gujjuboy10x00 @vis_hacker

Vishal Panchani security Engineer | hall of fame from Google ,paypal , brickftp and many more. keep calm and hack the planet. Top 10 in hackerone alltime medium.com/@vis_hacker Bengaluru, India Joined April 2017

Tweets

1K
Followers

6K
Following

664
Likes

4K

Elon Musk @elonmusk

7 months ago

Is the left really just a giant kleptocracy? The evidence increasingly suggests it is.

19K 41K 294K 44.9M 6K

Michael Stepankin @artsploit

8 months ago

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

8 84 303 28K 155

Download Image

Suraj @PwnFunction

8 months ago

my daily ritual starts with this youtube.com/watch?v=1S1fIS…

1 2 10 2K 3

Elon Musk @elonmusk

9 months ago

How can this be called a “continuing resolution” if it includes a 40% pay increase for Congress?

Wall Street Mav @WallStreetMav

9 months ago

How can this be called a “continuing resolution” if it includes a 40% pay increase for Congress?

2K 5K 12K 24.2M 659

Download Image

15K 26K 94K 34.2M 2K

Elon Musk @elonmusk

a year ago

Mario Draghi’s critique is accurate. A thorough review of EU regulations to eliminate unnecessary rules and streamline activity in Europe would revitalize growth and strengthen competitiveness. Things should be default legal, rather than default illegal.

Ursula von der Leyen @vonderleyen

a year ago

2K 1K 7K 12.0M 2K

3K 6K 40K 9.4M 3K

Orange Tsai 🍊 @orange_8361

a year ago

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confus… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code…

37 654 2K 203K 740

James Kettle @albinowax

a year ago

When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦‍♂️ Awesome work! Never under-estimate the crazy.

sw33tLie @sw33tLie

a year ago

13 67 276 47K 136

Download Image

7 35 213 22K 63

shubs @infosec_au

a year ago

Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: assetnote.io/resources/rese…

15 224 793 72K 300

Download Image

Geekboy @emgeekboy

2 years ago

🎉 Big congrats to @rootxharsh & @iamnoooob for their incredible research on hacking into @Apple using a 0-day in Lucee CMS! 🍎🔥 Check out their detailed blog post to learn more about their findings and methodology: blog.projectdiscovery.io/hello-lucee-le… #AppleHack #Lucee #0Day…

3 28 141 8K 26

Derin Eryilmaz @deryilz

2 years ago

My first blog post! It's about CVE-2023-4369, a $10,000 bug I found in ChromeOS in July. The bug used a chrome:// URL XSS to allow Chrome extensions to execute privileged code and read/edit downloaded files without user interaction. 👀 0x44.xyz/blog/cve-2023-…

9 134 525 51K 163

Omid Rezaei @omidxrz

2 years ago

I just published a write-up about an account takeover where I abused reverse proxy to hijack the OAuth Code. blog.voorivex.team/hijacking-oaut…

17 155 562 74K 313

Johan Carlsson @joaxcar

2 years ago

I have finally done my first proper bug write-up! This one is about a SOP bypass in Chrome (escalated to ATO) using the Navigation API. Hope someone finds it interesting. Feel free to leave me any comments; I want to improve on this! joaxcar.com/blog/2023/10/0…

9 109 499 85K 189

tehryanx @healthyoutlet

2 years ago

New writeup on some interesting web app tech. Enjoy! #bugbounty bountyplz.xyz/bugbounty/2023…

0 47 118 17K 64

shubs @infosec_au

2 years ago

The impact achieved here is neat: labs.hakaioffsec.com/nginx-alias-tr… - I remember first reading about this from @fransrosen - blog.detectify.com/2020/11/10/com…

3 52 201 19K 89

PortSwigger Research @PortSwiggerRes

2 years ago

Chrome has just unleashed popovers: modal dialogs without JS! Of course you can abuse them for XSS filter evasion: portswigger.net/web-security/c…

6 137 503 77K 132

Download Image

shubs @infosec_au

2 years ago

For a few months, @samwcyo, @bbuerhaus, @rhyselsmore and I focused on hacking EPP servers / ccTLD zones. We're disclosing our work today on the hackcompute blog: hackcompute.com/hacking-epp-se… Our efforts in this space led to the ability to control the DNS zones of the following…

15 242 673 157K 190

shubs @infosec_au

2 years ago

Last year, @Jhaddix, @bscarvell, @seanyeoh and I found a pre-auth RCE in Oracle Opera - CVE-2023-21932. This product holds the PII of every guest (including credit cards 😱). It's used by almost all of the big hotel/resort chains around the world. blog.assetnote.io/2023/04/30/rce… - 1/4