Spryzen

Into the World of Cybersecurity and IT

[Spryzen @Spryzen150537]

@srong805 @Phong_Zed @Mcnugget_1403 These Gooks are totally brainless 😂, all they talk is about nonsense, unrelated to the main topic here, just try to assult the Viets for nothing. Did your doctor tell your mom about your brain retarded disorder when you first born ?

[Spryzen @Spryzen150537]

@Pcu48 @mjiesociu @SmallKorean6767 Any other words 😂 ? I though the Kors are the nice and thoughtful people, maybe i was wrong. You people are a bunch of craps and arrogant as hell

[Spryzen @Spryzen150537]

@srong805 @Phong_Zed @Mcnugget_1403 Btw dont tell me about money or worth or income, such an useless and shitty argument. I mean my monthly income could buy your whole family for sure, your piece of shit 😂

[Spryzen @Spryzen150537]

@srong805 @Phong_Zed @Mcnugget_1403 Then why Krafton have to ban 2 best players globally just from a “for-fun” tournament 😂 ? Definately they scaring shitless from the Vietnamese players, we are always on the top and beat the shit out of Korean players. That’s what they have to do, banning our player, what a move

[Spryzen @Spryzen150537]

@thaswoon @Mcnugget_1403 What about the Rule where the tournament requires every player have to turn on their facecam during the match, does the Korean team did that respectfully ? Dont tell me about the rules if your team didnt even do them properly

[Spryzen @Spryzen150537]

@Sensoopp A marketing masterclass from Krafton 💀, unbelivable. The CEO even use ChatGPT to try to withhold 250k from Unknown Worlds

[Spryzen @Spryzen150537]

Doing some bug hunting in my free time on campus 👀

My capstone project is nearly done so now there’s some time for me to play a bit with some new bounty programs here

[Spryzen @Spryzen150537]

What you see here is a simple pipeline, where the backend server calls the mcp server via normal http (ofc with a secret header). The MCP server then will call the tool, which is a retrieval tool in the RAG system return the vector search from the given query

[Spryzen @Spryzen150537]

Wiring up the servers right now...Took me long enough 😊

Have learnt so much since the last post...now i already know about RAG system and MCP servers, and how the MCP server can connect to the backend server for tool calls. Will continue update on this one

[Spryzen @Spryzen150537]

Mcp servers, a cool thing to work with if you are building a project with AI, especially multi-agent workflow orchestration. Python is an easy-to-go choice to build a simple mcp server

[Spryzen @Spryzen150537]

I will be off for more than 3-4 months now to finish this stuff before my graduation :D

[Spryzen @Spryzen150537]

Been doing capstone project for my uni (this will be my last year at uni) several months lately so i cannot do my pet project right now. Been learning a lot of new stuff from the capstone, from setting up envs like a pro, to learning AI stuff like RAG system or multi-agent

[Spryzen @Spryzen150537]

@criss5701067360 Yes im using docker compose rn, it is really useful for seperated services. Using React for frontend and FastAPI for backend rn, a pretty basic setup

[Spryzen @Spryzen150537]

Back to work today. Setting up a quick docker file to start both server concurrently, avoiding hellish manual start and make everything looks more professional 👀, I’m also pretty new to Docker so I will be happy to receive advices from you guys.

Follow for more

[Spryzen @Spryzen150537]

Btw, GitKeeper is back online now, just have a quick fix this afternoon. I’m not coding much these days as my big concentration rn is about learning bug bounty…

[Spryzen @Spryzen150537]

Been learned quite a lot about Burp Suite & bug hunting. I started to testing common vulns like XSS, IDORs and BACs - these are the top vulns that bug bounty hunters usually aim for. I also learned and did a lot of recon, which is painful as recon tools rn is kinda old fashioned

[Spryzen @Spryzen150537]

Im having an idea to develop a new tool that will automates the api discovering process, as i found this is long and tired as hell. The purpose of this tool is to detect the main API url, find all available endpoints and how can they get called (POST, GET, DELETE, etc.)

[Spryzen @Spryzen150537]

@sahill_og Sure dude, and good luck for paying a bunch of money for those AI agents 😂. And technically, you can learn all of these stuff in just a few days

[Spryzen @Spryzen150537]

@EvanKlein338226 Sometimes we just forgot to put the protection on 😂

[Spryzen @Spryzen150537]

Good evening

Today i try to pentest my own webapp for detecting vulns and i got this potential DoS vuln. For some reason (maybe im too dumb or lazy), an api endpoint, which is critical in doing heavy, concurrent task, does not require auth header 😭.

[Spryzen @Spryzen150537]

Playing with Burp Suite today and test it on one of my friends CRUD app. Someone is stupid enough to left a chat api endpoint in public without proper auth header 😭. Remember folks, use middleware for all api routes that belongs to user action, not system action

[Spryzen @Spryzen150537]

Okay, i just found out that all of my endpoints are not protected by the api rate limiter. Because of this, i will temporary shut down the server for hot fixes

[Spryzen @Spryzen150537]

This means that i can spam/hammering the endpoint without being blocked by 401s or 403. Furthermore, it seems like the api rate limiter didnt take action, it didnt lock request, send 429s or something like that. I will figure this out