legasi

-

[legasi @L3G4CY5]

@adne343

[legasi @L3G4CY5]

@adne343 ne pitaj sine 6:30am afteri

[legasi @L3G4CY5]

@LooseSecurity what a larp

[legasi @L3G4CY5]

@adne343 a ca c ca a c aa aa

[legasi @L3G4CY5]

@LooseSecurity dont give out the sauce bro..

[legasi @L3G4CY5]

@dreyand_ @GoogleVRP 💪🤫

[legasi @L3G4CY5]

@monkehack @Hacker0x01

[legasi @L3G4CY5]

@LooseSecurity @dreyand_ @zenith256 What's next, hacking cyberpanel? 🚔🥷

[Zenith @zenith256]

A gold medal, CISA acknowledged CVEs, and a pentest for Kanye West.

Meet Zenith auditor, @dreyand_.

From CTF beginnings to finding bugs in AT&T, Spotify, and the U.S. Department of Defense, let’s see what makes DreyAnd one of the best security researchers in the space.

[legasi @L3G4CY5]

@zenith256 @dreyand_

[legasi @L3G4CY5]

💪

[m0z @LooseSecurity]

Absolute pleasure working with @monkehack @busf4ctor and @L3G4CY5 on the AWS Tokyo LHE.

It was eye opening seeing all the cool bugs that got reported during the event and I was really proud to have played a small part in getting the most impactful bug in one of the targets! 💪

[legasi @L3G4CY5]

@LooseSecurity @monkehack @busf4ctor Was a pleasure too✌️

[m0z @LooseSecurity]

Absolute pleasure working with @monkehack @busf4ctor and @L3G4CY5 on the AWS Tokyo LHE.

It was eye opening seeing all the cool bugs that got reported during the event and I was really proud to have played a small part in getting the most impactful bug in one of the targets! 💪

[legasi @L3G4CY5]

@theXSSrat damnn, drop the sauce pls

[DreyAnd @dreyand_]

what is your fastest time to find a 0day?

To start off the year, here's a fun writeup on an Authentication Bypass in OpenFlagr <= 1.1.18 I found a few months ago during an audit for @zenith256 🎁

https://t.co/aJMzLmsFwh

feel free to use it as a way to measure yourself too :)

[m0z @LooseSecurity]

In case you didn't realize, referrerpolicy attributes take precedence over policies defined in meta tags or response headers.

That means with HTML injection you can always leak query parameters (so long as the CSP complies).

[legasi @L3G4CY5]

@LooseSecurity 😬 meetup soon

[legasi @L3G4CY5]

Stupid twitter making me pay to edit, here the client-side trick abused iframe reparenting to escape the sandbox

[legasi @L3G4CY5]

Forgot to post, I've authored a web challenge on QnQSecCTF that had 3 solves. It included a nice client-side trick that abuses iframe reparenting behaviour when it uses disk-cache instead of bfcache, it might be useful :)
https://t.co/HCI56iKG0s

[legasi @L3G4CY5]

@LooseSecurity ikr