@_CryptoCat

Security Researcher @rapid7 😈 Hacking Content @ https://xitter.cf/t.co/U7jVhNr9sC 💜

 Not Here
cryptocat.me
Joined May 2016
  • Tweets8.3K
  • Following241
  • Followers9.1K
1.1KMedia
Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚 They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳
Ethical hacking resources

ALT Ethical hacking resources

28
329
5
1,253
132,538
She's a 4, but she's a private key for a intermediary CA.
18
286
12
3,892
43,514
In the middle of working on some @metasploit modules and @github banned my work account 🫠
1
204
Daybreak Blue just stopped working at the same time as all the other models stopped answering *anything* hacking related. When I go to @OpenAI cyber page it says my account is not eligible for individual access and to contact my org (old uni). Support are refusing any refund 💀
2
1
12
1,343
I'm seeing some other people post about Daybreak issues (maybe due to PHP RCE) so hoping my account error is just coincidence! 🤞
1
407
No refunds though, apparently 🤷‍♂️
ScamGPT

ALT ScamGPT

2
154
CryptoCat retweeted
Jorian
@J0R1AN9h
Everybody talking about php2shell, but wait 'till you hear about shell2php:
7
26
2
683
7,988
Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: youtube.com/watch?v=iWpykLFI…

Hacktics & Telemetry, E17: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. Lena Yu)

Episode 17 of Hacktics and Telemetry explores the evolving intersec...

youtube.com
4
9
2,875
Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑 cryptocat.me/blog/research/a…

User Registration & Membership Cross-Site Request Forgery to User Approval and Denial | CVE-2026-...

Root cause analysis of CVE-2026-92978 in User Registration & Membership, where the bulk Approve and Deny actions on the WordPress Users screen never checked a nonce, so any page a logged-in adminis...

cryptocat.me
13
628
How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE
3
5
151
4,239
CryptoCat retweeted
Traceix
@usetraceixOct 21
We’re shutting down too. We don’t use php I just don’t wanna work tomorrow.
MalShare@mal_shareOct 20
We are aware of the PHP vulnerability and are shutting down for the weekend.
79
2,255
94
35,039
512,214
CryptoCat retweeted
SinSinology
@SinSinologyOct 21
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com
49
259
29
1,837
156,991
CryptoCat retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
55
395
89
2,983
368,489
CryptoCat retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
238
27
715
153,061
CryptoCat retweeted
Kirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
273
1,806
682
16,046
3,615,776
Last Frappe post: GET CSRF in the bulk update endpoint, chained to RCE against a Website Manager. cryptocat.me/blog/research/a…

Frappe Bulk Update GET CSRF and a Browser-to-RCE Chain | CryptoCat's Blog

A GET CSRF in Frappe's bulk update endpoint lets one cross-site link change documents as a logged-in user, and against a Website Manager it chains into remote code execution.

cryptocat.me
10
589
Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: github.com/rapid7/metasploit…
1
5
22
1,798
Part 3/4 pwning Frappe / ERPNext: unpublishing a Frappe Web Form leaves its submission RPC live. A guest who knows the form name creates the backing document, permissions ignored 😬 cryptocat.me/blog/research/a…

Frappe Web Form Publication and Field Authorisation Failures | CryptoCat's Blog

How Frappe kept unpublished Web Forms alive through direct RPCs and trusted protected field values before a privileged document insert.

cryptocat.me
6
456
Part 2/4 pwning Frappe / ERPNext: a guest-triggered email embeds a file by path, the inline-image scanner reads it off disk, and /etc/passwd comes back 🙏 cryptocat.me/blog/research/a…

Frappe Unauthenticated Email Inline-Embed File Disclosure | CryptoCat's Blog

How Frappe let a Guest turn the stock account-deletion email into a local-file disclosure channel.

cryptocat.me
16
909
I have never seen a dog this big 😅
2
3
726
same bar, different dog 🐶
84
7 bugs, 0 CVEs 🥲 Here's part 1/4 of my pwning Frappe / ERPNext series 💥 cryptocat.me/blog/research/a…

Guest Stored XSS and Safe-Jinja File Write to RCE in Frappe and ERPNext | CryptoCat's Blog

An unauthenticated guest stores a script in a Frappe OAuth client name and chains it, through safe-Jinja file write or an ERPNext Genericode path traversal, into remote code execution.

cryptocat.me
6
40
1,352
Load more