@insertscript@infosec.exchange # https://xitter.cf/t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53
Joined June 2012
- Tweets2.1K
- Following217
- Followers6.7K
- Likes13.5K
alex retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
alex retweeted
There we go
wiz.io/blog/php2shell-php-rc…
When you like DNS related shenanigans, this is fun to check for yourself.
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC
blog.alice.poc.debiru.net/
1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。
（参考）
検証用URL blog.alice.poc.debiru.net/
FAKEサーバー debiru.static.jp/
TRUEサーバー blog.bob.poc.debiru.net/
@zhero___ zeroday.cloud/2026-competiti… has Next.js as a target ;-)
alex retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.
alex retweeted
We are going to be at DEF CON!
If you want to learn fault injection hands-on, make sure to bring your laptop.
alex retweeted
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀
github.com/WICG/declarative-…
ALT https://yeswehack.github.io/Dom-Explorer/shared?id=e7b1b80d-8bd8-4643-bab0-de6898d7b35b
alex retweeted
If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post:
blog.voorivex.team/content-t…
oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^
+{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}
alex retweeted
I co-authored an educational article on cache poisoning vulnerabilities with @intigriti.
If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!
Most hunters skip web cache poisoning because it looks intimidating... 😓
But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠
In our latest article, we walk you through identifying cache layers, spotting unkeyed inputs, and chaining them into real impact! 😎
This time, we teamed up with Zhero (@zhero___) who is well-known for his research around cache poisoning vulnerabilities! 💪
Read the article now!👇
intigriti.com/researchers/bl…
alex retweeted
DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
github.com/cure53/DOMPurify/…
alex retweeted
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):
Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js
zhero-web-sec.github.io/rese…
Damn, what a read
StubZero: $148,337 RCE in Google Cloud Production
brutecat.com/articles/google…
I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D
alex retweeted
FFFF the axios thing is bad, almost all node.js project use it, we use it.
didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao
built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway.
CHECK YOUR IMAGES.
github.com/hacktronai/cull
Well I learned a lot trying to solve this challenge.
But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)
Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image
Again just a quick JS PoC (nothing new, just some PoC to try it):
JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused.
insert-script.com/examples/j…