@arkark_

Into experimental/deprecated features | CTF player | ex-traP

 __proto__
arkark.dev
Joined July 2015
  • Tweets4.6K
  • Following876
  • Followers2.5K
621Media
Cross-Site ETag Length Leak blog.arkark.dev/2025/12/26/e… I just posted the author writeup for impossible-leak in SECCON CTF 14 Quals. As far as I know, this is a new XS-Leak technique! The ETag header can become a side channel :)

Cross-Site ETag Length Leak | XS-Spin Blog

A novel XS-Leak technique that turns ETag length differences into a cross-site oracle via 431 errors and History API.

blog.arkark.dev
5
99
4
356
44,334
IERAE CTF 2026 - FINAL for Humans Round 1 (Web) has started! alpacahack.com/ctfs/ierae-fi…

IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

A platform for exploring cybersecurity through Capture The Flag

alpacahack.com
1
3
18
1,705
github.com/mde/ejs/commit/e2… data object経由でejsの挙動を書き換えるCTFテクニックがついにできなくなった？

Remove options-in-data (Express 2 compat) (breaking) · mde/ejs@e2c015b

Options are no longer read out of the data object. This was compatibility for Express 2, which handed the view engine locals and options in a single object; the test suite itself labeled it &qu...

github.com
9
1,144
CTFを終わらせてくれる人を待ってます >RT
9
1,275
IERAE CTF 2026 — FINAL for Humans #1 One Web challenge. A vanilla AI agent couldn't solve it in testing. AI is welcome. October 10 · 09:00 JST alpacahack.com/ctfs/ierae-fi…

IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

A platform for exploring cybersecurity through Capture The Flag

alpacahack.com
31
8
110
25,404
blog.nginx.org/blog/nginx-ro… nginxに、parser differential問に使いやすそうな見た目をしてる機能が追加されてる👀

NGINX Routing on HTTP Request Body

Note: Written by a human. In blog diagram graphic made by AI. NGINX processes HTTP requests in phases. Each phase is designed for specific actions and decisions on the qualities of the request....

blog.nginx.org
1
1
49
3,151
あまりにも抽象的なタイトルだから何も内容の言及ができない
413
報告してたFirefoxの脆弱性にCVE採番されました mozilla.org/en-US/security/a…
49
2,032
JavaScriptをパースしてASTの木構造を辿って評価するタイプのsandbox、厳密にはJSのsubsetではないのでJSだと認めたくはないけど比較的セキュア寄りな設計だと思う。少なくともproxyベースのsandboxよりは
5
616
JavaScript Sandbox Escape 1. github.com/nyariv/SandboxJS/… 2. github.com/nyariv/SandboxJS/…

Sandbox escape via assignment to __proto__ in scope variable records

### Summary A sandbox escape vulnerability due to a binding named `__proto__` replacing the prototype of the scope variable record. ### Details The three steps below chain a `__proto__` bi...

github.com
6
88
6,122
There are two solutions to this challenge. One lets you leak the full URL using pure CSS in Chrome 150+! Full write-up here: blog.voorivex.team/oauth-tok…
AmirMohammad Safari
@AmirMSafariAug 18
This page is part of an OAuth callback. Can you hijack the authorization code? 🧪 Try it live on pwnbox.io/challenges/purifie…
5
29
3
183
11,627
Order of the Sinking Star is releasing on October 8, 2026 on PC (Steam & Steam Deck), Nintendo Switch 2, and PlayStation 5! 🌟 🧩 Wishlist and follow today: bit.ly/OSS-Website 📜 Read more details: bit.ly/OSS-RDA-Blog
43
185
42
1,142
97,187
github.com/jailctf/challenge… この出題形式のpyjailに続編が来ると思わなかった。コラッツ数列🤔

challenges-2026/collatz/handout/main.py at master · jailctf/challenges-2026

challenges-2026. Contribute to jailctf/challenges-2026 development by creating an account on GitHub.

github.com
6
1,072
BABA IS YOUのボードゲーム気になる
4
707
AIがparser differentialを見つけるのがうますぎる
14
1,188
優勝すごい。おめでとうございます 🎉
5
901
Finally!! We won DEF CON CTF! I’m incredibly proud to have competed as a member of this amazing team. I’m grateful to my teammates for the incredible teamwork that made this experience so special. GG to all the competitors, and thank you to the organizers for an incredible event!
11
22
259
8,590
DEFCON CTF Finals優勝しました‼️ 10年以上参加してきて、初めての優勝です。 AIでCTFが終わるという言説は私も概ね賛同(少なくとも違う競技になる)していて、今年が本当に最後だろうなあと思っていたので感無量です。 とりあえず疲れた & 風邪引いたので寝ます！
5
62
2
471
22,248
DEF CON CTF優勝！めでたい！！！！
7
13
1
135
6,025
QuickJS github.com/quickjs-ng/quickj… この立場を明確化しているSecurity .mdが好き

GitHub

GitHub is where people build software. More than 225 million people use GitHub to discover, fork, and contribute to over 800 million projects.

github.com
10
1,712
セキュリティエンジニアの世界がAIで静かに終わりを迎えつつある。いま感じていることを話しました。
レバテックLAB（レバテックラボ）
@levtech_labAug 6
AIによって、これまでのハッキング競技や 「脆弱性を発見して報奨金をもらう」バグバウンティの文化は終わりを迎えつつある―― トッププレイヤーから見た「今起きていること」を率直に語っていただきました⏬
2
41
4
262
35,316
Load more