Nicky Bloor

Coder, hacker, infosec researcher, adrenaline junkie. Once hiked Ben Nevis, Scafell Pike, and Snowdon in 22h 48m. Not a snake oil peddler.

[Nicky Bloor @nickstadb]

@Random_Robbie @LargeCardinal All good here bud. Was hoping to cross paths at SteelCon but it clashed with Oasis. No idea what happened with BSides Liverpool either. You good bud?

[Nicky Bloor @nickstadb]

Deserialization, reflection, and memory-resident shellcode execution come to mind with PrecodeFixupThunk being the first step of the JIT mechanism (hat-tip to @_xpn_ for weird ways to run unmanaged code in .NET!).

Anyone observed this, or have any more specific suggestions?

[Nicky Bloor @nickstadb]

Are there any funky .NET exploitation techniques that might lead to a crash in clr!PrecodeFixupThunk?

[Nicky Bloor @nickstadb]

@Steel_Con @NEXUS2345 🤣

[Nicky Bloor @nickstadb]

@Random_Robbie @LargeCardinal Yeah deffo let me know if you're heading to any other cons bud, be good to catch up.

[Nicky Bloor @nickstadb]

@vysecurity If it ain't snake oil on LinkedIn, it's some bullshit CVE with a 10.0 CVSS score that can only be exploited once you've already significantly compromised the target 🤔

[Nicky Bloor @nickstadb]

@ethicalhack3r Cheers Ryan! It's tough for sure. Definitely need to get the training miles in - and hopefully not injure yourself or be floored by flu 😅 Half marathon is a nice distance IMO but if you push yourself there you're definitely in danger of being tempted to do a full marathon.

[Nicky Bloor @nickstadb]

That's another one ticked! Did not go as well as I'd have liked but it was a brutal one today. The heat took a lot of people out. Hope everyone's ok and congrats to the 92k or so marathoners today whether at London or Manchester! #ManchesterMarathon

[Nicky Bloor @nickstadb]

In other news - my @Steel_Con talk has been accepted! Looking forward to it. Catch you there if you're going!

[Nicky Bloor @nickstadb]

@WisecWisec @irsdl I may have had something to do with this😉

[Nicky Bloor @nickstadb]

Apache security team have reviewed and revised this one! CVE-2025-24859 in Apache Roller has been downgraded to CVSS 2.1, panic over ;)

[Nicky Bloor @nickstadb]

CVE database is becoming a joke TBH, when things like CVE-2025-24859 are published with a CVSS score of 10.0 - To exploit this vulnerability you first need to obtain a valid session token, then you only maintain access to the corresponding user account... https://t.co/aDJX1f5ZSs

[Binni Shah @binitamshah]

Intercepting HTTPS Communication in Flutter : Going Full Hardcore Mode with Frida : https://t.co/S4j441guU3

[Nicky Bloor @nickstadb]

@MarkD755 @UK_Daniel_Card There definitely seems to have been a rise in "critical" CVEs with insane preconditions in recent years.

[Nicky Bloor @nickstadb]

CVE database is becoming a joke TBH, when things like CVE-2025-24859 are published with a CVSS score of 10.0 - To exploit this vulnerability you first need to obtain a valid session token, then you only maintain access to the corresponding user account... https://t.co/aDJX1f5ZSs

[Nicky Bloor @nickstadb]

@TheHackersNews I make that a 2.3 under CVSSv4.0, maybe even 2.1 - an attacker first needs to compromise an account, then they only maintain access to the account they already compromised. Who's reviewing/approving this stuff?! https://t.co/WxgCOk1gnd 🤔

[Nicky Bloor @nickstadb]

Excellent day catching up with folk over at @BSidesLanc !

[Nicky Bloor @nickstadb]

@Random_Robbie @fullspectrumdev @njcve_ @zseano @LargeCardinal Hahaha I'm game man!

[Nicky Bloor @nickstadb]

It's time! Picked this one up about 9 years ago, not long after I had my first Smog Rocket @BeavertownBeer !