gabdevele

web ctf player @ mntcrl

[gabdevele @gabdevele]

It's finally happening: Mntcrl CTF 2026 is here!
Starting June 27 at 16:00 UTC for 24 hours.

I authored many of the Web challenges for this edition including some 0-days. Good luck!

https://t.co/pgrDvr2C5d

[gabdevele @gabdevele]

Exfiltrating form parameters via Same Origin Method Execution with JSONP callback and DOMPurify.

Vibechat challenge from Bhackari CTF 2026

Read the full writeup here:
https://t.co/LOMt4uZ3zx

[gabdevele @gabdevele]

Two critical XSS vulnerabilities found in AFFiNE (unpatched).

@SalvatoreAbello and I discovered a 0-click and a 1-click XSS leading to full account takeover.
Reported in January but got ghosted by the AFFiNE team.

Read the article here: https://t.co/Zb3GXevFF7