Mirhat

Security researcher

[Mirhat @mirhatx]

@zonduu1 interestingly opus 5 works better on <= medium effort

[Nowasky @nowaskyjr]

Anchor/area tags can leak page URLs (origin, path, query, post-click fragment) by using href="#" with the ping attribute pointing elsewhere.

Works in Chrome and Safari (Firefox disables ping by default).

https://t.co/SVt05u6Hxs

[publiclyDisclosed @disclosedh1]

X (Formerly Twitter) disclosed a bug submitted by @mirhatx: https://t.co/xWvVfcoeRa #hackerone #bugbounty

[publiclyDisclosed @disclosedh1]

X (Formerly Twitter) disclosed a bug submitted by @mirhatx: https://t.co/mdg1npf9vy #hackerone #bugbounty

[Mirhat @mirhatx]

@mertistaken @Bugcrowd Congrats 🔥

[PortSwigger Research @PortSwiggerRes]

We've just published 'Smashing the state machine: the true potential of web race conditions' by @albinowax! Dive in to arm yourself with novel techniques & tooling, and help reshape this attack class:
https://t.co/GJOOn4Wmab

[Mirhat @mirhatx]

@bhavukjain1 nice finding mate

[Mirhat @mirhatx]

@erbature

[Mirhat @mirhatx]

@umr4n6 ux at its best

[Mirhat @mirhatx]

@ThePrimeagen there's no way this can be real

[Sam Curry @samwcyo]

We recently found a vulnerability affecting Hyundai and Genesis vehicles where we could remotely control the locks, engine, horn, headlights, and trunk of vehicles made after 2012.

To explain how it worked and how we found it, we have @_specters_ as our mock car thief:

[Mirhat @mirhatx]

@HusseiN98D How did you leak the Slack tokens? Was it reflected in some sort of page or something?

[Ian Carroll @iangcarroll]

Today I'm disclosing several vulnerabilities I found in the certificate authority e-Tugra, which disclosed significant amounts of subscriber PII and may have impacted their certificate issuances. Hopefully other CAs are not like this!

https://t.co/8mP5rS3EyA

[David Schütz @xdavidhu]

I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.

Google fixed the issue in the November 5, 2022 security patch. Update your devices!

https://t.co/LUwSvEMF3w

[Mirhat @mirhatx]

@GodfatherOrwa @intigriti Most of these tools are free, aren't they?

[Mirhat @mirhatx]

@hacker_ @opensea @Hacker0x01 Huge congrats! I guess it was a web3 bug 😁

[PortSwigger Research @PortSwiggerRes]

Making HTTP header injection critical via response queue poisoning, by @albinowax

https://t.co/GPvsO1XlBX

[Mirhat @mirhatx]

@mustaphaturhan espically after the uber hack last week

[Mirhat @mirhatx]

@habib_karatas @lutfumertceylan @mehmetcangunes @witchfindertr okey boomer

[Mirhat @mirhatx]

@erhansaydam @myavuzyalcintas Abi selam ironi yapmsitim. Oyle olmadigini biliyorum 😊