xchym (@xchym) header
xchym (@xchym) profile picture

xchym

@xchym

g4mm4 is my h3r0

Joined May 2010
  • Tweets68
  • Following483
  • Followers783
13Media
Photo by xchym (@xchym)Photo by xchym (@xchym)Photo by xchym (@xchym)Photo by xchym (@xchym)Photo by xchym (@xchym)Photo by xchym (@xchym)
Confirmed! Verichains Cyber Force chained two unique bugs - including an auth bypass - to exploit the Synology DS925+ and run code as root. Their work earns them $20,000 and 4 Master of Pwn points. #Pwn2Own
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
1
6
2
61
10,732
📦 Storage unlocked! Le Trong Phuc & Cao Ngoc Quy of Verichains Cyber Force just cracked the @Synology DS925+ at #Pwn2Own. A brief DNS issues delayed them, but they couldn't be stopped. They're off to the disclosure room to explain what they did. #P2OIreland
4
12
3,766
Verichains is glad to have helped unveil the root cause behind the largest Web3 hack—$1.4 billion on @Bybit_Official’s Multisig @Safe Wallet! This hack is a strong wake-up call as Web3 security isn’t just about on-chain transactions or smart contracts — it also relies on traditional Web2 components like private keys, frontends, backends, oracle data, etc — which are prone to exploitation & manipulation.
Ben Zhou (@benbybit) profile pictureBen Zhou
@benbybit26 Feb 2025
Bybit Hack Forensics Report As promised, here are the preliminary reports of the hack conducted by @sygnia_labs and @Verichains Screenshotted the conclusion and here is the link to the full report: docsend.com/view/s/rmdi832mp…
Image from Ben Zhou (@benbybit)
Image from Ben Zhou (@benbybit)
6
9
50
12,084
Verichains has released a new security advisory VSA-2022-120, exposing a key extraction vulnerability in Multichain's fastMPC. Kudos to @MultichainOrg for the swift response and bug bounty. Keep an eye out for upcoming advisories on critical attacks targeting popular MPC implementations. blog.verichains.io/p/vsa-202…
[VSA-2022-120] Multichain: Key Extraction Vulnerability in fastMPC's Secure Multi-Party Client...

[VSA-2022-120] Multichain: Key Extraction Vulnerability in fastMPC's Secure Multi-Party Client...

Since October 2022, Verichains has been conducting extensive research on threshold ECDSA security.

blog.verichains.io
15
1
26
8,618
We're really happy to share our improvements and some experiments for the CookieMonster tool. Weaponizing Monster for Cookies Attacks: vsrc.vng.com.vn/blog/weaponi… Also include burp-extender plugin for burp suite. Hope you guys enjoy it. ~Cheers, VSRC
Image from VNG Security Response Center (@vngsecresponse)
13
29
\o/
VNG Security Response Center (@vngsecresponse) profile pictureVNG Security Response Center@vngsecresponse6 Aug 2022
Ladies and Gentlemen: The new Dojo opens to welcome black belt Hackers to fight for honor!!! #VSRC Liferay revisited: A tale of 20k$. vsrc.vng.com.vn/blog/liferay… Hope you guys enjoy it and stay tuned for more technique writeups / blogs / exploits ... will come. ~Cheers, VSRC
Image from VNG Security Response Center (@vngsecresponse)
2
#OWASP subdomain Web Cache Poisoning Attacks lead to stored XSS :) youtu.be/pkCOsO9o-L4 This site is now closed ?!?
https://dsandbox.owasp.org

https://dsandbox.owasp.org

Web cache poisoning attacks lead to Stored XSS

youtube.com
1
3
10
My old presentation from Tradahacking7 Conference - bit.ly/2AiXmyl #26082018 #PracticalSubdomainTakeover #MerryXXXMas #DoggyNewYear

trada7-practical-subdomain-takeover-g4mm4.pdf

drive.google.com
1
9
32
Suddenly, I remembered my old shool hacking trick… maybe it is related to Server-Side RPO ;) #IIS5.x #Over15yearsBug #SSRPO
Image from xchym (@xchym)
Image from xchym (@xchym)
Image from xchym (@xchym)
Image from xchym (@xchym)
2
3
13
Fly with #Emirates ;)
2
17
#gsec #hitb #2017 #ctf #webblog #thelazyway youtu.be/xlu2rh-5wH4
#gsec #hitb #2017 #CTF #webblog

#gsec #hitb #2017 #CTF #webblog

#sqlmap #MyTamperScript #g4mm4ismyhero

youtube.com
1
3
8
Using my oldschool sqlmap tamper script to solve #simplesqlin #0ctf pastebin.com/yCAnv7eu
Image from xchym (@xchym)
7
Another way to solve #HackNo-Jam web challenge #codegate2016 #Achilles’heel #g4mm4_crawler =]]
Image from xchym (@xchym)
Image from xchym (@xchym)
1
12
#whitehatgrandprix "10kUSD_in_ca$h" CTF will be started shortly! Good luck to you guys all =] grandprix.whitehatvn.com/
1
#hacklu2015 #GradingBoard #writeup How to reuse LIMIT for extracting 5 chars/request or using \Nunion bypass as well
Image from xchym (@xchym)
Image from xchym (@xchym)
4
8
10K USD in cash!!! @vnsec long time no see teapawt.net/vnsec/status/653763334…
VNSECURITY (@vnsec) profile pictureVNSECURITY@vnsec13 Oct 2015
WhiteHat Grand Prix 2015 qualification round is coming next weekend, 1st prize for final round is 10k USD.... fb.me/4vkc3IuCt
2
#trendmicro #ctf #Misc300 Captcha re-riding attack + Race condition pastebin.com/89y8Eckm
Image from xchym (@xchym)
6
17
#CONFidence #Teaser #CTF #web300 by @DragonSectorCTF pastebin.com/EU8LcHsy #PHPoutput_buffering #oldtrick

g4mm4 is my h3r0 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
2
4
#bctf sqli_engine 200pts error-based sql injection via Duplicate entry method !!! pastebin.com/5exPuAFR
7
11
Not bad @LizardCircle! pls pm me your shipping address, I will reward you a selfie stick #google.com.vn #dns #oops :v
Load more