Tanner Barnes

I build security tools and sometimes do some hacking. Always compress then encrypt ;)

[Tanner Barnes @_StaticFlow_]

Tool master list: will update as I build new things!

[Tanner Barnes @_StaticFlow_]

@xssdoctor @ctbbpodcast For sure, but are there things you’re looking for as prerequisites to chain with CSPT? In the XSS case it seems the thought process is: I found a spot in the app that can render raw html, how do I get my html in there, oh cool there’s a CSPT gadget. Can CSPT alone achieve XSS?

[Tanner Barnes @_StaticFlow_]

@xssdoctor @ctbbpodcast Yea it’s a lot to fit into a tweet unfortunately. https://t.co/4P2NscqqXh. This part of the doc where you explain a potential vuln, it seems to assume anyone can view the attachment you uploaded. I get the bug class of CSPT just fuzzy on when it’s useful.

[Tanner Barnes @_StaticFlow_]

@moyix @evilsocket Has that been successful 👀👀

[Tanner Barnes @_StaticFlow_]

@evilsocket @moyix I was wondering the other day whether you could use a loop like this to find a kernel LPE by putting the agent in a low privilege environment and asking it to not stop till it can read flag.txt in the root folder

[Tanner Barnes @_StaticFlow_]

@0xTib3rius @HackingLZ @kuzushi What’s the latency??

[Tanner Barnes @_StaticFlow_]

@thedawgyg Also there’s no place in America currently where you’re allowed to vote without proof of ID. There’s just 12 states where you don’t have to bring that ID with you. Those 12 still require proof of ID to register to vote. The people in power just don’t want folks voting in general.

[Tanner Barnes @_StaticFlow_]

@thedawgyg Yea, interestingly I see it from the opposite side. Why are so many people in power making this big a deal over a problem with an incident rate of 0.007%? If you crack open the laws proposed, like the safe act, their sole purpose is to make it harder for _anyone_ to vote.

[Tanner Barnes @_StaticFlow_]

@thedawgyg And that’s just presidential election years. If you count midterm voting the total goes to like 2.2 billion and the amount of voter fraud goes to 0.0072%.

[Tanner Barnes @_StaticFlow_]

@thedawgyg I don’t think there’s any data to support voter fraud is an issue at all.
All Votes for pres: https://t.co/akVU8uPRzS : ~1.4 Billion. Heritage Fdn’s sample of all voter fraud data (‘82-‘25): https://t.co/zTM6Hccw5w 1620. (1620*100k)/1.4B ~= 0.01%
That’s if their sample is 1/100k

[Tanner Barnes @_StaticFlow_]

@rez0__ It’s more “high fantasy” classic dungeon crawl vs tech themed. There’s many more class-species combos. I like the visuals better. There’s a “standard” win path and an “extended” game if you are feeling brave.

[Tanner Barnes @_StaticFlow_]

Want to come work with me building AppSec tooling to help keep the many brands at Match Group secure? Apply here! https://t.co/VGbgLUz4Bf

[Tanner Barnes @_StaticFlow_]

Would anyone be interested in a hardware hacking stream? I have a device I've been playing with recently that I just made some big progress on and thought others might find it interesting!

[Tanner Barnes @_StaticFlow_]

@DanielLockyer The web app for https://t.co/5y0YdvB0E4 is really slow when there’s lots of matches for a query. Was gonna take a swing at fixing it but you might find it easier to solve than I

[Allie ✞ @allie__voss]

If anyone is writing wedding thank yous or any other type of thank yous, no advice will ever beat Lemony Snicket's:

[Tanner Barnes @_StaticFlow_]

@CristiVlad25 @NotebookLM What if the room you’re videoing in is just covered in prompt injections

[Tanner Barnes @_StaticFlow_]

Anyone gonna be at defcon this year bringing a hardware hacking setup? I’ve got a device I’ve been tinkering with but I am thus far unsuccessful in extracting the firmware. Would be fun to jam on it live at the con!

[Simon Willison @simonw]

The is diabolical... a Python object that hallucinates method implementations on demand any time you call them, using my LLM Python library https://t.co/z2fHhirW9z

[Tanner Barnes @_StaticFlow_]

@CristiVlad25 My guess is you're going to have to solve this at the hardware level. Phone/DSLR vendors are going to have to include TPM chips that sign the bytes from the camera sensor. Couple that with an attestation service which can verify the signature and then trust no unsigned content.