@ndevtk

Still pretending to be a security researcher.

github.com/NDevTK
Joined September 2021
  • Tweets344
  • Following113
  • Followers1.3K
8Media
LOL, my YouTube account/channel got terminated, and all PoC videos are gone 😂
6
3
2
45
25,834
🔥Blog post is up! How extensions could exploit JS bindings to use webRequestBlocking prior to Chrome 118: 0x44.xyz/blog/web-request-bl…
17
49
5,118
Sandbox bypass "allow-downloads" (reward: $3000) crbug.com/1357366
2
11
2,249
I just published XSLeaker a tool that helps you to find potential #XSLeak vulnerabilities. github.com/Philesiv/XSLeaker

GitHub - Philesiv/XSLeaker: Searcher for cross-site leaks (XS-Leaks)

Searcher for cross-site leaks (XS-Leaks). Contribute to Philesiv/XSLeaker development by creating an account on GitHub.

github.com
1
49
1
188
Leaking window.length without opener reference. (reward: $2000) crbug.com/1305394
3
6
NDevTK retweeted
terjanq@terjanq6 Apr 2022
The soXSS challenge is over! The bug was simple but not widely known and can be found in the snippet below. Last chance to spot it! 🙃 We released the writeup in a public repo along with all the challenge sources and solutions: github.com/terjanq/same-orig… #javascript #bugbountytips
7
46
1
196
If browsers just turned off Visited Links, I wonder how many people would notice.
15
1
1
39
NDevTK retweeted
NDevTK@ndevtk20 Nov 2021
Replying to @WholesomeMeme
Thats a duck.
1
1
🎉🎉My first paper "XSinator.com: From a Formal Model to the Automatic Evaluation of Cross-Site Leaks in Web Browsers", recently got accepted at ACM CCS 2021 and now won best paper award! Find the paper and code at XSinator.com.
5
31
2
125
NDevTK retweeted
NDevTK@ndevtk29 Oct 2021
Replying to @ndevtk @terjanq @strellic
With help from @ginkoid
1
3
NDevTK retweeted
NDevTK@ndevtk29 Oct 2021
Replying to @terjanq
Congratulations to @strellic for solving the challenge the intended way. :)
1
2
1
2
NDevTK retweeted
NDevTK@ndevtk26 Oct 2021
Replying to @terjanq
Congratulations to @parrot409 for solving the challenge the intended way. :D
1
1
1
3
NDevTK retweeted
NDevTK@ndevtk26 Oct 2021
Replying to @terjanq
Congratulations to @matt_dyas for solving the challenge the intended way. :D
2
1
6
Security: crossOriginIsolated bypass (reward: $3000) crbug.com/1226909
1
6
Inspired and based on the current @terjanq & @ndevtk XSS challenge , i created another challenge for you! Enjoy! xss-challenge.ysamm.com #xss #xsschallenge #ctf
terjanq@terjanq8 Oct 2021
Together with @ndevtk we created a new XSS challenge! The trick is neat so better take your chances 💪. Could come very handy one day 🙃 so-xss.terjanq.me/ #xss #xsschallenge #ctf
4
21
1
82
NDevTK retweeted
NDevTK@ndevtk8 Oct 2021
Replying to @h43z @terjanq
utils.js is "Just for visuals."
1
1
1
NDevTK retweeted
terjanq@terjanq8 Oct 2021
Together with @ndevtk we created a new XSS challenge! The trick is neat so better take your chances 💪. Could come very handy one day 🙃 so-xss.terjanq.me/ #xss #xsschallenge #ctf
16
36
5
158
If you'd like to experiment with potentially breaking level of isolation, you can enable "strict origin isolation" in Chrome - chrome://flags/#strict-origin-isolation. If a site relies on document.domain, it is likely to break.
1
6
1
26
We are publishing the research of Copy&Paste issues in browsers by @SecurityMB. Over $30k in bounties for bugs in Chromium, Firefox, Safari, Google Docs, Gmail, TinyMCE, CKEditor, and others. Includes also 0-day in Froala. research.securitum.com/the-c…
2
338
6
743
Leaking private @Hacker0x01 reports via a HTTP/2-powered timing attack, by @tomvangoethem hackerone.com/reports/493176 youtube.com/watch?v=s5w4RG7-…

HackerOne disclosed on HackerOne: Partial report contents leakage -...

**Summary:** The concurrent handling of HTTP/2 streams allows for a "timeless timing attack": instead of timing, the ordering of responses is used, making the attack resilient to network jitter....

hackerone.com
3
48
2
175
Load more