lexi <img src=x onerror=alert(1)>

not around here anymore lol. previous statements may not represent me correctly anymore

[lexi <img src=x onerror=alert(1)> @1lexxi]

@vxunderground i stopped researching github security a while ago due to bad treatment, but https://t.co/O30TVvqkyq was one of my favorite targets. it had so many bugs. would love to talk more about them but theyre holding tens of thousands of advertised bounties hostage in mediation cases 🥲

[lexi <img src=x onerror=alert(1)> @1lexxi]

@frostb1ten @msftsecresponse @Microsoft best part still was when i made a disgruntled post without details & suddenly they were on a first name basis with me despite never having used that name in a professional context because the nice people at M$ even stalk your twitter when they scam you 🥰

[lexi <img src=x onerror=alert(1)> @1lexxi]

@frostb1ten @msftsecresponse never got a single cent from them, in fact even made a slight loss. i was young and stupid. seasoned researchers know that the only reasonable way to handle @Microsoft disclosures is full disclosure. ill never forgive them for even demanding a meeting while i was on vacation...

[lexi <img src=x onerror=alert(1)> @1lexxi]

@dm4uz3 @zoemaestra everyone is lowkey sleeping on the paw hand

[lexi <img src=x onerror=alert(1)> @1lexxi]

@ghidraninja @kbeckmann 2

[lexi <img src=x onerror=alert(1)> @1lexxi]

@HSVSphere hello. vaguepost queen here. you are even more right than you know

[lexi <img src=x onerror=alert(1)> @1lexxi]

@averageun1x hey wait a second

[lexi <img src=x onerror=alert(1)> @1lexxi]

@_JohnHammond @OepnAI i love how this abuses the vuln i reported to twitter back in 2022 (!!!!) that they refuse to fix

https://t.co/6LpuvGuH1M

[lexi <img src=x onerror=alert(1)> @1lexxi]

hey, this vuln seems familiar!

this has actually been a thing for over two years now.

how do i know? its been almost two years since i reported the exact same vulnerability to twitter's hackerone 🙃

twitter's security & bug bounty program is laughably bad, a thread

[lexi <img src=x onerror=alert(1)> @1lexxi]

@tcntad1 @ReflectiveRuby2 @codeHusky > ssl

[lexi <img src=x onerror=alert(1)> @1lexxi]

@mugundhanbalaji @HaifeiLi they're often the same! i found a fun one recently that allowed running an arbitrary file without args, and exploited it by getting a username leak, opening the default web browser to a page with content-disposition, and then called open(`C:/Users/${user}/Downloads/pwn.exe`) lol

[lexi <img src=x onerror=alert(1)> @1lexxi]

@crackticker @andourys @lexi_2nd @Steam they hate u frfr

[lexi <img src=x onerror=alert(1)> @1lexxi]

@crackticker @andourys @lexi_2nd GLS 😇

[lexi <img src=x onerror=alert(1)> @1lexxi]

@crackticker @andourys @lexi_2nd shippingmogged

[lexi <img src=x onerror=alert(1)> @1lexxi]

@crackticker @andourys @lexi_2nd how it feels being gabens favorite child:

[lexi <img src=x onerror=alert(1)> @1lexxi]

@rez0__ as someone with an embarrassingly high number of reports to them: theyre massive scammers, that number checks out. and even if you do get paid, they straight up lie in their bounty table and pay 10% of what they promise despite agreeing on the vuln type after waiting months 🫠

[lexi <img src=x onerror=alert(1)> @1lexxi]

@ControlPanelFT @Marko_met_een_K can you please add a menu like in minecraft cheats for the options that would be much better

[lexi <img src=x onerror=alert(1)> @1lexxi]

https://t.co/tRygu9sqxG

[lexi <img src=x onerror=alert(1)> @1lexxi]

@hrkrshnn dont report shit to the github bug bounty, they're massive scammers. they openly break their bounty table promises and regularly close issues explicitly listed in the scope with bounties as informative, and they stealth fix those

[lexi <img src=x onerror=alert(1)> @1lexxi]

@meowkoteeq i love the gen1 steam controller dearly but that thing did NOT have swappable batteries, once they were in they were never coming out again LMFAO