alex

@[email protected] # Array(10).join('a'-1)+ Batman! #Cure53

[Calif @calif_io]

Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/I88EQFrUHa

His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

There we go
https://t.co/UejvtXFMR1

[alex @insertScript]

When you like DNS related shenanigans, this is fun to check for yourself.

[debiru / coeurl @debiru_R]

Cloudflare の Public DNS 1.1.1.1 に脆弱性があることを示す PoC
https://t.co/7cUCVyoRS0

1.1.1.1 を使っている人は FAKE サーバーに辿り着くはずです。

（参考）
検証用URL https://t.co/7cUCVyoRS0
FAKEサーバー https://t.co/GIy55Rs5OO
TRUEサーバー https://t.co/gFSm72BXB0

[alex @insertScript]

@zhero___ https://t.co/1W5kBvb0wg has Next.js as a target ;-)

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

[alex @insertScript]

@rebane2001 uh cool idea. Kinda curious why nobody got weird for the first result - at least in the screenshots I have seen.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

We are going to be at DEF CON!

If you want to learn fault injection hands-on, make sure to bring your laptop.

[alex @insertScript]

@J0R1AN this is perfect - I needed that for a test case I always wanted to try^^

[Jorian @J0R1AN]

This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀
https://t.co/mbvgknxHJZ

[AmirMohammad Safari @AmirMSafari]

If a website uploads your pictures to S3 as public objects and serves them through a reverse proxy, you have XSS even if the website's implementation is safe! I wrote about this in full in this post:

https://t.co/bjpWyHOqsR

[alex @insertScript]

@garethheyes oh it is definitely up there - but for me the IE's valueOf location assignment stays my favourite^^

+{"length":1,"0":"javascript:alert(1)","toString":[].join,"valueOf":location}

[zhero; @zhero___]

I co-authored an educational article on cache poisoning vulnerabilities with @intigriti.

If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!

[Masato Kinugawa @kinugawamasato]

DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
https://t.co/PNPSorjJEL

[zhero; @zhero___]

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js

https://t.co/0JWjH6yzC2

[alex @insertScript]

Damn, what a read

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[alex @insertScript]

@magicmac2000 I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D

[s1r1us @S1r1u5_]

FFFF the axios thing is bad, almost all node.js project use it, we use it.

didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao

built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway.

CHECK YOUR IMAGES.

https://t.co/mJt54dt7RW

[alex @insertScript]

@AmirMSafari Well I learned a lot trying to solve this challenge.
But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)

[alex @insertScript]

@shhnjk Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image

[alex @insertScript]

Again just a quick JS PoC (nothing new, just some PoC to try it):
JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused.
https://t.co/hUfyhIi0pZ