?
17.05.2025 12:25
👍 0
🔁 0
💬 1
📌 0
?
it was fun :D
New research :
osec.io/blog/2025-07...
This time is about an authentication bypass in a popular auth provider, which allowed account takeover of the wallet. Plus some other auth missconf in the wild
Do you think Musk's bullshit is affecting the climate that much in Germany too? I thought in europe he had much less influence
If you like our research "Supply Chain Attacks: A New Era" please vote it :D. there is another article where I was involved "
Zoom Session Takeover - Cookie Tossing Payloads" if you like that too pls feel free to vote it XD
nice one :)
CloudFlare WAF pretty kek
pastebin.com/Q4L6XkJj don't know how to post code here, but came up with this during an audit, this wasn't catched by CloudFlare WAF cuz of Object.assign Lmfao, then from here url:#javascript: in order to pop-up metamask wallet transaction, kekwl
blog.slonser.info/posts/cve-20... Chrome patched this, but many Web3 services still act as full proxies, forwarding HTTP link header. Found a case where this bypassed CSP with default-src 'none'. file.notion.so/f/f/97ab6450...
new bounty coming with a weird case on web 3 wallet. I wish I wasn't always so tired and lazy that I could start writing writeups again. My last writeup on my personal github is from 2 years ago
osec.io/blog/2023-11... / Has been two years since i wrote a ctf writeup but here github.com/BrunoHalltar... :P
www.w3.org/TR/CSP2/#sou... this leads to interesting cases if there is a redirect 👀
tumpicon :P
Wanted to share our research regarding a Bypass on Lavamoat and how supply chain works
osec.io/blog/2024-06...
Hello Blùèsky