Jinone

Security researcher

[Jinone @jinonehk]

@t0xodile Maybe. But thank you for the compliment.

[Jinone @jinonehk]

Great experience collaborating with Akamai — the team is incredibly friendly and professional.

[Ryan Barnett (B0N3) @ryancbarnett]

CVE-2025-66373: HTTP Request Smuggling Due to Invalid Chunked Body Size

https://t.co/uviWpvUJBA

[Jinone @jinonehk]

Great idea. I usually find fuzzing complete phone numbers quite complex. But this article inspires me to try guessing with a small dataset.

[zere @j_zere]

Just released a blog post "Deanonymizing Users at Scale: When Blocking Becomes an Oracle".

In it, I describe an attack that made it possible to reveal the phone number of almost any user on one of the world’s largest social platforms:

https://t.co/CuTMMmm1X0

[Jinone @jinonehk]

@jobertabma @NahamSec @stokfredrik @Hacker0x01 jin0ne

[Doyensec @Doyensec]

🎉Announcing the latest research from our intern @maikypedia! In it, you'll learn all about Decompression Attacks, get to practice in custom-built labs and get some free @semgrep rules for detecting flaws. Check it out today!

https://t.co/we46rcyptw

#appsec #doyensec #semgrep

[Jinone @jinonehk]

@chain00x nslookup

[Jinone @jinonehk]

League of Legends is holding me back. I'm only ranked at diamond 2.

[Jinone @jinonehk]

@Blaklis_ Happy birthday 🎉

[Frans Rosén @fransrosen]

Here's my x-correlation/json-injection research also in writing, thank you @ctbbpodcast!
https://t.co/px1UcmvUTc

[James Kettle @albinowax]

The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here ->
https://t.co/cBRLNpOZ6y

[Jinone @jinonehk]

@GhiffariZaid @696e746c6f6c @bxmbn DM

[Harel @H4R3L]

New blog! This time a high severity session takeover in Zoom worth $15,000. Read the story of how @sudhanshur705 , @BrunoModificato and I chained 2 completely useless XSS vulns to steal OAuth tokens, hijack browser permissions, and more:
https://t.co/qVUgk5shqh

[Aethlios @AethliosIK]

Wow! Thanks for sharing my work @albinowax, it's really nice to see that it's reached your attention. :)

[James Kettle @albinowax]

I'm thrilled to announce "Listen to the whispers: web timing attacks that actually work" will premiere at Black Hat USA!

After nine months of running bulk timing attacks on thousands of live sites, I've got a lot to share :D #BHUSA @BlackHatEvents
https://t.co/YsrfM0SUm7

[Codean @CodeanIO]

A public service announcement about #CVE-2024-4367 that we found in one of our pentests at Codean Labs. Make sure to update your #Firefox version to 126 and for #developers to update your PDF.js dependency. You can read our blog post for all details.
https://t.co/4hJ0kSh87r

[HTTPVoid @httpvoid0x2f]

Enjoy our next blog post this time an SQL Injection on Apple’s Infra. Another win nets us a $25,000 bounty! 💻💰 #AppleSecurity #Research #bugbountytips #bugbounty

https://t.co/p09IH8bE86

[Ngo Wei Lin @Creastery]

Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server:

https://t.co/jmjTTOxEGY

[Jinone @jinonehk]

Hong Kong

[Harel @H4R3L]

Just published a writeup on my account takeover vulnerability in ChatGPT, using a really cool web cache deception technique. Waited a while to finally publish this, enjoy :)

https://t.co/P1vHoSzABX

[Jinone @jinonehk]

@_godiego__ @Hacker0x01 🔥🔥🔥