π SkyrocketingοΌ π (200+ new stars)
π¦ microsoft / litebox
β 917 (+208)
π Rust
A security-focused library OS supporting kernel- and user-mode execution
Abe Simpson meme saying, βback in my day we used to hunt for vulnerabilities by handβ
College econ lessons that stuck with me for life:
1. Opportunity Cost: The cost of an action is the alternative you sacrifice. Working late costs dinner with your family.
2. Sunk Cost Fallacy: Don't persist just because youβve already invested effort. If a Netflix series sucks, just stop watching.
ignore the title about caching, this is the best explanation of how LLMs work, period
brew install kingfisher
# Scan a single Shai-Hulud exfil repo
kingfisher scan --git-url github.com<org>/%3Chulud-rep...
kingfisher repo: github.com/mongodb/kingfisher
Scan your repos and orgs with Kingfisher to detect _valid_ leaked creds:
# Enumerate and scan your whole org for any Shai-Hulud-created repos
KF_GITHUB_TOKEN=ghp_xxx \
kingfisher scan github --organization <your-org>
This allows defenders to actually recover the valid secrets Shai-Hulud exfiltrated so they can be identified and rotated quickly.
Most open-source scanners stop after a single Base64 decode and miss the data Shai-Hulud buries underneath.
The Shai-Hulud v2 npm worm is exfiltrating secrets into auto-created GitHub repos as double-Base64 encoded blobs.
Kingfisher is currently the only open-source secret scanner that recursively decodes multiple layers of Base64.
Billion dollar ideaβ¦Splunk, but fast π«
π The 2nd edition of πContainer Security π is out now! π
bookshop.org/p/books/cont...
Very late on getting this video out the door, but a teeny weeny showcase of the recent Docker for Desktop on Windows & MacOS container escape, CVE-2025-9074 -- proof of concept was included so a simple demo of arbitrary file write & file read on the host: youtu.be/dTqxNc1MVLE
the recording of my talk on the Black Hat show floor is up on yout00b :) youtu.be/whhOYRWd_rs
Iβve been exploring what it means to be an AI-native PM. Marily Nikaβs workflow feels like the state of the art.
Perplexity for user research filtered to Reddit, custom GPTs for specs in her voice, and v0 for UI mockups. Prototypes in hours, not weeks.
Hardest part is getting the tools approved.
anyone working in security knows
that tools can be used for good or for evil
but dont forget they are often used for stupid
OpenAI released their long-promised open weight models today under clean Apache 2 licenses and with benchmarks that put them shockingly close to o3-mini and o4-mini
I've run the smaller (20B) model on my Mac and it's very impressive, despite only using ~15GB of RAM simonwillison.net/2025/Aug/5/g...
The second challenge in our monthly CTF series is out! This time focused on a container escape.
The crazy fast secret discovery program I wrote in Rust has been open-sourced. Check it out!
Iβve always liked the Amazon βone way door vs two way doorβ analogy for this type of decision making:
m.youtube.com/watch?v=rxsd...
If you never used the Piper extension, I recommend to watch the 4-minute demo I gave last year during my talk at
NorthSec π οΈ
Nice clear explanation of how GitHub roll out new implementations of features out that get 2,000 queries a second - including dark-shipping to 1% of users where the new implementation is invisibly compared with the production one via a background job
Double-Clickjacking, or "press buttons on other sites without preconditions". After seeing and experimenting with this technique for a while, I cooked up a variation that combines many small tricks and ends up being quite convincing.
Here's a flexible PoC:
jorianwoltjer.com/blog/p/hacki...
In case you've a hard time intercepting Firefox traffic to the loopback interface, open the about:config page and set "network.proxy.allow_hijacking_localhost" to True π
Thanks @onemask.bsky.social for the tip π
Pink Draconian (who apparently isn't on Bluesky π’) published a walk-through of the "Damn Vulnerable RESTaurant" app
The video contains some pretty good tips related to Burp Suite, give it a look!
youtu.be/CdVTG3aWTew?...
As LLMs and AI-powered IDEs like Cursor are transforming how we code, security tools havenβt kept up. That's why we built our MCP server, which gives LLMs the ability to use Semgrep (kind of like how ChatGPT uses Python for math).
π semgrep.dev/blog/2025/gi...
My interactive AWS NAT Gateway blog post is now published. Check it out at malithr.com/aws/natgatew....
UC - Web Sockets
Just dropped another completely free API security lesson on JustHacking, this time weβre looking at WebSocket APIs. In this 30min lesson youβll learn what a WebSocket is and the types of apps that use them, how to communicate to WebSockets and some of the security issues in them!
programmers are always posting like "worked on tracking down an issue with a Flurble deployment for twelve hours. the problem wasn't in Flurble at all - it was in the Gumbies install. It turns out if you install Gumbies 3.0 over Gumbies 2.7 and don't do a cache flush on all the client spiders they'll get stuck in the crystal maze." then you look up Gumbies and the site is one of those scroll scroll scroll types with one sentence per page, like "GUMBIES is a lean, expressive sharding sandcube for testing and deploying large scale Woodchips playgrounds. GUMBIES automates and streamlines away watersliding phases, meaning your team can get right to the chipping. See why Microsoft, OpenAl and Bloingo have embraced GUMBIES in their Woodchips workflows." and you get to the bottom and you're like I want this I guess but I still don't know what
This is my entire life
Generated a few fuzz harnesses using new local models, OlympicCoder was best, fixing own bugs zero-shot & few hallucinations
Open R1 OlympicCoder 32B
DeepSeek R1 Distill Qwen 32B
QwQ 32B
Gemma-3-27b-it
All 4bit quant. Coder was by bartowski, the rest were Unsloth dynamic quant
I'm taking requests for my BSides Rekjavik k8s talk.
* Do you want a demo of something?
* Talk about something specific?
* A new tool that could use a boost?
Serious and/or sarcastic accepted.
Please reshare because the algorithm still needs tuning
cfp.bsidesreykjavik.com/2025/talk/KP...
