@s3bsrt

I like to break stuff | Web Vuln Research & CTF @ARESxCTF @aboutblankets

 Italy
sebsrt.xyz
Joined February 2022
  • Tweets71
  • Following570
  • Followers772
4Media
Pinned Tweet
sebsrt@s3bsrtFeb 13
I’ve been digging into HTTP Trailers and found some new smuggling techniques: sebsrt.xyz/blog/trailing-dan…

Trailing Danger: exploring HTTP Trailer parsing discrepancies

Trailing Danger: exploring HTTP Trailer parsing discrepancies

sebsrt.xyz
4
107
4
426
43,000
With @hash_kitten, we've been looking into Cloudflare's /cdn-cgi/image endpoint and managed to get an XSS :D To achieve this, we used what I believe to be a new CSP bypass involving the Cache-Control response header, combined with a sanitizer bypass! I hope you'll enjoy it! 👇
Assetnote
@assetnote2h
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed. You can read more here: slcyber.io/research/cache-me…
5
29
106
2,959
XSS from a response header 🤯 Firefox will load an XSLT stylesheet from a data: URL in a Link header. Combined with a harmless XML body and you get JS running in the page origin. Plus Safari importing GIFs as SVG and more sanitizer bypasses
2
25
1
104
5,539
sebsrt retweeted
Xclow3n@xclow3nOct 25
Spent this year on HTTP request smuggling. Four mechanisms, ten products. All of them reuse a connection whose previous request was never finished. Turning reuse off takes the crossings to zero and fixes nothing. Reuse isn't the defect. xclow3n.com/post/smuggling-s…
1
9
1
59
2,673
CTF has finally become a contest between Korean meat proxies just to see which team has the bigger wallet and can burn more tokens with their pay2win strats
12
25
5
385
26,088
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
344
4,175
1,254
18,597
7,072,136
Bro emudhra.we-have-a-problem.co…
2
2
7
2,878
A 12 year-old race condition to object injection and RCE, preauth in some configurations, I found in DokuWiki (CVE-2026-113356). gist.github.com/sebastianosr…

DokuWiki RCE - file r/w race condition to object injection

DokuWiki RCE - file r/w race condition to object injection - report.md

gist.github.com
1
16
87
6,082
sebsrt retweeted
Codean@CodeanIOOct 9
We released our latest blogpost covering the details of some bugs that @b0n0b0__ presented during Romhack Camp (hosted by @cybersaiyanIT). They'll publish the video of the talk and the slides, make sure to check all that out and stay tuned for part two! codeanlabs.com/2026/10/break…

Breaking GNOME: the core - Codean Labs

codeanlabs.com
5
2
15
2,940
We're back, analyzing CVE-2026-21589 - an Arbitrary File Read vulnerability in Atlassian Jira, Confluence, BitBucket and more... Enjoy! labs.watchtowr.com/you-wont-…

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary...

Welcome back to yet another episode of "security was taken seriously". Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we...

labs.watchtowr.com
2
73
6
209
18,933
sebsrt retweeted
HAHWUL
@hahwulSep 6
GORI v0.5.0 is out 🎉 - Cookie workbench: decode / verify / crack / forge Flask, Rack, Django session cookies - Retest: diff two projects at endpoint scale - CVSS v3.1 & v4.0 on issues, SARIF export - gRPC schema from descriptor sets or server reflection - Pipe bytes through your own command Plus a long tail of very specific things — per-send TLS fingerprints, WebSocket-over-h2 replay, SOCKS5H. Hack from the terminal. github.com/hahwul/gori/relea…
🤖 Made with AI
1
2
1
15
1,219
🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX tantosec.com/blog/2026/09/te… The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.

From Padding Oracle to Shell: RCE in Telerik UI for ASP.NET AJAX

How a sacrificial block turned a decrypt-only padding oracle into a forgery, and the forgery into unauthenticated RCE.

tantosec.com
1
59
5
181
32,119
I've published UniBLEed, a fully wormable proximity Bluetooth RCE affecting Unitree's G1 humanoids. Blog spans cloud, mobile, firmware, Bluetooth & hardware. Two multi-bug RCE chains. 3 months into ~80 minutes, $6,700 in bounties. Go jailbreak your G1s!! boschko.ca/g1-ble-rce/

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the...

boschko.ca
9
84
10
226
24,352
sebsrt retweeted
elttam@elttamAug 14
New blog post: Ruby 4.0 Universal RCE Deserialization Gadget Chain elttam.com/blog/ruby-4-0-uni…

Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

elttam.com
3
30
2
81
11,027
This came from an interesting experiment. I gave Opus 4.8 my original Cookieless DuoDrop article and asked it to find a bypass. It found one. 🤔 Makes me wonder how many older security fixes are worth revisiting with modern AI-assisted research.
Soroush Dalili
@irsdlAug 11
A URL-encoded ASP .NET Cookieless marker could partially bypass the CVE-2023-36899 fix and cross IIS application boundaries.

Cookieless DuoDrop Was Back: A Partial CVE-2023-36899 Patch Bypass

Article · @irsdl
1
3
25
2,601
sebsrt retweeted
Tom Stacey@t0xodileAug 12
portswigger.net/research/crl…

CRLF-Powered Desync Attacks: Beheading HTTP Streams

Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power

portswigger.net
2
23
563
sebsrt retweeted
Assetnote
@assetnoteJul 14
Our research team discovered a critical pre-authentication RCE inside ServiceNow by bypassing their scripting sandbox (CVE-2026-6875). You can read more here: slcyber.io/research-center/s…

Smashing the ServiceNow Sandbox – Pre Authentication RCE

Searchlight Cyber researchers discover a second pre-auth RCE in ServiceNow (CVE-2026-6875) by escaping the script sandbox via a JavaScript gadget chain, allowing full instance compromise without...

slcyber.io
1
46
149
10,936
sebsrt retweeted
Calif
@calif_ioJul 1
MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. blog.calif.io/p/mad-bugs-my-…
2
18
4
71
27,441
mhackeroni is going to Vegas! We qualified for the eighth time to the DEF CON CTF Finals - top 12 in the world. We're putting together our 2026 sponsors: backing Italy's leading ethical hacking team is a unique opportunity. Want in? Let's talk: [email protected] #infosec #CTF
12
1
34
1,181
sebsrt retweeted
Calif
@calif_ioJun 18
We sent Claude Mythos Preview spelunking through Squid’s guts, and it surfaced clutching a 29-year-old bug. Meet Squidbleed: a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration. Full story: blog.calif.io/p/squidbleed-c…
6
90
5
335
66,470
Load more