0xNova

Security Researcher | Web3-Auditor |

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[0xNova @sama_pwn]

@PashovAuditGrp @cvetanovv0 The setup im using still lacks alot not sure what im missing but still working on it

[0xNova @sama_pwn]

@your_pena71143 @mess_2025 @BRICSinfo By targeting innocent civilians right

[0xNova @sama_pwn]

Ai could never replace Ahsan bhai👏👏

[Ahsan Khan @hunter0x7]

Critical: Client-Side Encryption Collapse

https://t.co/nbScR5c6hj
↓
some_javascript.js
↓
Line no 80519 → encObj + base64 key
↓
atob(val) → "Encoded_Password"
↓
CryptoJS.AES.decrypt(encObj, passphrase)
↓
55 configuration properties → 107 operational secrets exposed
→ Azure AD client_secret → OAuth client_credentials flow
→ RSA public keys → Forge encrypted /enc/ API requests
→ HMAC key → Backend-accepted payload signing
→ Direct Line token → Production chatbot access
→ Monitoring / RUM keys → Telemetry manipulation
→ Auth0 + reCAPTCHA config → Auth flow manipulation
→ 31+ encrypted authentication endpoints mapped
↓
Use extracted Azure AD credentials
↓
Request token from Microsoft OAuth endpoint (client_credentials)
↓
Receive valid JWT with high-privilege role (e.g., AllAccess)
↓
“Super token” accepted by backend across protected API routes
(No user interaction required, role-based authorization granted)
↓
All sensitive authentication and account endpoints
were wrapped in client-side hybrid encryption
→ Every request payload encrypted in browser
→ AES-256-CBC used for body encryption
→ RSA-OAEP used to wrap per-request AES key
→ Server accepts any request that decrypts successfully
→ Decryption success treated as implicit authorization
↓
Reverse-engineer encryption module (@**6246)
→ Algorithm: AES-256-CBC + RSA-OAEP (SHA-512)
→ Random 32-byte AES key per request
→ IV derived client-side
→ AES key wrapped with embedded RSA public key (promocode_pem)
→ Final format: { "key": base64(RSA_key), "body": hex(AES_ciphertext) }
↓
Hook JSON.stringify + XMLHttpRequest
↓
Capture plaintext BEFORE encryption (credentials, OTPs, tokens)
Capture encrypted wrapper AFTER encryption
Capture correlated server responses
↓
Analyze MFA implementation
↓
IP-based rate limiting only (lockout resets on IP change)
OTP expiration not strictly enforced server-side
Encrypted payload fields trusted after decryption
↓
Mass takeover method
↓
1. Trigger MFA or password reset
2. Rotate IP to bypass rate limiting
3. Reuse or brute-force OTP under weak enforcement
4. Complete password reset flow
5. Authenticate as victim
6. Capture decrypted OTP and auth tokens via runtime hook
7. Reuse valid 2FA tokens for subsequent authenticated requests
↓
Full attack chain achieved:
→ Extract secrets from client bundle
→ Generate high-privilege JWT (“super token”)
→ Read any plaintext request (credentials, PII, tokens)
→ Forge any encrypted request the server will accept
→ Bypass MFA protections via IP rotation
→ Reset victim passwords
→ Decrypt authentication flows in runtime
→ Mass account takeover

[0xNova @sama_pwn]

@0xTib3rius Curious how the agents handle authorization state for BAC/IDOR or other business logic issues ?
Can it reason across multi request workflows and role boundaries , intent , or is mainly limited to injection and recon driven findings?

[0xNova @sama_pwn]

@FUINY77 @paoloardoino I think this list mainly refers to web2 issues not mainly contract bugs

[0xNova @sama_pwn]

Does anyone know where can one submit a security issue?

[Paolo Ardoino 🤖 @paoloardoino]

USAT 🇺🇸 official Ethereum smart-contract:
https://t.co/r3SXkqlrBU

[vitalik.eth @VitalikButerin]

“Ethereum was not created to make finance efficient or apps convenient. It was created to set people free”

This was an important - and controversial - line from the Trustless Manifesto ( https://t.co/QAvZfiNxpe ), and it is worth revisiting it and better understanding what it means.

“efficient” and “convenient” have the connotation of improving the average case, in situations where it’s already pretty good. Efficiency is about telling the world's best engineers to put their souls into reducing latency from 473 ms to 368ms, or increasing yields from 4.5% APY to 5.3% APY. Convenience is about people making one click instead of three, and reducing signup times from 1 min to 20 sec.

These things can be good to do. But we must do them under the understanding that we will never be as good at this game as the Silicon Valley corporate players. And so the primary underlying game that Ethereum plays must be a different game. What is the game? Resilience.

Resilience is the game where it’s not about 4.5% APY vs 5.3% APY - rather, it’s about minimizing the chance that you get -100% APY.

Resilience is the game where if you become politically unpopular and get deplatformed, or if a the developers of your application go bankrupt or disappear, or if Cloudflare goes down, or if an internet cyberwar breaks out, your 2000ms latency continues to be 2000ms.

Resilience is the game where anyone, anywhere in the world will be able to access the network and be a first-class participant.

Resilience is sovereignty. Not sovereignty in the sense of lobbying to become a UN member state and shaking hands at Davos in two weeks, but sovereignty in the sense that people talk about "digital sovereignty" or "food sovereignty" - aggressively reducing your vulnerabilities to external dependencies that can be taken away from you on a whim. This is the sense in which the world computer can be sovereign, and in doing so make its users also sovereign.

This baseline is what enables interdependence as equals, and not as vassals of corporate overlords thousands of kilometers away.

This is the game that Ethereum is suited to win, and it delivers a type of value that, in our increasingly unstable world, a lot of people are going to need.

The fundamental DNA of web2 consumer tech is not suited to resilience. The fundamental DNA of _finance_ often spends considerable effort on resilience, but it is a very partial form of resilience, good at solving for some types of risks but not others.

Blockspace is abundant. Decentralized, permissionless and resilient blockspace is not. Ethereum must first and foremost be decentralized, permissionless and resilient block space - and then make that abundant.

[0xNova @sama_pwn]

@Reed02x

[0xNova @sama_pwn]

@paoloardoino Thanks 🙏🏻

[0xNova @sama_pwn]

@mosetibosire 1 am adhd hits diff you see things normally you dont 😂 i hope i was right 🤞

[Davide Crapis @DavideCrapis]

Ethereum is in the unique position to be the platform that secures and settles AI-to-AI interactions.

The ERC-8004 standard is coming to mainnet.

[0xNova @sama_pwn]

@UK_Daniel_Card It helps you get publicly exposed :) so people can read your emails and stuff

[0xNova @sama_pwn]

@UK_Daniel_Card Semgrep does a brilliant job btw

[0xNova @sama_pwn]

@ItakGol Yeah the main concern is the way people are deploying it cant put the blame on clawdbot but it sure will take a while

[0xNova @sama_pwn]

@stokfredrik Thanks, that means a lot coming from you🙏

[0xNova @sama_pwn]

Clawdbot deployment security disaster : Shodan+Naabu+httpx is all it took to reveal hundreds of cooked "YOLO" deployments. Clawdbot Control wide open: configs, PII, & chat history , n8n and much more exposed.
Tailscale Funnel , open door to Mac Minis and what not
#Clawdbot

[0xNova @sama_pwn]

@Dustin_Schimp juicy not sure defo alarming xD but honestly, it’s a mess. with recent patches, a lot of deployments went dark some haven’t been updated this was from early morning so alot of instances were still exposed.
A few had chat histories with some very much NSFW stuff so had to stop.

[0xNova @sama_pwn]

@stokfredrik https://t.co/IB9YL3opYM

Also Lobster extensions uses spawn(..., { shell: true }). I believe If your bot processes untrusted input (public groups, web fetches), prompt injection can escalate to disaster.

[0xNova @sama_pwn]

Clawdbot deployment security disaster : Shodan+Naabu+httpx is all it took to reveal hundreds of cooked "YOLO" deployments. Clawdbot Control wide open: configs, PII, & chat history , n8n and much more exposed.
Tailscale Funnel , open door to Mac Minis and what not
#Clawdbot