Dipendra Shrestha

Interested in web... CTF with Hack@Sec.

[Masato Kinugawa @kinugawamasato]

doc=new DOMParser().parseFromString(`
<select>
<button>
<noscript>
<selectedcontent></selectedcontent>
</noscript>
</button>
<option>
<style></noscript><img src=x onerror=alert()></style>
</option>
</select>`,'text/html');
document.write(doc.body.innerHTML);//🔥

[Taecii_🇳🇵 @writtenbycats]

like what’s even going on

[Ryan Naraine @ryanaraine]

Good lord 🤮

[GMO Flatt Security株式会社 @flatt_security]

セキュリティリサーチャー RyotaK @ryotkak の技術ブログを公開しました。

今回、Claude Code GitHub Actions の権限制御を外部の GitHub Issue 経由でバイパスし、ワークフロー権限を悪用できる脆弱性、並びにそれに付随する設定ミスを発見・報告しました。

当該の脆弱性は v1.0.94 で修正済みですが、設定ミスについては各リポジトリにて対応が必要であるため、当該製品を利用されている場合は設定の見直しと実行ログの確認を推奨します。

https://t.co/6hjfE6xrsb

[hashkitten @hash_kitten]

Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only!

https://t.co/v5LXrs5ORk

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Low Level @LowLevelTweets]

nah im just not gonna run npm install anymore

[Wiz @wiz_io]

We responsibly disclosed the issue to @GitHub, who deployed a fix on https://t.co/SvN2lGsnbO the same day (!) and released patches for all supported GHES versions.

GitHub Enterprise Server customers are strongly encouraged to update immediately.

[siunam @siunam321]

I started playing CTFs in 2022, and LLMs definitely changed the **competitive** CTF scene a lot, especially since mid-2025. I also started using LLMs in late 2025. Yes, those models did one-shot many challenges, but what's the fun of slopping them? I learned absolutely nothing 🥲

[Dipendra Shrestha @StructHack]

@DeSolti I feel ashamed to have studied in the same class as you. J ho tei dekhauda k bhayo? "timing this timing that".. Timro ghar ko kasailai kei bhako bhaye bujthyeu hola..

[Rebane @rebane2001]

i built an entire x86 CPU emulator in CSS (no javascript)

you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS

[sebsrt @s3bsrt]

I’ve been digging into HTTP Trailers and found some new smuggling techniques:
https://t.co/gpaIiYkSHs

[Nowasky @nowaskyjr]

Chrome implements referrerpolicy on <input type="image">, despite it not being in the HTML spec. Like on the in-spec elements, it takes precedence over the document policy for that request and can be abused to leak the page URL via the Referer header.

https://t.co/y2t4H4n43s

[Ark @arkark_]

Cross-Site ETag Length Leak
https://t.co/RYofmHVh6T

I just posted the author writeup for impossible-leak in SECCON CTF 14 Quals. As far as I know, this is a new XS-Leak technique! The ETag header can become a side channel :)

[Guillermo Rauch @rauchg]

https://t.co/b8rKtYZlB3

[Balen Shah @ShahBalen]

प्रिय Gen Z,
तपाईहरूको योगदान र बलिदानबाट देशले परिवर्तन पाएको छ।

वीर सहिदहरूप्रति हार्दिक श्रद्धाञ्जली। तपाईंहरूको योगदान अमूल्य छ, जसले सधैं भावी पुस्तालाई देशप्रेम र कर्तव्यबोधको मार्गदर्शन गर्नेछ। तपाईहरूप्रति असिम सम्मान।

घाइतेहरूको शीघ्र स्वास्थ्यलाभको कामना गर्दछु।

[Balen Shah @ShahBalen]

तेरो भरौटेहरूको पो बा भइस् ।

साँच्चै नै कहिले बा हुन पाएको भए पो छोरा छोरीको मृत्युको पीडा बुज्थिस ।

यस्तो आतङ्क वाद यो विश्वले कहिले देखेको थिएन ।

त नेता त के मान्छे पनि बन्न सकेनस, आतङ्क बादी होस ।

#kpoliisterriorist

[Orange Tsai 🍊 @orange_8361]

Turns out my #PHRACK article is live! 🔥

> The Art of PHP — My CTF Journey and Untold Stories!

Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉

https://t.co/BMCLlHti7q

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

https://t.co/SgsSyxoEMR

1/4

[Halvar Flake @halvarflake]

It is pretty interesting that as I age and geohot ages, I end up noticing that we agree on more things than I thought in the past.

This here is a good read:
https://t.co/1QU0oVlWbi -- it's