NDevTK

Still pretending to be a security researcher.

[NDevTK @ndevtk]

Bug write-up for "Google AI Studio XSS" https://t.co/ubhArPvSl0 (ﾉ*･ω･)ﾉ

[NDevTK @ndevtk]

@Tur24Tur Strange because could just reuse the same chat session maybe it allows for easier moderating. If true that's an very invasive setup.

[NDevTK @ndevtk]

@0x464D @S1r1u5_ Security research does require exploit dev otherwise AI could just make it up. I got approved for a use case wonder if having a duck background image helps.

[NDevTK @ndevtk]

https://t.co/7sMg3G3bw6 got more complicated it now converts unsafe sinks to safe DOM API calls and traces taint from sources to sinks across files, functions, and control flow. Maybe can reuse code in extension :)

[NDevTK @ndevtk]

@J0R1AN Nice I didn't spend much effort on making it look nice without JavaScript analysis the code required is a lot less.

[NDevTK @ndevtk]

I made a HTML/CSS to DOM API converter! https://t.co/7sMg3G3bw6 this project doesn't use Babel JS because I couldn't be bothered.

[NDevTK @ndevtk]

The first version of APIClient has been released https://t.co/zLP7wr1WSO it supports API learning with key tracking based on usage and Google/Swagger discovery documents plus XSS finding also replacement for postLogger extension. It's not perfect, create GitHub issues :)

[NDevTK @ndevtk]

@S1r1u5_ https://t.co/6ssSg2X1fh they do have form.

[NDevTK @ndevtk]

https://t.co/HPyuwMA25W has been recovered does both API learning and XSS finding it's not perfect but I'm starting to get over it. Hopefully this time I will release and not delete it.

[NDevTK @ndevtk]

Taint analyser is replaced with CodeQL Chrome https://t.co/2ABivU9kwd because trying to get AI to build a code graph then integrate it with an SMT was annoying. I asked something basic like trace the internals of jquery it made a fake version.

[NDevTK @ndevtk]

Bug write-up for "Google XSS part 3" https://t.co/reA3VbwocZ \^o^/

[NDevTK @ndevtk]

@S1r1u5_ Arguably they could have been compensating with features for having a bad model but yeah the model is good not perfect but better than Gemini.

[NDevTK @ndevtk]

@randomunkn36565 There's a share button for browsable intents but for the other intent types it would need ADB exports or its own deeplink system that prefills the fields (preferred by me) crashes in large apps is a problem will hopefully get better with updates.

[NDevTK @ndevtk]

DroidProbe is getting an API client that supports Swagger and Google discovery documents. Based on past experience with a Minecraft server hosting app it's a good target for security issues.

[NDevTK @ndevtk]

@ynsmroztas Oh competition.

[NDevTK @ndevtk]

The test release of DroidProbe is published after joining https://t.co/aI6meI4Oqy it can be installed at https://t.co/mhNqXK1IM1 please provide feedback :)

[NDevTK @ndevtk]

https://t.co/OufjbDNhls Contextual GUI via code analysis all the things.

[NDevTK @ndevtk]

@JubaBaghdad @a7mad__n1 @GoogleVRP Could be 200.00

[NDevTK @ndevtk]

A no-code web-based GUI for Chromium MojoJS security research with automated binding generation. Tempted to add an AI chat bot. https://t.co/ujI8BI5x5i

[NDevTK @ndevtk]

An experimental WinDbg debugging toolkit for Chromium security researchers: https://t.co/DkajV10bAF
Bug write-up for OAuth redirects don't check for SSL/TLS: https://t.co/DoyRfMGwIb
Summarizer theme on my writeups website now works on desktop chrome again! 🦆