expl @Exploitati0n

Just an exploit seeker and curious noob. jonatas.wtf 🇧🇷 Joined January 2019

Tweets

356
Followers

352
Following

325
Likes

4K

caon @_caon__

3 weeks ago

🚨 CFP aberto — Bug Bounty Village @ H2HC 2025 🚨 Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty? Manda sua talk! 👉 docs.google.com/forms/d/e/1FAI… #H2HC #BugBounty #Call4Papers #HackerCulture

0 7 16 3K 4

James Kettle @albinowax

a month ago

This is some really nice research! It's definitely worth trying these techniques against cryptocurrency extensions! marektoth.com/blog/dom-based…

3 53 313 19K 262

TRAMOIA @tramoia_sh

4 months ago

CHAMADA DE ARTIGOS 2025 Mais artigos, novos autores, pwnage e 0days. Com esses objetivos iniciamos a nova Chamada de Artigos 2025 para a segunda edição! Envie seu artigo para : [email protected]

1 27 99 6K 13

Download Image

Mayfly @M4yFly

7 months ago

New Active Directory Mindmap v2025.03! 🚀 📖 Readable version: orange-cyberdefense.github.io/ocd-mindmaps/i… 🔧 Now fully generated from markdown files—way easier to update and maintain! 💡 Got improvements? PRs welcome! 👉 github.com/Orange-Cyberde…

9 332 887 39K 686

Download Image

zhero; @zhero___

8 months ago

very pleased to announce the release of my new article based on my research that led to CVE-2024-46982 titled: Next.js, cache, and chains: the stale elixir zhero-web-sec.github.io/research-and-t… note: does not cover the latest findings shared in my recent posts enjoy reading;

45 244 1K 208K 507

Download Image

Artur Marzano @MacmodSec

10 months ago

ADCS Attack Techniques Cheatsheet for all of you lazy folks who prefer colored tables over reading a bunch of articles just to find some specific information: bit.ly/adcs-cheatsheet

6 177 501 28K 382

Sam Curry @samwcyo

a year ago

New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate. Full disclosure: samcurry.net/hacking-kia

88 1K 4K 338K 1K

Download Video

watchTowr @watchtowrcyber

a year ago

In August, watchTowr Labs hijacked parts of the global .mobi TLD - and went on to discover the mayhem that we could cause. Enjoy.... labs.watchtowr.com/we-spent-20-to…

9 129 347 49K 128

expl @Exploitati0n

a year ago

Yay, I was awarded a $1000 bounty on @Hacker0x01 for a 1-Click RCE vulnerability! Collab with my bro @LuskaBol hackerone.com/xpl #TogetherWeHitHarder

0 0 30 1K 4

Orange Tsai 🍊 @orange_8361

a year ago

PHP just fixed one of my RCE vulnerabilities, which affects XAMPP by default. Check to see if you are affected and update now! 🔥 blog.orange.tw/2024/06/cve-20…

12 346 1K 133K 313

5pider @C5pider

2 years ago

Modern implant design: position independent malware development. A small blog post on how to design "modern" malware with features like global variables, raw strings, and compile-time hashing. 5pider.net/blog/2024/01/2… Repo: github.com/Cracked5pider/…

25 309 982 137K 558

Sam Curry @samwcyo

2 years ago

“Rook to XSS: How I hacked chess[.]com with a rookie exploit” skii.dev/rook-to-xss/ Really great read! If you’ve never looked, chess.com has a great off-platform bug bounty program via [email protected]

8 115 445 36K 207

celesian @c3l3si4n

2 years ago

This is a very unknown technique. Tried googling it and found no results, so maybe even a novelty. This allows you to dump all domains from a Cloudflare user by doing nameserver correlation. Great for finding base domains owned by the company. celes.in/posts/cloudfla…

1 25 140 16K 84

TRAMOIA @tramoia_sh

2 years ago

tramoia.sh ??.??.2024

14 122 315 41K 58

Download Image

Swissky @pentest_swissky

2 years ago

"A tale of making internet pollution free" - Exploiting Client-Side Prototype Pollution in the wild - @S1r1u5_ blog.s1r1us.ninja/research/PP

0 19 47 5K 21

celesian @c3l3si4n

2 years ago

Sharing my experience with alias path traversals on nginx, and how we leaked sensitive data on Bitwarden and GCP with that. Along with that, we also released a tool called navgix to check for the presence of these vulnerabilities in an automated manner. labs.hakaioffsec.com/nginx-alias-tr…

7 102 232 29K 77

Hillai Ben-Sasson @hillai

3 years ago

I hacked into a @bing CMS that allowed me to alter search results and take over millions of @Office365 accounts. How did I do it? Well, it all started with a simple click in @Azure… 👀 This is the story of #BingBang 🧵⬇️

258 3K 15K 3.2M 5K

Download Image

Nagli @galnagli

3 years ago

The team at @OpenAI just fixed a critical account takeover vulnerability I reported few hours ago affecting #ChatGPT. It was possible to takeover someone's account, view their chat history, and access their billing information without them ever realizing it. Breakdown below 👇

86 726 3K 675K 1K

Download Video

Sam Curry @samwcyo

3 years ago

We recently found a vulnerability affecting Hyundai and Genesis vehicles where we could remotely control the locks, engine, horn, headlights, and trunk of vehicles made after 2012. To explain how it worked and how we found it, we have @_specters_ as our mock car thief: