rekter0

doing things @sundialxyz,
CTF @water_paddler / BlueWater

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[rekter0 @rekter0]

@_riatre Codex with few kb md files to fill in some gaps

[rekter0 @rekter0]

@n3r0li 🥷🙈

[rekter0 @rekter0]

ctftime is also trolling llms solve stations with prompt injection

[blasty @bl4sty]

can we please get the libxml2 and ffmpeg people some cold cash, lambo's and decent quality blow as a token of appreciation for all the ASAN splats we throw over the fence and want to have fixed pronto? I know one man's trash (CVE's) is another man's treasure, but we gotta respect and support these hardworking devs a bit more. how else do you expect to play back (x-rated) flicks that come in esoteric video container formats or correctly render SVG's containing vector depictions of your favorite animals in safari?

[rekter0 @rekter0]

@S1r1u5_ You guys should start using the same prettier conf

[Gareth Heyes \u2028 @garethheyes]

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below:

https://t.co/Tje8Ce8if0

[Water Paddler @Water_Paddler]

🥈 Thrilled to nab 2nd as Blue Water, teamed up with @perfect_blue at DEFCON CTF Final 33!

🙌 Congrats to @mmm_ctf_team for their 4th straight 1st

💪 We’re gunning for the crown next year! Join our crew to make it happen! DM us or drop us an email! 🚀

#DEFCON #CTF

[rekter0 @rekter0]

@blueminimal @sqrtrev Use sqlite atach database into css directory
Or use sqli to update user_tables obj column to trigger elixir binary to term deserialise rce

[Tavis Ormandy @taviso]

I just learned that OSC8 (hyperlinks) in Windows Terminal uses ShellExecute(). Excellent trolling potential for README files 😆

[Massimo @Rainmaker1973]

Now you know why

[Sonar Research @Sonar_Research]

🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace.

When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete.

#mXSS #XSS

[Sundial @sundialxyz]

Jesse Pollak showing the ease of onboarding with Onflow.

[Sundial @sundialxyz]

Trade onchain with counterparties, not addresses, privately.

Finally, a small demo of the Onflow protocol, fully computed proof in zero-knowledge with no internet required.

Going live on Base soon, and many other ecosystems.

1-click ZK-KYC, everywhere, imminent✨

[Remedy @xyz_remedy]

📝Another fantastic write-up about the Remedy Closed Beta Challenge. Dive into details https://t.co/0Ph1pxAFSJ

Big kudos to @rekter0 for this comprehensive breakdown🙏

Curious about and want to give it a shot? Join us on Discord to explore and take part https://t.co/RimDkMtQJM

[rekter0 @rekter0]

A twitter content spoofing issue being exploited by same recent Ledger hackers?
you can put any username and as long as the tweet id is valid it will be redirected to the correct account.

the scam pages drain using same ledger hack contract bytecode
🤔

[Water Paddler @Water_Paddler]

Thx for hosting such a great CTF. Great team work with @pb_ctf. Congraz to *0xA and MMM. See you guys in Final!

[perfect blue @pb_ctf]

Blue Water places 2nd place in DEF CON CTF Finals!

Blue Water is a merger of @pb_ctf + @Water_Paddler + Samsung Research + Tea Deliverers.

Thank you to @Nautilus_CTF for the great CTF, and shoutout to all the other finalists!

See you next year? 😉