alex (@insertScript) header
alex (@insertScript) profile picture

@insertscript@infosec.exchange # https://teapaw.org/t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53

Joined June 2012
Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)Photo by alex (@insertScript)
and awesome research 2/2
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed. You can read more here: slcyber.io/research/cache-me…
196
alex retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: teapaw.org/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
55
407
93
3,088
396,041
When you like DNS related shenanigans, this is fun to check for yourself.
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC blog.alice.poc.debiru.net/ 1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。 (参考) 検証用URL blog.alice.poc.debiru.net/ FAKEサーバー debiru.static.jp/ TRUEサーバー blog.bob.poc.debiru.net/
5
1,370
alex retweeted
On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
353
1,382
548
11,806
2,824,898
We are going to be at DEF CON! If you want to learn fault injection hands-on, make sure to bring your laptop.
3
32
2
354
21,495
alex retweeted
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declarative-…
5
27
1
134
16,376
If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post: blog.voorivex.team/content-t…
Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.io/challenges/mimic-2
6
41
2
226
21,714
alex retweeted
I co-authored an educational article on cache poisoning vulnerabilities with @intigriti. If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!
Most hunters skip web cache poisoning because it looks intimidating... 😓 But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠 In our latest article, we walk you through identifying cache layers, spotting unkeyed inputs, and chaining them into real impact! 😎 This time, we teamed up with Zhero (@zhero___) who is well-known for his research around cache poisoning vulnerabilities! 💪 Read the article now!👇 intigriti.com/researchers/bl…
7
32
1
253
16,071
DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。 特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた github.com/cure53/DOMPurify/…
1
41
2
179
13,979
alex retweeted
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____): Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js zhero-web-sec.github.io/rese…
6
66
3
356
23,841
alex retweeted
FFFF the axios thing is bad, almost all node.js project use it, we use it. didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway. CHECK YOUR IMAGES. github.com/hacktronai/cull
4
11
1
78
15,231
Again just a quick JS PoC (nothing new, just some PoC to try it): JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused. insert-script.com/examples/j…
1
9
899
Your chance to be part of a historic event for cryptography education in the Levant is still open! The CFP for Cedarcrypt, the most ambitious and exciting cryptography event in the Levant region in recent memory, has a deadline of April 10 and we still have room in the program. If you've been meaning to submit a talk, workshop, or research presentation, now's the time. We want hands-on workshops, lectures on both foundational and real-world topics, and research talks including work in progress. Topics range from post-quantum crypto and ZK proofs to secure implementation and protocol verification. We're also still actively seeking sponsors. Sponsorship funds student stipends directly — it's how we make the event accessible to grad students and early-career researchers worldwide. If your organization is in this space, let's talk. Accepted speakers get travel support, free registration, and accommodation help. July 13–16, Paphos, Cyprus. Join us in making a real difference in how real-world cryptography is taught in the Levant! Come meet and engage with excited new students! cedarcrypt.org
5
15
2,302
We take a closer look at the 2nd exploit, and sit down with @_manfp to learn about his research process. youtube.com/watch?v=NT1VCmJF…
6
66
390
20,917
Thanks for participating in this challenge! I analyzed the qs parser source code and wrote about the inconsistency between the backend and frontend query parsers, along with two possible solutions. Hope you enjoy it! blog.voorivex.team/when-two-…
Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.xyz
14
29
3
181
16,252
Chrome auto decodes all url-encoded, non-special characters in the URL for the user. This can be annoying when you're trying to sneak a payload in that looks a little weird. You can bypass this by adding %ff anywhere in the URL.
5
39
1
386
16,330