Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.
Blog post: https://t.co/WO9MeExoun
PoCs: https://t.co/NpVgEHBHPl
can we please get the libxml2 and ffmpeg people some cold cash, lambo's and decent quality blow as a token of appreciation for all the ASAN splats we throw over the fence and want to have fixed pronto? I know one man's trash (CVE's) is another man's treasure, but we gotta respect and support these hardworking devs a bit more. how else do you expect to play back (x-rated) flicks that come in esoteric video container formats or correctly render SVG's containing vector depictions of your favorite animals in safari?
I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below:
https://t.co/Tje8Ce8if0
🥈 Thrilled to nab 2nd as Blue Water, teamed up with @perfect_blue at DEFCON CTF Final 33!
🙌 Congrats to @mmm_ctf_team for their 4th straight 1st
💪 We’re gunning for the crown next year! Join our crew to make it happen! DM us or drop us an email! 🚀
#DEFCON#CTF
@blueminimal@sqrtrev Use sqlite atach database into css directory
Or use sqli to update user_tables obj column to trigger elixir binary to term deserialise rce
🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace.
When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete.
#mXSS#XSS
Trade onchain with counterparties, not addresses, privately.
Finally, a small demo of the Onflow protocol, fully computed proof in zero-knowledge with no internet required.
Going live on Base soon, and many other ecosystems.
1-click ZK-KYC, everywhere, imminent✨
📝Another fantastic write-up about the Remedy Closed Beta Challenge. Dive into details https://t.co/0Ph1pxAFSJ
Big kudos to @rekter0 for this comprehensive breakdown🙏
Curious about and want to give it a shot? Join us on Discord to explore and take part https://t.co/RimDkMtQJM
A twitter content spoofing issue being exploited by same recent Ledger hackers?
you can put any username and as long as the tweet id is valid it will be redirected to the correct account.
the scam pages drain using same ledger hack contract bytecode
🤔
Blue Water places 2nd place in DEF CON CTF Finals!
Blue Water is a merger of @pb_ctf + @Water_Paddler + Samsung Research + Tea Deliverers.
Thank you to @Nautilus_CTF for the great CTF, and shoutout to all the other finalists!
See you next year? 😉