ensy

ctfer with @BlackB6a, web player, programmer, high schooler

[ensy @ensyzip]

Found a DOMPurify 3.2.3 Bypass on Chinese New Year!
Works when `SAFE_FOR_TEMPLATES` is set to true.
https://t.co/Isia1fr5Xn

[ensy @ensyzip]

Nice border radius there

[ensy @ensyzip]

@aidenybai the font reminds me of chatgpt image generation

[ensy @ensyzip]

@Rhynorater 🤔

[ensy @ensyzip]

@J0R1AN vouch

[ensy @ensyzip]

@ctbbpodcast Thanks @J0R1AN for escalating it – don't know how I am sleeping tonight with such a random discovery at 3am

[ensy @ensyzip]

Accidentally found an XSS on Adobe while listening to @ctbbpodcast 's public hackalong – might have to become a member now for more hackalongs😂

[ensy @ensyzip]

@siunam321 Reminds of https://t.co/IrYxd00mdi – this would perhaps be considered as 'parser differential between two different cookie parsers'? 😂

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

https://t.co/SgsSyxoEMR

1/4

[ensy @ensyzip]

If you ask it to set an alarm, then click on the 'clock' widget that google assistant shows – there's a chance it reveals your alarms for a split second
Or is this just an issue with Nothing OS?

[ensy @ensyzip]

Apparently you can use google assistant with your phone locked?

Found that you can 'leak' alarms through google assistant; someone who gets hold of your phone could get a glimpse of the possible meetings/appointments you have – even without ever unlocking it🤔

[siunam @siunam321]

Here's my review of this certificate and its course. Enjoy!
https://t.co/IBYQtOfUrF

[ensy @ensyzip]

@payloadartist @GoogleVRP June 18, 2024 https://t.co/tCusXJwO6g

[ensy @ensyzip]

First proper bug bounty :P

Thanks @GoogleVRP

[siunam @siunam321]

RIP mXSS. (Or a new era of mXSS?!)

[HSVSphere @HSVSphere]

Never made anything when you were <14 award goes to whomever is running this account

[siunam @siunam321]

Here's my research about Python dirty Arbitrary File Write to RCE via overwriting shared object files or overwriting bytecode files. Enjoy!

https://t.co/P3V2y0yGH9

#Research #WebAppSec

[Rebane @rebane2001]

it's finally time...

this is css clicker, a fully-featured incremental game where your goal is to design your own personal website and get as many views on it as possible

the fun part? it's a pure-css game, meaning it has zero javascript or server-side code.

have fun!

[ensy @ensyzip]

@samedotdev @aidenybai

[ensy @ensyzip]

vibe security
@samedotdev @aidenybai
https://t.co/GNXB16JCfZ
https://t.co/qZd4pcuypf

[️ @crackticker]

vibe coders when the vibe is off