intrigus

I create and break stuff. GitHub ⭐. @KITCTF.
#Java, #CodeQL and #V8. Github: stuff:

[intrigus @intrigus_]

I‘m now on Mastodon as well, you can add me at @[email protected]

[KITCTF @KITCTF]

GPN CTF 2026 at @entropiagpn is now served and the buffet is open for 36 hours!
Come taste our freshly cooked challenges.
==> https://t.co/3k59dCuZyw <==
If you're on-site, pull up a chair! (The set table in front of the merch desk with a KITCTF flag on it)

[intrigus @intrigus_]

Learn what to do when your CodeQL database doesn't contain what you expect and how to use cvise to easily create a minimal reproducer in my newest blog post 🎉
https://t.co/os215p4Iam

[KITCTF @KITCTF]

We arrived in Mexico City for @GoogleVRP's #hackceler8 finals together with @fluxfingers 🥳

[intrigus @intrigus_]

Had a lot of fun in Stockholm at @SEC_T_org talking about attacking and defending GitHub Actions.
Full slides: https://t.co/LFCDwqzZoK

[asymmetric research @asymmetric_re]

GitHub Actions are a powerful automation tool, but also a prime target for supply-chain attacks.

During @SEC_T_org, Security Researcher Simon Gerst (@intrigus_) broke down real vulnerabilities, defenses that work, and how to limit damage if an exploit occurs.

Full talk below ↓

[intrigus @intrigus_]

@seanhn Maybe, but not yet fully decided.

[intrigus @intrigus_]

Excited to talk about some of the research I've been doing during my masters :)

[NULLCON @nullcon]

➗🚗💨 V8 runs your #JavaScript like a race car tearing down the track—and @intrigus_ decided to lift the hood at #NullconBerlin2025.

Using formal bug-hunting tools, he found a hidden math problem in its division that could throw it off course.

👉 https://t.co/UKa60Ce90f

#V8

[KITCTF @KITCTF]

This Thursday, we're excited to have @mawalu
talk about Android system services and how to use @fridadotre for efficient and scalable IPC request interception.
As always, 7pm -120, 50.34

[intrigus @intrigus_]

@x0rb33f @fluxfingers Nope, that was someone else from the team.

[intrigus @intrigus_]

Really enjoyed this year's Google CTF together with @fluxfingers.
Especially the pwn "Unicornel TrustZone" challenge was nice. Writeup soonish 😀

[KITCTF @KITCTF]

We had a lot off fun playing this year's Google CTF in a spontaneous merger with @fluxfingers
Somehow we qualified for the finals 🎉.
Thank you for such a great CTF @GoogleVRP
GG to all teams and see you in Mexico!

[KITCTF @KITCTF]

Hey, GPN CTF is back!

Can you break the CTF monopoly? The only property worth owning is the top spot on our CTF leaderboard. 'Go to jail' is just a chroot jail away, play online or on-site at @entropiagpn
Friday, 20th of June 2025 10:00 UTC!
More info: https://t.co/xmrE4LIfVo

[intrigus @intrigus_]

@watchtowrcyber "Relieving" to see that even you couldn't find a way to exfiltrate multi-line files^^
I (together with I-Al-Istannen) found an XXE in CodeQL a while ago and was disappointed that only single-line files can be exfiltrated but the JDK code looked solid and I didn't find a bypass :/

[intrigus @intrigus_]

Last year I played Realworld CTF and solved "Protected by JavaSE" together with I-Al-Istannen.
We exploited XXE in @github's CodeQL using the unintended CVE-2024-25129.
I wrote about the (un)intended solution and how to use CodeQL to find bugs in CodeQL 😂
https://t.co/1rlYpEBSQd

[intrigus @intrigus_]

When you look at a CVE's patch for more than a few seconds and get a new CVE for free :sigh:

[intrigus @intrigus_]

(3/3)
In the end, all you have to do is to change a single stack pointer move and `nop` a loop and go from the right image to the far better left image 🎉

I've also written about this in a bit more detail:

https://t.co/RtA7xHM4od

[intrigus @intrigus_]

(1/3)
Stack probing (to protect against stack clash attacks) in binaries leads to not so pretty decompilation in @NSAGov's Ghidra and @vector35's Binary Ninja, but there is an easy fix 🥳

[intrigus @intrigus_]

(2/3)
I was playing DEFCON CTF Quals last week and the `loader` binary of the `callmerust` challenge had some not so pretty decompilation so I chose to investigate and fix it.

[intrigus @intrigus_]

GitHub's award that recognizes my contributions to open source security through my various workshops and my tireless help with people learning CodeQL or just answering their questions (plus some very nice swag) has arrived 🥳

[intrigus @intrigus_]

Woah, I totally didn't expect this 😯
I wouldn't be where I'm now without the help of @HauwaOtori, @XCorail and @nicowaisman to name just three.
Thank you for bringing me to GitHub+SF, encouraging me to do my first conference talk and letting a random run queries on ALL of lgtm.

[KITCTF @KITCTF]

This Thursday, @intrigus_ will present the results of his master's thesis on bounded verification of the range analysis in v8's Turboshaft engine.
As always, 7pm -120, 50.34

[intrigus @intrigus_]

Really excited for this one!

[KITCTF @KITCTF]

This Thursday, we're excited to have @momo5502 give us a deep dive into Windows user-space emulation.
As always, 7pm -120, 50.34

[intrigus @intrigus_]

@pwningsystems Nice!