Thomas Gregory

Kýrie Iisou Christé, eléison me. Gamer. Free thinker. Tweet biasanya tentang IT Security atau lagi kepikiran sesuatu. My opinions are my own. 🎮☕💻

[Matt Shumer @mattshumer_]

https://t.co/ivXRKXJvQg

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[Cyberpunk 2077 @CyberpunkGame]

📢 REDstreams alert 📢

Join us for a new episode of #REDstreams, where we'll dive deep into the new features Coming Soon TM for Cyberpunk 2077 in Update 2.2!

See you tomorrow at 5 PM CET on our Twitch and, for the first time ever, simultaneously on our YouTube channel.

https://t.co/Pd1ztyTLTu
https://t.co/TOS9HhqLi9

Get ready, chooms! It's gonna be 🔥

[Thomas Gregory @modpr0be]

"Knowing that life is finite urges us to embrace the present, cherish every moment, and live with intention, for it is in the fleeting nature of time that we find true meaning."

- me

[Thomas Gregory @modpr0be]

Gmail Phishing
Inbox mail -> Attachment -> myjust123[.]pdf -> link to https[://]mygmailservser[.]kidsgamereviews[.]sa[.]com
#phishing

[Thomas Gregory @modpr0be]

"He who would accomplish little need sacrifice little; he who would achieve much must sacrifice much. He who would attain highly must sacrifice greatly."
- James Allen

[Thomas Gregory @modpr0be]

@keydkartika Bukaan, temen komplek gw haha

[Thomas Gregory @modpr0be]

Had a dream with my childhood friend, how are you there?

[klez @KlezVirus]

[RELEASE] Following the talk at DEF CON, I'm releasing all the POC projects associated with DriverJack. More info in the repos. For any additional info, hit me up ;)

- https://t.co/VmVpVtNkhD
- https://t.co/Cdzi5RBgVE
- https://t.co/RjN05qKeXg

[Thomas Gregory @modpr0be]

"Be so focused on watering your grass that you don't have time to check if someone else's is greener"

[Thomas Gregory @modpr0be]

#LummaStealer
YT video -> projectglbl[.]lol -> https://t.co/R1J7OrvaA3 -> GlobalæhÑáts.rar -> GlobalCheats.exe -> BitLockerToGo.exe

hxxps[:]//toughsnxcmxz[.]shop/api
hxxps[:]//empiredzmwnx[.]shop/api
hxxps[:]//boattyownerwrv[.]shop/api
hxxps[:]//rainbowmynsjn[.]shop/api
hxxps[:]//definitonizmnx[.]shop/api
hxxps[:]//creepydxzoxmj[.]shop/api
hxxps[:]//budgetttysnzm[.]shop/api
hxxps[:]//chippyfroggsyhz[.]shop/api
hxxps[:]//assumedtribsosp[.]shop/api

[Thomas Gregory @modpr0be]

Some songs remind me of Sunset in Ubud, Bali. In fact, I made a playlist for it.
https://t.co/Dye6uecl2r

[Thomas Gregory @modpr0be]

@SecurityTrybe "Oh no! Something has gone wrong. A problem has occurred and the system can't recover. Please log out and try again."

[Thomas Gregory @modpr0be]

Fortuner dateng 🙂
E36 dateng ☺️
G400 dateng 😈

[Thomas Gregory @modpr0be]

@Jhaddix Happy birthday man!

[Thomas Gregory @modpr0be]

If you have a sister, at least two women will always care about you. The first is your mother, and the second is your sister.

[Thomas Gregory @modpr0be]

It is what it is, so be it.

[It's FOSS @Itsfoss]

Waking up as a Linux user today

#Crowdstrike

[Thomas Gregory @modpr0be]

@gabsmashh It's fun. I love it so far, but I prefer AC Unity. The Mirage story doesn't tell you much; it just gives you the story of Basim.