Cybersec researcher & exploit developer w/ emphasis on webapp security. Former #TeaMp0isoN + former Founder of Project Insecurity LTD + founder of Bug0xF4.about.me/MLT-0x539 keybase.io/0dayWizardJoined July 2021
Been writing a script to make post-exploitation on *nix easier for beginners, here's what I've added so far. If anyone can think of more functionality to add then please let me know. I've made a primitive UI to make it easier for beginners to use (rather than cmdline args)
I asked this like a year ago but didn't get a response.. everything else for my chain is still working so I'll ask again..
Does anyone currently have JSNOP callback or open redirection in *.paypalobjects.net?
I'll split the bounty with you if you've got one.
I swear @elonmusk has singled me out for the sole purpose of trolling me.. my tweets for my blog posts disappear then as soon as I repost them, the original tweets suddenly reappear 🙃
[Zerodays] -- a list of 0days found by myself and/or members of Project Insecurity LTD (my old cybersecurity firm) over the years:
github.com/MLT-0x539/Expl…
This list will be constantly getting updated as there are hundreds more PoC's that I still need to add to the list.
[BLOG POST] - BBP writeup, escalating a "useless" HTMLi to PI via a chain involving charset spoofing, CSS Injection, and dangling markup injection to leak PII:
0x80dotblog.wordpress.com/2023/08/07/bbp…
Hmm, weird. Can anyone see the 2 new blog posts that I tweeted out and/or the tweet I made linking to my "exploits" repo on my GitHub?
They were visible for me yesterday but for some reason I can no longer see the tweets.. it's like they've disappeared from my timeline.
Lol, to you and the other 5 accounts that sent me the exact same message.. if you're going to attempt to scam someone who works in cybersecurity via a fake kraken support email I think you're going to have to try a LOT harder than that 🙃
Does anyone know how long transactions in kraken tend to be stuck as "pending" for?
I deposited some money around 18 hours ago using "easy bank transfer" via an account I've used for deposits hundreds of times. Every other time it's been deposited instantly but this one is stuck.
I just accidentally took over the blog of someone called Tiffany since their email address contained "MLT" in the first part. Unsure how to contact her so I left a message there:
mlt15.wordpress.com/2025/05/23/hi-…
I guess I can at least score a bounty for this accidental finding, lol.
I just accidentally took over the blog of someone called Tiffany since their email address contained "MLT" in the first part. Unsure how to contact her so I left a message there:
mlt15.wordpress.com/2025/05/23/hi-…
I guess I can at least score a bounty for this accidental finding, lol.
Lol, oops. I just inadvertently found a WordPress zeroday that allows me to compromise the blog of anyone who has the same letters in the first part of their email as mine (for example if my email is [email protected] and theirs is [email protected]).
Blog post: The "Triangle Paradox", when security risk outweighs benefits of functionality (with real-world example with HTMLi/XSS in Facebook):
0x80dotblog.wordpress.com/2025/05/23/blu…
Note:
My PoC had intentionally been tweaked a little to prevent it from working -- the reasoning for that is because their "patch" was easily bypassed when I first published this, by simply using a <portal> tag instead of iframe. I'll publish the full PoC later since its fixed
Note:
My PoC had intentionally been tweaked a little to prevent it from working -- the reasoning for that is because their "patch" was easily bypassed when I first published this, by simply using a <portal> tag instead of iframe. I'll publish the full PoC later since its fixed
BBP Writeup: Turning a "useless" HTMLi into a P1 (definitely one of the more fun and unique methods I've ever used to escalate a HTMLi):
0x80dotblog.wordpress.com/2023/08/07/bbp…
I've started to slowly publish my old 0day exploits found either by myself or members of Project Insecurity LTD (my old cybersecurity firm). They can be found here:
github.com/MLT-0x539/Expl…
I've got hundreds more to post still, so this list will constantly be getting updated.
This has got to be the most insane ASCII art I've ever seen.. at first I assumed it ANSI art due to the level of detail but nope it's coloured regular ASCII art
96K Followers 2K FollowingHacker, marketer. I manage socials and produce amazing technical blogs for cybersecurity orgs. Founder of @hacker_content and @haksecio
42 Followers 233 FollowingVery Much Big Hacker Man 😎
There is no Internet Connection
Try:
Contacting the System Admin
Checking the Proxy Address
Running Windows Diagnostics (on Mac)
7 Followers 444 FollowingI am a Medical Laboratory Technologist with hands-on experience in lab tests like hematology, microbiology, and biochemistry. I enjoy learning new skills and he
96K Followers 2K FollowingHacker, marketer. I manage socials and produce amazing technical blogs for cybersecurity orgs. Founder of @hacker_content and @haksecio
1K Followers 75 FollowingHacktivist - Anonymous Operations, fighting for free expression, and standing against injustice and inequality. Freedom begins with your actions.
125 Followers 90 FollowingRetired Operator // My targets weren't always systems. Often, they were the shadows hiding behind them. Now, I apply that discipline in the legal field.
10 Followers 46 FollowingVibe coding a crypto hedge fund with $0.20 worth of 2013 BTC. Any activity represents my opinions and not those of my employer.
67 Followers 75 FollowingProduct Security Engineer but I may do some hacking, CTI and other stuffs :)
Please allow some time for a DM response as I am not engaged on social media often.
37K Followers 2K FollowingExpert web3 bug bounty and crowdsourced audit platform with 220 programs and over 20 million in bounty
DS: https://t.co/yl9Srpuzbb
639 Followers 733 FollowingAn old wise guy. Enjoying his new found, quiet life, admiring the scenery.
Problem is, the scene/ry has a way to drag you back to the views.
2011.
🎭
2K Followers 1K FollowingMike Tiso | ex-Red-Team & Incident Resp. Lead | University Professor | Rev. engineer | Opinions and tweets are my own! Certified LMGTFY, OMGWTFBBQ
342 Followers 288 Following#Cybersecurity, #BountyHunter | CEO of @Terrlocks⚡️| worked with @justzik @brawadis | Official partners for @Polarchefs -I- @stellara_io -I- @BlueLeafServers