luck and godspeed! :D
2
Fredrik N. Almroth retweeted
Frans Rosén (@fransrosen) profile picture
Frans Rosén@fransrosen6 Jul 2022
I decided to make a homage-post to @homakov and @Nirgoldshlager about different OAuth-token leakage methods I've been researching – ten years after their blog posts that inspired me to start hunt for bugs ♥️ thank you. labs.detectify.com/2022/07/0…
Account hijacking using "dirty dancing" in sign-in OAuth-flows

Account hijacking using "dirty dancing" in sign-in OAuth-flows

Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens...

labs.detectify.com
20
370
12
970
Fredrik N. Almroth retweeted
STÖK ✌️ (@stokfredrik) profile picture
STÖK ✌️
@stokfredrik25 Apr 2022
Had a great conversation about @detectify ‘s crowdsource program with @almroot today in the studio. Def a interesting way of creating a passive income flow, submit a finding, preferably unauth, get it verified and get paid every time it hits / fires on any of their customers!
2
2
1
26
Fredrik N. Almroth retweeted
shubs (@infosec_au) profile picture
shubs
@infosec_au8 Apr 2022
Bypassing CDN WAF’s with Alternate Domain Routing blog.ryanjarv.sh/2022/03/16/…
11
108
4
316
Replying to @SSkylinearafat @DC3VDP
almroot@x:~$ nsupdate > server <ip-of-target-ns> > update add takeover.<target.com> 60 A 1.3.3.7 > send
Replying to @martenmickos
Tack ska du ha!
1
Replying to @stokfredrik
Snyggt jobbat! Grattis!
2
Fredrik N. Almroth retweeted
James Kettle (@albinowax) profile picture
James Kettle
@albinowax21 Jan 2022
Just three days remaining to cast your vote for the top 10 hacking techniques of 2021! Massive thanks to everyone who has already taken part; more voters means higher quality results. portswigger.net/polls/top-10…
Top 10 web hacking techniques of 2021

Top 10 web hacking techniques of 2021

Welcome to the community vote for the Top 10 Web Hacking Techniques of 2021.

portswigger.net
3
25
106
Load more