caon

[caon @_caon__]

@zeroc00i @0xPira club penguin mentioned!!!!

[caon @_caon__]

@arthurair_es Inspiração!! Parabéns pela trajetória, que venham muitos os LHEs e oportunidades ano que vem :)

[Alex Moshkov @amoshkov]

Not even in Brazil yet, and the @BugBountyBr guys already gave me such a warm welcome 😁

@highustavo @zeroc00i @locs3c @_caon__ — thanks for the live, guys. That was insanely genuine!

[Alex Moshkov @amoshkov]

🟥 Positive Hack Talks → São Paulo 🇧🇷
Dec 10th, 2025

🗣️ Speakers — submit papers (flights/hotel covered). CFP link in thread 👇
💻 Cybersecurity community — join our most community-driven event.

➡️ https://t.co/dLTF5ZhE7Z
Free · 8 talks · limited spots

#PHTalks

[caon @_caon__]

@oestagiarioplus feito

[caon @_caon__]

Ótima oportunidade para a comunidade!

🚨 LHE – Mercado Livre Hacking Event 2025 🚨

🗓 25/10 a 01/11
Escopo ampliado, desafios, bounties e premiações exclusivas!

Inscreva-se: https://t.co/vYWaFcOyNB

[caon @_caon__]

@gui_scombatti @0xTeles @arthurair_es pf não me coloque em uma saia justa kkk

[caon @_caon__]

@gui_scombatti @0xTeles @arthurair_es Somente para os ambassadors fazerem o corre e compartilhar! Todos são bem vindos!!!!!

[caon @_caon__]

@sw33tLie The library used in the trackpad balance app comes to mind, maybe it has the capabilities to implement your idea
https://t.co/2TF0b5oOyF

[Bug Bounty Village Brazil @BugBountyBr]

🚨 CALL 4 PAPERS — Bug Bounty Village @ H2HC 2025 🚨

Caçou um bug insano? Tem case real ou técnica nova? Esse é seu palco!

Envie sua proposta pelo form:
https://t.co/vtbDfTBXiR

#H2HC #BugBountyVillage #Call4Papers #HackerCulture

[caon @_caon__]

🚨 CFP aberto — Bug Bounty Village @ H2HC 2025 🚨
Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty?
Manda sua talk!
👉 https://t.co/qiinfEVgtH

#H2HC #BugBounty #Call4Papers #HackerCulture

[caon @_caon__]

@caioluders @itseieio Agora com CNPJ!

[Caido @CaidoIO]

Hackers,

To make our pricing fairer worldwide, we’re trying out localized pricing.

We’re starting with Brazil 🇧🇷, with Individual plan prices dropping by about 50%.

💸 Monthly: ~110 BRL → 55 BRL
💸 Yearly: ~1,100 BRL → 550 BRL

Which country should we do next?

https://t.co/DMyhYUX9yb

[Masato Kinugawa @kinugawamasato]

I don't know who this will help but I put together a page listing JavaScript APIs that can break Shadow DOM encapsulation :)

https://t.co/nBcGAFqGlA

[André Baptista @0xacb]

Try this out on your next target!

Some more gold from the guys at @ctbbpodcast! 🔥

[Sergey Toshin @_bagipro]

New Android host validation bypass technique!

[1/4] All parsed URIs in Android are https://t.co/x8giXOfU0w.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter

[Web Security Academy @WebSecAcademy]

How to find viable targets for client-side desync attacks:

1️⃣ Open Burp Suite and intercept requests.

2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater.

3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to HTTP/2.

4️⃣ Send the Modified Request and look for this error message:
"Server ALPN does not advertise HTTP/2 support"...

5️⃣ Enable ALPN Override in request settings and send again.

If you see "Stream failed to close correctly" then you've confirmed that the server does not support HTTP/2 and is a valid target for desync testing!

Want to learn more about desync attacks? On August 6, at Black Hat USA, James Kettle from PortSwigger Research will reveal new classes of desync attack that enabled him to compromise multiple CDNs and kick off the desync endgame! 😲

Stay up to date here: https://t.co/kr6SR4JOw3

[André Baptista @0xacb]

If the origin server treats a delimiter, but the cache doesn’t and the cache normalizes paths before applying static directory rules you can leverage path traversal!

Take this payload:
/myAccount$/..%2Fstatic/any

- The cache sees: /static/any
- The origin sees: /myAccount

The response for /myAccount is cached under /static/any and anyone that visits that static URL gets leaked data.

[Gareth Heyes \u2028 @garethheyes]

Want to know how I discovered this vector? Read the blog...

https://t.co/RAKpV7hSes