skull

hacker, security researcher. 21. i run a blog @

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[skull @brutecat]

@xtunz_ @Paradox he did in fact own it lol

[skull @brutecat]

@zenith256 @dreyand_ He’s a living legend :)

[skull @brutecat]

@omespino @GoogleVRP was it LFI on the borgtask? why was the payout so low

[skull @brutecat]

@J0R1AN @garethheyes this is so cool :)

[skull @brutecat]

@HackerOn2Wheels there’s a client side open redir on *.googleapis.com (one of the subdomains)

[skull @brutecat]

@OkayValve You people are the reason I get so much spam on my “[email protected]” email lol

[Brutecat Security @BrutecatSec]

@brutecat this is what our harness does against the hardest target on earth.

imagine it pointed at yours.

https://t.co/kohkRvV59K

[skull @brutecat]

@h4x0r_dz @orange_8361 the most legendary hacker of all time :)

[skull @brutecat]

@thezdi @moyix @orange_8361 @d3vc0r3 insane.

[skull @brutecat]

@PhiloGroves This is exactly why CVSS sucks, idk why people bother w/ bugs that already require high privileges. It’s just not impactful. For all of my OSS vuln research, I filter these out.

[skull @brutecat]

@__nopnop wish i could see this talk!! sounds awesome :)

[skull @brutecat]

@Dmonty28516998 @Canvas_by_Inst @LowLevelTweets @LawrenceAbrams @josephfcox what’s the actual impact of this bug? i don’t know the specifics of this but since canvas is open source, you could just do public disclosure lol

[skull @brutecat]

@inspector_amb @haxor31337 incredible! congrats :)

[skull @brutecat]

@Dinosn if you’re interested in hacking google server-side, you should 100% check this out.

@michaeldaltonau did a fantastic job talking about the process of finding bugs through discovery docs :)

[skull @brutecat]

@Reelix @goofball1998 @KarlsSec The one report there is just what I set to “public” on the bughunters site.

I’m rank 19 on the global leaderboard lol.

If you seriously think I’m a larp feel free to ask any googlers on the VRP discord.

[skull @brutecat]

My 2nd RCE in Google Cloud production (Borg) in less than 3 months...

I'm at $600k in total rewards from Google VRP in the past few months. Still can't believe it.

[skull @brutecat]

Finally had the pleasure of meeting @sirdarckcat IRL at Google Singapore 🇸🇬

Always learn something new talking to him!

[skull @brutecat]

@zeyu1337 wow this is so cool 😂

[skull @brutecat]

@sirdarckcat @wtm_offensi would love to meetup & have a chat if you have some time, i’m based in SG. sent you a DM!