I have a crippling addiction hacking websites Sometimes participate in CTFs with @EmuExploit
Joined April 2020
- Tweets77
- Following192
- Followers448
- Likes334
ghostccamm retweeted
The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted!
portswigger.net/research/top…
ghostccamm retweeted
Here's lighttpd/1.4<>gunicorn Request smuggling N day writeup from m0lecon CTF 2025 0xsapra.gitbook.io/web/write…
ghostccamm retweeted
Part II: I found a bypass to Microsoft's fix using a Timing Attack to leak the Microsoft Event Registration database again! Here's the writeup: blog.faav.top/microsoft-even… #BugBounty #bugbountytips
I found another vulnerability to leak the Microsoft Events Registration and Waitlist databases, this could've leaked tons of PII. Here's the writeup: blog.faav.top/microsoft-even… #BugBounty #bugbountytips
After this, I found a bypass to Microsoft’s fix and will be releasing Part II in a few days.
We've published a new advisory regarding a circumstantial authentication bypass for the Beego framework. This vulnerability was reported in May, and after multiple follow-ups with no response, we have made the advisory public.
github.com/elttam/publicatio…
I will be presenting my research into ORMs at Black Hat EU this year!
In my talk I showcase that an ORM could leak more data than what you joined for and methods on how to exploit a vulnerable use case, without exploiting an SQLi.
#BHEU @BlackHatEvents
blackhat.com/eu-25/briefings…
ghostccamm retweeted
The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com/
ghostccamm retweeted
Sometimes, SQL injection is still possible, even when prepared statements are being used. Our researcher @hash_kitten has written up a blog post about a novel technique for SQL Injection in PDO’s prepared statements: slcyber.io/assetnote-securit…
i will be dropping my fattest track at 7:30pm this friday
this song will straight up give you cholesterol
register to DownUnderCTF now!
2025.duc.tf/
Less than 2 days to go! The clock never stops! ⌛
Registrations are now open at:
2025.duc.tf
Welcoming all skill levels! We can’t wait to show you what the team has cooked up this year! 🧑🍳
ghostccamm retweeted
New writeup:
Early last month, @samwcyo, @sshell_, and I found a Django ORM injection in an online shooter game that let us steal cryptocurrency from the game's wallet.
Read the blog post here:
blog.p1.gs/writeup/2025/07/0…
ghostccamm retweeted
Did you guess right? ONE month until DownUnderCTF 2025 kicks off and by now you should know what you’ll be doing this 18-20th July!
Join us! Share your interest here! ctftime.org/event/2669
ghostccamm retweeted
🔥 2025, we’re coming in HOT! 🔥 Block out July 18th-20th - it’s going to be an absolute explosion of fun! 🎉🚀
#CTF #DownUnderCTF
ALT DownUnderCTF 2025: coming 18th to 20th July.
ghostccamm retweeted
New blog post: New Method to Leverage Unsafe Reflection and Deserialisation and gain RCE on Rails elttam.com/blog/rails-sqlite…
ghostccamm retweeted
Congrats @toasterpwn winning the #Hexacon2024 CTF speed run yesterday. Great work by the @hexacon_fr team in organising it - it was great fun to watch!
It's a bummer I missed @BSidesCbr this year since I now live in Deutschland. But I was very happy to be part of the famous @cybearsCTF CTF. Thank you to everyone!
Btw, new ORM Leak payload for the beego web framework that bypasses allow listing prefixes gitlab.com/cybears/chals-202…
If you want to try out an info leak challenge without SQLi check out my other challenge gitlab.com/cybears/chals-202…
There are so many query logic bugs in the real world that are ripe for hacking.
ghostccamm retweeted
Cybears are getting ready to again awkwardly combine with the official BSides CBR theming! Join us on an epic quest to combine transformers, bears and LOTR into a fun CTF 🤣🤖🐻🏹⚔️ @BSidesCbr
ghostccamm retweeted
Quick Blog Post on ORM Leak Exploitation with SQLite3:
pentesterlab.com/blog/orm-le…
ghostccamm retweeted
We just released our first challenge on ORM Leak:
pentesterlab.com/exercises/o… !
Part 2 of our ORM Leak research about attacking insecure uses of the Prisma ORM.
We also do a deep dive into a methodology for constructing time-based attack for ORMs, using Prisma as an example and released a tool called plormber to assist with exploitation.
New blog post and tool release: plORMbing your Prisma ORM with Time-based Attacks
elttam.com/blog/plorming-you… and
github.com/elttam/plormber/
Thanks to everyone participating in @DownUnderCTF 5!
MC Fat Monke will be back again next year with hopefully a working headset youtube.com/watch?v=jmhn3IML…
(I might post some things on that channel at a later date)
