xchym

g4mm4 is my h3r0

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Verichains Cyber Force chained two unique bugs - including an auth bypass - to exploit the Synology DS925+ and run code as root. Their work earns them $20,000 and 4 Master of Pwn points. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

📦 Storage unlocked! Le Trong Phuc & Cao Ngoc Quy of Verichains Cyber Force just cracked the @Synology DS925+ at #Pwn2Own. A brief DNS issues delayed them, but they couldn't be stopped. They're off to the disclosure room to explain what they did. #P2OIreland

[Verichains @Verichains]

Verichains is glad to have helped unveil the root cause behind the largest Web3 hack—$1.4 billion on @Bybit_Official’s Multisig @Safe Wallet!

This hack is a strong wake-up call as Web3 security isn’t just about on-chain transactions or smart contracts — it also relies on traditional Web2 components like private keys, frontends, backends, oracle data, etc — which are prone to exploitation & manipulation.

[Verichains @Verichains]

Verichains has released a new security advisory VSA-2022-120, exposing a key extraction vulnerability in Multichain's fastMPC. Kudos to @MultichainOrg for the swift response and bug bounty.
Keep an eye out for upcoming advisories on critical attacks targeting popular MPC implementations.

https://t.co/Ip1wdyjcAK

[VNG Security Response Center @vngsecresponse]

We're really happy to share our improvements and some experiments for the CookieMonster tool.

Weaponizing Monster for Cookies Attacks: https://t.co/zUlvGEHTkr

Also include burp-extender plugin for burp suite. Hope you guys enjoy it.

~Cheers,
VSRC

[xchym @xchym]

\o/

[VNG Security Response Center @vngsecresponse]

Ladies and Gentlemen: The new Dojo opens to welcome black belt Hackers to fight for honor!!! #VSRC

Liferay revisited: A tale of 20k$. https://t.co/Opa58lorMO
Hope you guys enjoy it and stay tuned for more technique writeups / blogs / exploits ... will come.

~Cheers,
VSRC

[xchym @xchym]

@snyff use-after-free =]]

[xchym @xchym]

@peternguyen14 super LOL

[xchym @xchym]

#OWASP subdomain Web Cache Poisoning Attacks lead to stored XSS :)
https://t.co/pAt4m4lap4
This site is now closed ?!?

[xchym @xchym]

My old presentation from Tradahacking7 Conference - https://t.co/WKLqo72rwu #26082018 #PracticalSubdomainTakeover #MerryXXXMas #DoggyNewYear

[xchym @xchym]

@disclosedh1 @Black2Fan I guess this issue is "web cache poisoning attacks", not a "cache deception attacks" :)

[xchym @xchym]

Suddenly, I remembered my old shool hacking trick… maybe it is related to Server-Side RPO ;)
#IIS5.x #Over15yearsBug #SSRPO

[xchym @xchym]

Fly with #Emirates ;)

[xchym @xchym]

#gsec #hitb #2017 #ctf #webblog #thelazyway
https://t.co/ClzHQe4S1t

[xchym @xchym]

@phd_phuc lol, not me

[xchym @xchym]

Using my oldschool sqlmap tamper script to solve #simplesqlin #0ctf https://t.co/HeTQ27LGcp

[xchym @xchym]

@mazen160 If you report to DoD, I guess all of them will be marked “dupllicated” =]]

[xchym @xchym]

@mazen160 apache struts, I guess =]]

[xchym @xchym]

@manhluat93 noob cái nồi :v

[xchym @xchym]

Another way to solve #HackNo-Jam web challenge #codegate2016 #Achilles’heel #g4mm4_crawler =]]