For the 2nd year in a row, my research was chosen for 'Top 10 web hacking techniques'. It's very encouraging that my 'WAF evasion techniques' is among other awesome researches and that I'm able to share my security thoughts with the #infosec community!

Nice trick showing that the very same zip can be seen differently by two different programs. I've examined how this quirk could help us in zip path traversal attacks:.

Generate videos in just a few seconds. Try Grok Imagine, free for a limited time.

You can confuse WAFs even more, by explicitly stating the number as positive or negative (and you can use multiple of + - characters)!. There's one weird oddity with BigInt, however. You can do: `let x = -0o1337n`, but - `let x = +0o1337n` leads to TypeError: can't convert BigInt

Been doing web2/mobile bug bounties on and off. Recently, added web3 to my bug bounty routine. The platform choice was obvious - @immunefi .It's interesting how even Low severity issues in web3 can lead to 4-digits payouts.

RT @phaldrzynski: @nav1n0x Shaming some company for having vulnerabilities is absolutely wrong. Let's criticize the programs which purposel….

Many people who are complaining that you can do better (earn more) by doing competitions - do not realize that there's a huge difference between the audit and the competition. Competitions reward unique findings the most. It's more incentive to dig into some particular part of.

In web2, more and more people start to understand the difference between an audit, pentest and vulnerability assessment. I'm glad this discussion finally starts to appear in web3 too. Using proper terminology will help everyone: Customer - who decides what model to evaluate the.

Not only was it my first Live Hacking Event, but also the first time I have ever been on stage!.I was nominated to do a Show and Tell and talked about the vuln. I had found during #AmbassadorWorldCup #AWC2024 Elite Eight round. It was nice to meet so many amazing, skilled people,.

Cannot agree with this. If you want professionals, then you either open an invite-only program and spend time on selectively choosing the right bug-hunters for your target, or you request a pentest/vulnerability assessment. You can't have your cake and eat it too. Open bug bounty.

Not only this. Hallucinations are even bigger concern. 1. AI hallucinates package name which does not exist. 2. Attacker creates that package with malicious code.3. Voilà - you have a backdoored code copy-pasted from LLMs.

This was super fun discovery. While it seems to be already fixed, they are tons of other ways to get the internal prompt. You can ask to reveal the first Nth characters of the prompt, translate the prompt or even tl;dr; it (in case, when the input is limited). Examples are in my.

This behavior can be easily explained, when we'll deep-dive into EVM storage. MAPPING.Let's consider a mapping declared at SLOT_X. Whenever we assign new value to key K of this mapping, its value is being stored at: `keccak256(K || SLOT_X)`. We can easily calculate where the.

This was fun web3sec competition! I missed a few rounds, yet I managed to get more points then the combined score of the next 3 players!.I've asked @Slavcheww to donate my reward to the children charity organization🙃.

Amazing research! Some of the payloads look crazy, yet they are still compliant with RFCs - this is insane! Using encoded-words seems like pretty novel technique, which will definitely lead to many interesting access-control findings!.

Another top-notch research - demonstrating how, even small time differences can lead to valuable info about the target! Absolutely a must-read for anyone who wants to know how much info we can predict from observing just the server response's time.

From now on, I'll try to post both webapps and smart contracts content-related tweets :).

During the hiatuses from researching web2 security, I've decided to deep-dive into web3 security. I've started my journey with amazing @RealJohnnyTime's course. Recently, I designed a new reentrancy challenge/exercise, which was published there!.

Actually, tel: URI (according to RFC-3966) is not only limited to XSS. You can try:.a) SQLi: +123;phone-context='or1=1--.b) param pollution: +123;phone-context=x&phone-context=y.c) or even SSRF, if the library really parses that URI: +123;phone-context=server - this is even.