Rohit Narayanan M

Cybersecurity enthusiast | AI student | CTF player - @teambi0s

[teambi0s @teambi0s]

bi0s CTF 2025 has ended!

Huge props to the top 3 teams:
🥇@r3kapig
🥈@ProjectSEKAIctf
🥉@thehackerscrew1

Also, big hats off to the top 10 teams and everyone else who participated 🔥

Huge thanks once again to @osec_io for sponsoring this edition! ❤️

[teambi0s @teambi0s]

registrations are open!
https://t.co/TmyDME0rT8

[teambi0s @teambi0s]

free? play bi0s CTF next weekend

[teambi0s @teambi0s]

Team bi0s continues to grow, pushing the limits of cybersecurity.
In 2024, we reported many more CVEs, brought back InCTFj - inspiring the next generation of hackers, and much more!
Read our Year in Review to know more: https://t.co/NEv88JwU0g

[alfin @alfinjose_]

I’ve always liked DOM Clobbering & client-side issues. Different browsers needed different payloads consisting of different tags and attributes, so I built ClobberX to make payload generation easier!

🔗Check it out: https://t.co/FMjFz708Tw

Would love to hear your feedback!

[zhero; @zhero___]

very pleased to announce the release of my new article based on my research that led to CVE-2024-46982 titled:

Next.js, cache, and chains: the stale elixir

https://t.co/UFndJxNYLI

note: does not cover the latest findings shared in my recent posts

enjoy reading;

[Nithin Chenthur Prabhu @Azr43lKn1ght]

Introducing DFIR Labs: A 24-challenge series by internationally acclaimed CTF authors, tailored for professionals, researchers and students. Master DFIR, Malware Analysis and Threat Hunting through challenges designed to push your expertise to new heights
https://t.co/6lgoxMDt8f

[Srijiith | k1R4 @justk1R4]

Last month I authored a pwn challenge for ICC 2024. It's a calculator with a JIT compiler. The exploit is quite different from a typical challenge. Here's the writeup for it:
https://t.co/W1pNnMwW2e

[Winters @ArunKr1shnan]

I discovered a high severity bug in https://t.co/qQyGTnzeoy by leveraging a pythonic quirk.
Assigned CVE-2024-8550(CVSS-7.5).
Thanks to my mentors @teambi0s
and people at @huntr_ai.

Report: https://t.co/gXkI8d5P2l

[Winters @ArunKr1shnan]

Got my first CVE(CVE-2024-8143), Huge thanks to all my mentors at @teambi0s and all the people at @huntr_ai 🙂.
Report: https://t.co/1pIZwKRpIP.

[daniel @hackermondev]

1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
https://t.co/8pkfFsXRWR

[xyzeva @xyz3va]

gaining access to anyones browser without them even visiting a website (CVE-2024-45489)

https://t.co/Junay0CCNv

[Rebane @rebane2001]

new blogpost time!!

this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty

lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:

have fun!
https://t.co/64ZAIVHoSO

[James Kettle @albinowax]

The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here ->
https://t.co/cBRLNpOZ6y

[RyotaK @ryotkak]

I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.

This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.

https://t.co/puM7hZWIlE

[Adhithya Suresh Kumar @amun_rha]

I wrote a blogpost and a tool on how to abuse Vectored Exception Handling (VEH) along with indirect syscalls to produce legitimate call stack without manually constructing them.

Blog Link: https://t.co/zLCtetcPaY
Tool Link: https://t.co/AHdJgZB99O

[Nithin Chenthur Prabhu @Azr43lKn1ght]

Delve into Windows Forensics! Investigate crucial artefacts, expose obscured data and master techniques for in-depth investigations and sophisticated windows Incident Response! Fourth post in the Malware Development, Analysis, and DFIR Series

https://t.co/N7oPPcTMxs

#DFIR

[Sonar Research @Sonar_Research]

🔥 XSS on any website with missing charset information? 😳

Attackers may leverage the ISO-2022-JP character encoding to inject arbitrary JavaScript code into a website. Read more in our latest blog post:

https://t.co/Ji3V0fK5b6

#appsec #security #vulnerability

[Suraj Kumar @the_m3chanic_]

Made a writeup for the challenge lost-canary from UIUCTF last weekend. Decided to go a little more in-depth this time with some reversing and pwn concepts, check it out!

https://t.co/r90puegRJw

#cybersecurity #pwn #reverse

[Orange Tsai 🍊 @orange_8361]

PHP just fixed one of my RCE vulnerabilities, which affects XAMPP by default. Check to see if you are affected and update now! 🔥
https://t.co/EQdzNTihOm