alex @insertScript

@[email protected] # https://t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53 Joined June 2012

Tweets

2K
Followers

7K
Following

217
Likes

13K

alex @insertScript

2 weeks ago

@zhero___ zeroday.cloud/2026-competiti… has Next.js as a target ;-)

1 3 11 1K 10

View Details

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

351 1K 12K 2.8M 6K

View Details

alex @insertScript

2 months ago

@rebane2001 uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.

1 0 0 570 0

View Details

LiveOverflow 🔴 hextree.io @LiveOverflow

2 months ago

We are going to be at DEF CON! If you want to learn fault injection hands-on, make sure to bring your laptop.

3 32 356 21K 81

View Details

alex @insertScript

3 months ago

@J0R1AN this is perfect - I needed that for a test case I always wanted to try^^

0 0 2 713 0

View Details

Jorian @J0R1AN

3 months ago

This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declarati…

5 27 134 16K 67

View Details

AmirMohammad Safari @AmirMSafari

3 months ago

If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post: blog.voorivex.team/content-type-o…

AmirMohammad Safari @AmirMSafari

4 months ago

Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.io/challenges/mim…

9 15 176 26K 79

6 41 226 21K 146

View Details

alex @insertScript

3 months ago

@garethheyes oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^ +{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}

0 0 9 394 1

View Details

zhero; @zhero___

3 months ago

I co-authored an educational article on cache poisoning vulnerabilities with @intigriti. If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!

Intigriti @intigriti

3 months ago

Most hunters skip web cache poisoning because it looks intimidating... 😓 But a single misconfigured cache layer can regularly turn into critical findings, even on heavily tested targets! 🤠 In our latest article, we walk you through identifying cache layers, spotting unkeyed

3 63 350 54K 328

7 32 253 16K 110

View Details

Masato Kinugawa @kinugawamasato

4 months ago

DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた github.com/cure53/DOMPuri…

1 41 180 14K 158

View Details

zhero; @zhero___

4 months ago

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____): Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js zhero-web-sec.github.io/research-and-t…

6 66 357 24K 210

View Details

alex @insertScript

5 months ago

Damn, what a read

skull @brutecat

5 months ago

StubZero: $148,337 RCE in Google Cloud Production brutecat.com/articles/googl…

14 174 779 93K 442

0 0 3 1K 3

View Details

alex @insertScript

5 months ago

@magicmac2000 I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D

1 0 1 284 0

View Details

s1r1us @S1r1u5_

6 months ago

FFFF the axios thing is bad, almost all node.js project use it, we use it. didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway. CHECK YOUR IMAGES. github.com/hacktronai/cull

4 11 78 15K 48

View Details

alex @insertScript

6 months ago

@AmirMSafari Well I learned a lot trying to solve this challenge. But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)

0 0 3 360 0

View Details

alex @insertScript

6 months ago

@shhnjk Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image

1 0 3 274 0

View Details

alex @insertScript

7 months ago

Again just a quick JS PoC (nothing new, just some PoC to try it): JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused. insert-script.com/examples/javas…

0 1 9 894 6

View Details

Nadim Kobeissi @kaepora

7 months ago

Your chance to be part of a historic event for cryptography education in the Levant is still open! The CFP for Cedarcrypt, the most ambitious and exciting cryptography event in the Levant region in recent memory, has a deadline of April 10 and we still have room in the program. If you've been meaning to submit a talk, workshop, or research presentation, now's the time. We want hands-on workshops, lectures on both foundational and real-world topics, and research talks including work in progress. Topics range from post-quantum crypto and ZK proofs to secure implementation and protocol verification. We're also still actively seeking sponsors. Sponsorship funds student stipends directly — it's how we make the event accessible to grad students and early-career researchers worldwide. If your organization is in this space, let's talk. Accepted speakers get travel support, free registration, and accommodation help. July 13–16, Paphos, Cyprus. Join us in making a real difference in how real-world cryptography is taught in the Levant! Come meet and engage with excited new students! cedarcrypt.org

0 5 15 2K 0

View Details

alex @insertScript

7 months ago

@rebane2001 The only solutions I can think of: Overwrite the prototypes - Number or Object use document.all as the one exception. Afaik no symbols are utilized sadly for this operator.