psytester

testing》ethical hacking》vulnerability》cve 🧱 don't ask me for malicious actions

[psytester @psytester1]

@lostsec_ Thanx for the reminder of an old vuln in 2026. 😉
Your payload did not work in my tested target, but the poc of snyk-labs did its job on very old version 1.x 🔥
Will search for more projects with pdf.js 💥

[psytester @psytester1]

@intigriti seen a lot as default in internal test stages, sometimes after deployment to prod, too.
But in Germany we are safe, because we have the "Hackerparagraph" § 202a StGB, were it's forbidden to use this login. You don't go over start, do not get 4000€, but directly into jail.

[psytester @psytester1]

@intigriti ohh 😍 with chrome I was not that wrong, but I did not find a write up for CVE-2024-9966 in ctf context

[psytester @psytester1]

@intigriti I'm going to the corner of shame now. I already read about jsonp callbacks and simply did not test it.
I interacted with the bot's browser a lot, but funny script part to internal was blocked by SOP.
I was on the red herring with outdated chrome 129 version.
But! I learned a lot.

[psytester @psytester1]

@intigriti I hate you or I'm just too stupid 😉

</blockquote> <p>Preview loads inside the moderation console below.</p> <div id=

[psytester @psytester1]

@intigriti step 1 solved.
3.251.4*.** confirmend and the way to trigger it, is....
it's art 🤣

step 2 is comming

[psytester @psytester1]

@chux13786509 Almost 6 months are over.
I’ve actually been hooked from time to time and have read and learned a lot. For example, the PG simple query protocol, but apparently nothing that applies to this code snippet.
Please explain, I really don't want to die a fool.

[psytester @psytester1]

@intigriti 5 seconds for .htaccess and .htpasswd. It was where I meet John first time 🤣
But it was systemic behavior in past, ~ 2000
Back in the day, I didn't think in terms of vulnerabilities, but rather in terms of bugs and misused "features".

[psytester @psytester1]

@byXcore @h4x0r_dz it's in the researcher blog post as link 🧐
and if missing, you need to install binutils to get required `nm` binary

[psytester @psytester1]

@_aircorridor @three_cube ❣️This exploit works fine on unpatched Ubuntu based systems.
My production RHEL systems don't have installed rpmbuild, so attack surface is not given.

[psytester @psytester1]

@intigriti Blocking UNION?
Sending UNI/**/ON, UNION/*foo*/SELECT

Blocking OR?
Sending ||, OR/**/, OR%0A

Blocking SELECT?
Sending SEL/**/ECT, SEL%45CT

[psytester @psytester1]

Shift right with right shit by shit left.
🤭
Happens if a project tries to move security responsibility to the end, from left to right and is no DevSec anymore.
But only one character in the word "shift" was lost.🤣

[psytester @psytester1]

New week, new supply chain fun.
A package.json with entries for version pinning, e.g.
"axios": "^1.5.1"
vs.
"axios": "~1.5.1"
vs.
"axios": "1.5.1"
and `npm install` vs `npm ci` vs. `yarn add` but without yarn.lock

Can you see the problem?
A lot of projects had "fun" today.

[psytester @psytester1]

@intigriti How do you expose an AI scam call?
Ask for a cupcake recipe.

[psytester @psytester1]

@AquaSecTeam To be precise, an internal CI/CD merge request from renovate bot, simply to update trivy version.
It was not only bad, it was a nice workload, learned some more on top.

[psytester @psytester1]

@aquasecteam is doing a great job with trivy.
Usually, you can use the results to demonstrate the vulnerability fairly quickly using existing exploits.
But today, a simple renovate merge request compromised several projects. Supply chain attacks everywhere
https://t.co/CkeAOilSWG

[psytester @psytester1]

@chux13786509 get public key from /.well-known endpoint, create a jwt with algo HS256 and sign with publ key.
the verify jwt will try to decode not only with RS256, but with HS256 as well. bingo!

Can I get now the solution for your golang challenge?🙏
My brain burns

[psytester @psytester1]

@chux13786509 Is glitch on this client code level only or maybe on PG server with some bad pg_rewrite custom rewriter?

I hate you for the challenge because I don't see the problem between the lines.
I love you for forcing me to dive deeper into Golang, side-channel attacks via Sort and PG.

[psytester @psytester1]

@chux13786509 After a lot of checks, I'm very curious about the solution.

[psytester @psytester1]

@chen9918b @msftsecresponse For me CVE-2026-20841 works with this simple content and user interaction

[psytester @psytester1]

@chen9918b @msftsecresponse is it that simple I reproduced and with user interaction?
I need to click on the link in notepad md view and while unpatched version opens the calc.exe directly, the patched version asks me because the link could be unsafe.