Adam Langley

Ethical Hacker & Fullstack Dev | Helping thousands learn to hack ethically & build secure apps | CTO @hackinghub_io | Director @bsidesexeter

[Adam Langley @BuildHackSecure]

@apiratemoo yup same here, not one for confrontation.

[Adam Langley @BuildHackSecure]

This PHP vulnerability has been refreshing. It’s exposed just how many high-follower-count cybersecurity “experts” can’t distinguish between an insecure language and insecure code written in that language.

A large following clearly doesn't guarantee technical competence.

[Adam Langley @BuildHackSecure]

@apiratemoo Just be humble with stuff, don't try and put people down and you're all good.

[Adam Langley @BuildHackSecure]

@apiratemoo As soon as I spotted jQuery versions from years ago I knew I was onto something.

[Adam Langley @BuildHackSecure]

When a software company is dunking on PHP on LinkedIn and you find XSS within 5 minutes of looking at their website....

[Adam Langley @BuildHackSecure]

Spamming apt update like it's a CTF about to start!

[Adam Langley @BuildHackSecure]

@Akshanshjaiswl @y_sodha haha, all the writeups might be quite similar!

[Adam Langley @BuildHackSecure]

At least I don't have 300+ docker security labs written in PHP.... Oh wait....

[Adam Langley @BuildHackSecure]

@njcve_ @Random_Robbie Ditto haha

[Tom Stacey @t0xodile]

Turbo Intruder 2 has landed! You can now surpass 100,000 RPS over WiFi using the new HTTP/3 engine, test HTTP/3 exclusive targets with the Burp adapter, and deploy new research-grade race condition techniques! Check out the post below for full details:

[Adam Langley @BuildHackSecure]

@apiratemoo So sorry for your loss ❤️

[Adam Langley @BuildHackSecure]

@njcve_ Yeah I imagine you've got to be on the important list for that 😢 Not sure what triggered for me, I had it in a loop building some labs and got like 15 out of 40 in and then it refused to do any more. Must hit some kind of internal limit for security related input.

[Adam Langley @BuildHackSecure]

@njcve_ Ah okay, I was doing loads of security stuff ( not offensive ) with GPT 6 and after a few hours it suddenly started telling me I needed daybreak, uploaded verification and got it straight away. Annoyingly it uses 5.6 and now not getting the results that 6 was giving me.

[Adam Langley @BuildHackSecure]

@njcve_ Gonna assume Red as I got blue within a couple of minutes.

[Adam Langley @BuildHackSecure]

@njcve_ Red or blue?

[Luke Stephens (hakluke) @hakluke]

People who say PHP is insecure are uninformed, and I'll happily have a healthy debate in the replies.

The reputation comes from the 90s and early 2000s, when PHP powered most of the web and security was an afterthought everywhere. People who cut their teeth hacking those sites still feel the flinch when they see PHP.

Modern PHP ships with secure primitives out of the box, like prepared statements via PDO and built-in password hashing. Frameworks like Laravel go further and escape output by default. And these days you often can't tell a site is running PHP at all, most frameworks route away from the .php extension now.

Before you throw a jab at a language, framework, or any technology, try testing it first. Then let's have a wholesome argument.

[Ben Sadeghipour @NahamSec]

Are you guys ready for this year's @BugBountyDEFCON?

[Adam Langley @BuildHackSecure]

@stokfredrik