@insertscript@infosec.exchange # https://teapaw.org/t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53
Joined June 2012
- Tweets2.1K
- Following217
- Followers6.7K
- Likes13.5K
alex retweeted
Scalable Vector Grief
Bypassing 6 SVG sanitizer to run JavaScript in Firefox even when the response body is completely harmless XML.
By @garethheyes
portswigger.net/research/sca…
and awesome research 2/2
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
What a morning - two awesome researchs to read. 1/2
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
alex retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: teapaw.org/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
alex retweeted
There we go
wiz.io/blog/php2shell-php-rc…
When you like DNS related shenanigans, this is fun to check for yourself.
Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC
blog.alice.poc.debiru.net/
1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。
（参考）
検証用URL blog.alice.poc.debiru.net/
FAKEサーバー debiru.static.jp/
TRUEサーバー blog.bob.poc.debiru.net/
@zhero___ zeroday.cloud/2026-competiti… has Next.js as a target ;-)
alex retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.
alex retweeted
We are going to be at DEF CON!
If you want to learn fault injection hands-on, make sure to bring your laptop.
alex retweeted
This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀
github.com/WICG/declarative-…
ALT https://yeswehack.github.io/Dom-Explorer/shared?id=e7b1b80d-8bd8-4643-bab0-de6898d7b35b
alex retweeted
If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post:
blog.voorivex.team/content-t…
oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^
+{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}
alex retweeted
I co-authored an educational article on cache poisoning vulnerabilities with @intigriti.
If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!
Most hunters skip web cache poisoning because it looks intimidating... 😓
But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠
In our latest article, we walk you through identifying cache layers, spotting unkeyed inputs, and chaining them into real impact! 😎
This time, we teamed up with Zhero (@zhero___) who is well-known for his research around cache poisoning vulnerabilities! 💪
Read the article now!👇
intigriti.com/researchers/bl…
alex retweeted
DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
github.com/cure53/DOMPurify/…
alex retweeted
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):
Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js
zhero-web-sec.github.io/rese…
Damn, what a read
StubZero: $148,337 RCE in Google Cloud Production
brutecat.com/articles/google…
I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D
alex retweeted
FFFF the axios thing is bad, almost all node.js project use it, we use it.
didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao
built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway.
CHECK YOUR IMAGES.
github.com/hacktronai/cull