Rafael lima

security researcher

[lexi <img src=x onerror=alert(1)> @1lexxi]

reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome.

now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :|

[Rafael lima @lim4rafael]

@c4ng4c3ir0 "Esse email nao esta cadastrado"

[xvonfers @xvonfers]

🔥🔥🔥
[$62000][400086889][wasm] Arbitrary Wasm type confusion due to removed security-sensitive CHECK() at type canonicalization
https://t.co/hD1dn2Ty0L

A full exploit that runs cat /etc/passwd
https://t.co/ydHMN2bz13

Reported by Seunghyun Lee (@0x10n)

[xvonfers @xvonfers]

Qualcomm June 2025 Security Bulletin
https://t.co/pD7SaUzvR9

"There are indications from Google TAG that CVE-2025-21479, CVE-2025-21480, CVE-2025-27038 may be under limited, targeted exploitation"

[Microsoft Threat Intelligence @MsftSecIntel]

Russian state actors Aqua Blizzard and Secret Blizzard are now collaborating to target Ukrainian military systems. Meanwhile, DarkGate resurges through the ClickFix technique. Learn more from the latest Microsoft Threat Intelligence Podcast episode: https://t.co/Jk7ww7qk4D

[PinkDraconian @PinkDraconian]

𝗜 𝗵𝗮𝗰𝗸𝗲𝗱 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗵𝗿𝗼𝗺𝗲 𝗮𝗻𝗱 𝗺𝗮𝗱𝗲 €𝟬...

Last night, I found a high-severity bug on the Google Chrome browser. A really cool exploit with some very large consequences. I was over the moon. I was ecstatic!

[xvonfers @xvonfers]

https://t.co/AO7FGRGhMM

[Security Trybe @SecurityTrybe]

😂

[abuse.ch @abuse_ch]

Unknown stealer botnet C2 targeting LATAM, having #opendir

👉https://t.co/CkfgNkNRZ4

[Rafael lima @lim4rafael]

https://t.co/xRdX0Ef1lA

[LaurieWired @lauriewired]

Here's the presentation:

https://t.co/0cbywy7tTL

[TheSecMaster @TheSecMaster1]

𝐑𝐞𝐝 𝐓𝐞𝐚𝐦 𝐓𝐨𝐨𝐥𝐬 🔥

🔴 RECONNAISSANCE:
- RustScan ==> https://t.co/V60s7cQtgH
- NmapAutomator ==> https://t.co/tBDprydjR7
- AutoRecon ==> https://t.co/zPFqsSkX7v
- Amass ==> https://t.co/gbL5JFzJA8
- CloudEnum ==> https://t.co/gpfJshCY8B
- Recon-NG ==> https://t.co/Ej7Ch27XRs
- AttackSurfaceMapper ==> https://t.co/26CZjPZ5lH
- DNSDumpster ==> https://t.co/155QKGbYIS

🔴 INITIAL ACCESS:
- SprayingToolKit ==> https://t.co/QQBFhJrV9U
- o365Recon ==> https://t.co/WncQwZTTBx
- Psudohash ==> https://t.co/RQjl3ayHjs
- CredMaster ==> https://t.co/9HNXvAgscs
- DomainPasswordSpray ==> https://t.co/6oWcpHO4dF
- TheSprayer ==> https://t.co/qmBCBOCR3q
- TREVORspray ==> https://t.co/vuvowKozwo

🔴 DELIVERY:
- o365AttackToolKit ==> https://t.co/Tc1u6HzNKq
- EvilGinx2 ==> https://t.co/rc7qoAwicN
- GoPhish ==> https://t.co/tRUCykjWQh
- PwnAuth ==> https://t.co/AFZ6d0CS0g
- Modlishka ==> https://t.co/gIaTsBNfd5

🔴 COMMAND AND CONTROL:
- PoshC2 ==> https://t.co/4PjliJ62ei
- Sliver ==> https://t.co/sizFqU9C87
- SILENTTRINITY ==> https://t.co/tb7tA7xkgv
- Empire ==> https://t.co/ZPXUwdDXFW
- AzureC2Relay ==> https://t.co/OQORBpiRlW
- Havoc C2 ==> https://t.co/0qBUUHfR9T
- Mythic C2 ==> https://t.co/MRUoUI1VdG

🔴 CREDENTIAL DUMPING:
- MimiKatz ==> https://t.co/Uqm014iF4C
- HekaTomb ==> https://t.co/IanPmvdyNO
- SharpLAPS ==> https://t.co/DEo72E4stt
- Net-GPPPassword ==> https://t.co/WwZcPAc1SN
- PyPyKatz ==> https://t.co/MObsdlWq63

🔴 PRIVILEGE ESCALATION:
- SharpUp ==> https://t.co/SXiwPmngxR
- MultiPotato ==> https://t.co/Xrdlsp6wuU
- PEASS ==> https://t.co/Tn4d6U591f
- Watson ==> https://t.co/cU2sej8Y1A
- Bat-Potato ==> https://t.co/D9lZ3oqzM7

🔴 DEFENSE EVASION:
- Villain ==> https://t.co/SKfVanKO7h
- EDRSandBlast ==> https://t.co/ZRFdt6bYLS
- SPAWN - Cobalt Strike BOF ==> https://t.co/UyNVs8CNTr
- NetLoader ==> https://t.co/w3DUiwHzth
- KillDefenderBOF ==> https://t.co/j9KpZTi6Za
- ThreatCheck ==> https://t.co/RSF9SP6nFp
- Freeze ==> https://t.co/O6FXHCSpZL
- GadgetToJScript ==> https://t.co/mHthGtTruA

[reverseame @reverseame]

ransacked: 119 vulnerabilities in LTE/5G core infrastructure #CellularSecurity #FloridaInstituteForCybersecurityResearch #LTE #5G #Vulnerabilities https://t.co/0FSj8ayj9d

[Rafael lima @lim4rafael]

https://t.co/jEb0IMYkC9

[Ian Beer @i41nbeer]

My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp -
https://t.co/H4m8MBwoWN

[Google VRP (Google Bug Hunters) @GoogleVRP]

🔔 Android bug hunters, take note 📝!

The Android VRP is now offering an extra $1,000 bonus reward to researchers who include an AutoRepro test with their vulnerability report – we're looking forward to your submissions!

https://t.co/5EeXCEfK7h

[Rafael lima @lim4rafael]

https://t.co/UOkYEGAris

[Rafael lima @lim4rafael]

@5aelo - https://t.co/YEawlUl14s

[Rafael lima @lim4rafael]

@5aelo - https://t.co/YEawlUl14s

[Phrack Zine @phrack]

What is your favorite Phrack article? What did it teach you?