Researcher @_0xPwner_
Joined May 2025-
Tweets19
-
Followers5
-
Following88
-
Likes34
We dissect a DFG compiler bug we discovered in Safari/WebKit. This post covers root cause, impact, and technical analysis: blog.exodusintel.com/2025/08/04/oop… #WebKit #VulnerabilityResearch #ExploitDev #Safari #CyberSecurity #ExodusIntel
Finally got around to publishing the slides of my talk @offensive_con from ~two weeks ago. Sorry for the delay! The V8 Heap Sandbox: saelo.github.io/presentations/… Fantastic conference, as usual! :)
It can be useful for those who have now started to learn v8sbx: - BackingStore/EPT overwrite(swap) - MetadataPointerTable corruption - HeapNumber wild-copy - Sign-extension slip in EPT - Forged TrustedAddress - Wasm func-table hijack - JIT-spray RWX pages
Good morning! Just published a blog post diving into Windows Kernel Pool internals: basics, memory allocation functions, internal structures, and how Segment Heap, LFH, and VS work. r0keb.github.io/posts/Windows-…
In my recent exploration of V8 vulnerability research and exploitation, I've delved into the V8 sandbox, a critical component designed to enhance security by isolating V8’s heap memory. This topic is about fuzzing V8 Sandbox, criticism and suggestions are welcome!
In my recent exploration of V8 vulnerability research and exploitation, I've delved into the V8 sandbox, a critical component designed to enhance security by isolating V8’s heap memory. This topic is about fuzzing V8 Sandbox, criticism and suggestions are welcome!
V8 is leaving the Sea-of-Nodes Turbofan compiler for the shores of CFG, read all about it in my colleague's blog post: v8.dev/blog/leaving-t…
Google Chrome V8 Object Allocation Integer Overflow Vulnerability (CVE-2018-6065) by markbrand: bugs.chromium.org/p/chromium/iss…
Perform research on V8 Sandbox Bypass reports in one shot tracker.ret2happy.com/bugs
How This Weird Exploit Primitive Corrupts iOS Heap Memory youtu.be/RWjpM0zDJVA?si…
Small tip for the JavaScript reverse engineers out there, Chrome has a `debug()` function which triggers a breakpoint whenever its first argument is called. It even works on built-in methods, no more wrapping stuff in proxies :D debug(DOMParser.prototype.parseFromString)
My learning note of several type confusion bug in wasmgc implementation of v8. xia0.sh/blog/overview-…
Check out our first blog post about V8 CVE-2024-12695: bugscale.ch/blog/dissectin…
This weekend, I gave a talk on web browser security research at a student-organized conference. I tried to make the talk reasonably beginner-friendly, so the slides (linked here) could hopefully be useful to someone as a learning resource. docs.google.com/presentation/d…
0day "In the Wild" googleprojectzero.blogspot.com/p/0day.html Spreadsheet: docs.google.com/spreadsheets/d… It is still updated regularly.
#hosselot_tips: Develop your harness as a win32 application (WinMain) instead of console application (main) and enjoy increased fuzzing speed as "conhost.exe" will not be spawned anymore. In my tests on Windows 10 it increases my fuzzing speed more than 5 times.
#hosselot_tips: Develop your harness as a win32 application (WinMain) instead of console application (main) and enjoy increased fuzzing speed as "conhost.exe" will not be spawned anymore. In my tests on Windows 10 it increases my fuzzing speed more than 5 times.
What a great blog post! Thank you to the researcher for sharing the research! Besides the core fuzzing part, the researcher has a great offensive point of view: the DoS-only bugs are still valuable as it can disable the Defender and make malware run without protection, in…
This Video Can Exploit Your iPhone (CVE-2025-31200) youtu.be/nTO3TRBW00E?si…
Top 25 Bug Bounty Platform you should try out 01. Bugcrowd 02. HackerOne 03. Intigriti 04. YesWeHack 05. Synack, Inc. 06. HackenProof | Web3 bug bounty platform 07. Open Bug Bounty 08. Immunefi 09. Cobalt 10. Zerocopter 11. Yogosha 12. SafeHats 13. Vulnerability Research Labs
The slides for my OffensiveCon talk "Finding and Exploiting 20-year-old bugs in Web Browsers" docs.google.com/presentation/d…
William @BOberfell76278
45 Followers 1K Following Crypto investor since 2017. Now Head of Influencer Relations closing 7-figure deals. Connect for collabs 🚀
Jermain Bergstrom @JermainBer97227
79 Followers 3K Following Shipping fictional characters since 1999 🚢❤️
Terence Haag @haag_teren70570
36 Followers 3K Following
d4rkc0nd0r @d4rkc0nd0r
242 Followers 498 Following
Jann Horn - jann@info... @tehjh
16K Followers 229 Following occasional human borrow checker; works at Google Project Zero; personal account; mastodon: [email protected]
jinmo123 @jinmo123
1K Followers 2 Following
Rene Freingruber @ReneFreingruber
3K Followers 577 Following Interested in reversing, browser exploitation, red & blue teaming, web vulns, ...
HackenProof @HackenProof
36K Followers 2K Following Expert web3 bug bounty and crowdsourced audit platform with 220 programs and over 20 million in bounty DS: https://t.co/41lshly4dI YT: https://t.co/cLUr6ODztP
RedDrip Team @RedDrip7
16K Followers 29 Following Technical Twitter of QiAnXin Technology, leading Chinese security vendor. It is operated by RedDrip Team which focuses on malware, APT and threat intelligence.
Liam\0 @LiamInfoSec
495 Followers 232 Following vuln researcher Currently: Lost in Browser Exploitation
FAMASoon @FAMASoon
621 Followers 515 Following blog: https://t.co/vw7x2QFnxe GitHub: https://t.co/sj0X6Q3g9C
qiuhao @QiuhaoLi
845 Followers 610 Following
vx-underground @vxunderground
368K Followers 290 Following The largest collection of malware source code, samples, and papers on the internet. Password: infected
Frank Wu @FrankOverF1ow
716 Followers 376 Following CTFer, Student, (Rev & Pwn & Automation), DEFCON 33 Finalist Exploring System Security and Porgram Analysis. Hacking with @r3kapig and @S1uM4i for fun.
Zellic @zellic_io
16K Followers 15 Following Security reviews and research that keep winners winning. We apply unmatched hacking talent to secure critical software for the most innovative teams.
Danis Jiang @danis_jiang
3K Followers 1K Following Yuhao Jiang / former ctfer @ Vidar-Team / Security Researcher @ Ant Group Light-Year Security Lab / GeekPwn 2022 / Pwnie Awards 2023 / Tianfu Cup 2023
Richard Johnson @richinseattle
18K Followers 3K Following Computer Security, Reverse Engineering, and Fuzzing; Training & Publications @ https://t.co/mloVP6rPB7; hacking the planet since 1995; Undercurrents BOFH
Security Bug Aggregat... @BugsAggregator
1K Followers 1 Following Aggregate Chromium disclosed security bugs.
d4rkc0nd0r @d4rkc0nd0r
242 Followers 498 Following
terjanq @terjanq
10K Followers 255 Following security enthusiast that loves hunting for bugs in the wild. co-founder and player of @justCatTheFish. infosec at @google. opinions are mine.
arttnba3 @arttnba3
91 Followers 58 Following binary security researcher | Linux kernel | active maintainer@CTF-Wiki | retired pwner@L-team x El3ctronic | PhD@SUT
Samuel Groß @5aelo
24K Followers 501 Following Working on Project Zero, Big Sleep, and V8 Security. Personal account. Also @[email protected] and https://t.co/aVitnPjBie
TheZDIBugs @TheZDIBugs
5K Followers 2 Following Checks for high severity, 0day, or Pwn2Own related advisories published by @thezdi
kylebot @ky1ebot
6K Followers 319 Following CTF player @Shellphish | PhD Student @ASU | @angrdothorse dev | Author of how2heap | Vulnerability Research Hobbyist | @[email protected]
Lyutoon @Lyutoon_
922 Followers 289 Following PhD student | CTF @Nu1L_Team & @StrawHat_CTF | AI + Security | Fuzzing | Collecting xx HoF | BlackHat Speaker | LLM4Shell
keenjoy95 @keenjoy95
639 Followers 139 Following
Alex Plaskett @alexjplaskett
12K Followers 571 Following Security Researcher | Pwn2Own 2018, 2021, 2022, 2024 | Posts about 0day, OS, mobile and embedded security.
Zhuowei Zhang @zhuowei
33K Followers 187 Following link in bio ⬛⬛⬛⬛⬛🟩🟩🟩🟩🟩🟩 ⬛⬛⬛⬛🟩🟩🟩🟩🟩🟩🟩🟩 ⬛⬛🟧⬛🟩🟫🟫🟫🟫🟫🟫🟩 ⬛⬛🟧⬛🟫🟫🟫🟫🟫🟫🟫🟫 ⬛⬛🟧🟧🟫🟧🟩🟧🟧🟩🟧🟫🟧 ⬛⬛🟧🟧🟫🟧🟫🟧🟧🟫🟧🟫🟧 ⬛⬛⬛🟧🟧🟧🟧🟧🟧🟧🟧🟧🟧 ⬛⬛⬛🟩🟩🟧🟧🟫🟫🟧🟧🟩🟩 ⬛🟫🟫🟫🟫🟫🟧🟧🟧🟧🟩🟩🟫 🟫🟫🟧🟫🟫🟫🟫🟩🟩🟩🟩🟩🟧 🟫🟧🟧🟧🟫🟫🟧🟫🟫🟩🟩🟧🟧
xia0o0o0o @Nyaaaaa_ovo
3K Followers 1K Following Write some shit code. CTF with @r3kapig. Do shit security research. Currently at University of California, San Diego. DEFCON 31/32/33 finalist | LOOKING FOR JOB
David Korczynski @Davkorcz
1K Followers 251 Following researcher @ADALogics | Software security, fuzzing, vulnerability analysis, AI, open source. | CS PhD from @CompSciOxford
Thuan Pham @thuanpv_
2K Followers 900 Following Senior Lecturer in Cyber Secutity at @UniMelb & ARC DECRA Fellow. Prev @MonashInfotech & @NUSComputing. (Fuzz) Testing enthusiast. Tweets are my own.
stephen @_tsuro
10K Followers 527 Following @v8js security, CTFs and CPU vulnz. LCHL. @[email protected]
Hossein Lotfi @hosselot
6K Followers 60 Following Vulnerability researcher at ZDI (views are my own). Check #hosselot_tips for vulnerability research tips. 'A machine never faults. It reflects human's faults.'
DARKNAVY @DarkNavyOrg
2K Followers 50 Following Cybersecurity enthusiasts from DARKNAVY. Achieve, Analyze, Attack *Oops.
TheSAS2025 @TheSAScon
4K Followers 255 Following #TheSAS2025 book your place now 👉 https://t.co/cVsRzXM8OXTrends for United States
You might like
