HolyBugx

AppSec, and Automation.

[HolyBugx @HolyBugx]

Don't rely on WAFs.

[Guillermo Rauch @rauchg]

@infosec_au @assetnote DM’d you. You have a working repro for bypassing Cloudflare but not Vercel. Would love to correct the record or see the evidence.

[HolyBugx @HolyBugx]

@rez0__ Lots of contradiction & speculation with little data.

- "Hackbots find 1 % of vulns" → How was this measured?
- 2 → 3 → 4 % isn't a law; one jump ≠ trend.
- "Hackbot singularity this year" clashes with your "slow hand-off"

Where are the citations? Evidence or just vibes?

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top ten web hacking techniques of 2024! https://t.co/XHPEeqPQLR

[HolyBugx @HolyBugx]

@SinSinology Beautiful, very well done! ���🏽

[Sam Curry @samwcyo]

New blog post with @infosec_au:

We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely.

The issue was reported and patched.

Full post here: https://t.co/QPzRIqqx9t

[d4d @zakfedotkin]

Introducing the Cookie Sandwich, a tasty technique to steal HttpOnly cookies using legacy RFC features: https://t.co/kellcWkFoL

[Michael Stepankin @artsploit]

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

[daniel @hackermondev]

Research into a unique 0-click deanonymization exploit targeting Signal, Discord and hundreds of platform 🧵

[d4d @zakfedotkin]

Did you know you can use an ancient magic cookie to downgrade parsers and bypass WAFs?! Neither did we. Enjoy!
https://t.co/Hv62isyGNn

[HTTPVoid @httpvoid0x2f]

Check out our latest blog post! We dive into GitHub Enterprise’s SAML implementation and explore an authentication bypass in encrypted assertion mode.

CVE-2024-4985 / CVE-2024-9487: GitHub Enterprise SAML Authentication Bypass.

https://t.co/mFOE6GGkhO

[daniel @hackermondev]

1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
https://t.co/8pkfFsXRWR

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[HolyBugx @HolyBugx]

@evilsocket Beautiful finding and writeup!

[James Kettle @albinowax]

Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
https://t.co/mxhH2N7teW

[watchTowr @watchtowrcyber]

In August, watchTowr Labs hijacked parts of the global .mobi TLD - and went on to discover the mayhem that we could cause.

Enjoy....

https://t.co/maUn3dHnee

[Ian Carroll @iangcarroll]

In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found.

Here is our writeup:
https://t.co/g9orwwgoxt

[Orange Tsai 🍊 @orange_8361]

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd

Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996

[Gareth Heyes \u2028 @garethheyes]

Everyone knows that the RFCs for email addresses are crazy. This post will show without doubt that you should not be following the RFC.

https://t.co/HL0g9f7QEA

[James Kettle @albinowax]

The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here ->
https://t.co/cBRLNpOZ6y

[RyotaK @ryotkak]

I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.

This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.

https://t.co/puM7hZWIlE