pritch

just wanna htp and control eip!

[TrendAI Zero Day Initiative @thezdi]

Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[Luke Jahnke @lukejahnke]

New blog post: Ruby Array Pack Bleed
PoC + breakdown of a simple out-of-bounds reads in Ruby's Array#pack

[pritch @elpritchos]

@camiaei Ah ok, thank you. I'll keep chatting to you on the PR then.

[Louis Nyffenegger @snyff]

As an engineer, I ❤️ clever engineering.

Ruby on Rails relies on signed sessions (AES GCM). They are secure, but there is a catch: you cannot invalidate them early. You have to wait for expiry. Workarounds exist, like caching sessions you want to kill, but nothing universal.

[pritch @elpritchos]

@xxdigitalis @thegrugq @phrack

[pritch @elpritchos]

@vitorpy @dhh Sure, I don’t think I’ll have a lot of time to maintain it but any feedback is welcome.

[pritch @elpritchos]

@vitorpy @dhh I put together a bit of an “Omadora” build based on Omarchy recently. It’s really just for my own personal use but you might find it a good base to build from with your own tooling.

https://t.co/joEkMo8Eb6

[Chidanand Tripathi @thetripathi58]

We are cooked.

Google DeepMind Genie 3 just broke the internet.

10 wild examples

1. Nothing feels real anymore

[pritch @elpritchos]

@seeinglogic @orange_8361 @phrack Someone had to.

[Luke Jahnke @lukejahnke]

If you’re on twitch you can now follow me there, username is nastystereo

The channel will be focused on hacking, link in the next tweet

[Orange Tsai 🍊 @orange_8361]

This is absolutely the greatest recognition for a researcher. Thank you all!

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

The Fetch API supports Blob objects as request bodies, not just strings!

Blobs can omit a type, enabling cross-site POST requests without a Content-Type header.

Even with non-empty bodies, the Blob's data becomes the request body!

(credit: @lukejahnke)

[Orange Tsai 🍊 @orange_8361]

The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 https://t.co/EWlBSgXhpx

cc: @_splitline_

[Luke Jahnke @lukejahnke]

🧵My latest blog post is live 🔥 Read it to learn what SafeMarshal is and *two* very different ways to escape and get RCE!

https://t.co/OxRAkwhFp7

[Louis Nyffenegger @snyff]

Probably my last CVE for the year: JWT Algorithm Confusion in a C library...

https://t.co/43WTiBq2JM

[Luke Jahnke @lukejahnke]

🧵New blog post! Introducing the _json juggling attack in Ruby on Rails

[Luke Jahnke @lukejahnke]

🧵Can you work out how to bypass this vulnerable CSRF protection? Read all about this gotcha in my latest blog post

[Luke Jahnke @lukejahnke]

🧵I just published a new blog post, this time about vulnerabilities in a web framework written in the R programming language!

[Luke Jahnke @lukejahnke]

https://t.co/xI316Irhsu - Where reporting the vulnerabilities is left as an exercise for the reader

Want to provide feedback on upcoming posts before they’re published? Drop me a DM!