CryptoCat @_CryptoCat

Security Researcher 😈 Hacking Content @ https://t.co/U7jVhNr9sC 💜 cryptocat.me Not Here Joined May 2016

Tweets

8K
Followers

8K
Following

199
Likes

71K

RootSys @RootSysAt

6 days ago

🚨 Next.js and the Mutated Middleware [CVE-2025-57822] - a powerful SSRF primitive enabling full control over HTTP methods, headers & URLs. See how a subtle middleware bug can result in a high-impact vulnerability: 🔗 blog.rootsys.at/posts/nextjs-a… #AppSec #Nextjs #SSRF

1 46 146 17K 92

watchTowr @watchtowrcyber

3 days ago

GoAnywhere MFT, CVE-2025-10035, conspiracy theories, quiet advisory updates and IoCs with no ITW exploitation. Welcome back. labs.watchtowr.com/is-this-bad-th…

1 42 88 10K 22

Mat Rollings @stealthcopter

3 days ago

REGEXSS: How .* Turned Into over $6k in Bounties Overly-greedy regex replacements can break HTML sanitisation & lead to XSS. Includes a live demo you can try exploiting it yourself! sec.stealthcopter.com/regexss #BugBounty #BugBountyTips #XSS #AppSec

1 40 200 9K 125

CryptoCat @_CryptoCat

4 days ago

Solved a couple of reversing challenges in the K17 CTF at the weekend! 🚩 book.cryptocat.me/blog/ctf/2025/…

0 2 26 1K 4

Download Image

ezzer @ez_z3r

7 days ago

Made a writeup on a critical CVSS 10.0 vulnerability I've recently found. Check it out, maybe you'll manage to make into a full config independent RCE. blog.z3r.ru/posts/spring-c…

2 25 107 10K 79

Mushroom キノコ @MushroomWasp

a week ago

Wrote those chals in Connectors CTF 25! • Full-Stack Disaster: Long RCE chain: Nginx → XSS+CSP bypass → admin XSS/CSRF → .ejs SSTI → RCE mushroom.cat/ctf/full-stack… • cat flag.png: Leak flag.txt via error-based CMD injection and flag.png via DNS exfil mushroom.cat/ctf/cat-flag-p…

0 1 8 670 1

Download Image

CryptoCat @_CryptoCat

a week ago

AI-assisted patch diffing of an n-day vulnerability to create a PoC for bug bounty 🔥 blog.r4.dk/posts/ndaydev/

0 0 3 453 1

Jorian @J0R1AN

2 weeks ago

While playing a challenge by @salvatoreabello, I found a pretty interesting way to exploit Dangling Markup with a strict CSP. All you need is an <iframe>, <object> or <embed> set to about:blank, with a dangling name= attribute. This vulnerable page should be iframable.

1 36 225 23K 156

Download Image

ryuku @malekmesdour

2 weeks ago

If you want to learn how to bypass WAF to exploit a Boolean-based blind SQL injection manually, this blog post is for you. A walkthrough of an SQLi I found with @xUzunDz on a bug bounty target behind Cloudflare's WAF blog.ryukudz.com/posts/sqli-waf… Enjoy ☕ #BugBounty #BugBountytips

6 25 87 6K 93

Jorian @J0R1AN

2 weeks ago

Bit late but this is a nice challenge, worth trying if you haven't already :D Otherwise, my solution is below, it's a really fun technique that makes me re-evaluate all the .source checks I've seen before...

omid @omidxrz

4 months ago

5 9 106 25K 70

Download Image

3 12 80 11K 62

CryptoCat @_CryptoCat

2 weeks ago

DEF CON 33 - 40 Years Of Phrack: Hacking, Zines & Digital Dissent youtube.com/watch?v=TW-D1I…

0 0 10 1K 5

Justin Gardner @Rhynorater

2 weeks ago

Amazing episode with @PortSwiggerRes's @albinowax. Back when I started the pod in 2023, I envisioned episodes just like this. High signal, technical, depthful. If you're gonna catch any episode of CTBB, this would be a good one: youtu.be/aVfhWj3z6gk

2 21 139 15K 50

CryptoCat @_CryptoCat

2 weeks ago

Two game hacking talks today at @bsidesbelfast 🔥 First one from Rebecca Martin on spreading malware via Sims mods. Another from Matthew Reaney on the history of game console hacking 🎮

1 3 9 962 1

Download Image

CryptoCat @_CryptoCat

2 weeks ago

Real hackers drink club mate 😅 Also, some battlebots @bsidesbelfast 🤖

1 1 14 886 0

Download Image

CryptoCat @_CryptoCat

2 weeks ago

Second @bsidesbelfast talk on vibe coding and AI security by Ciaran Conliffe ✅️ Interested in LLM hacking? Check out the ongoing AI CTF by Hack The Box x HackerOne 🧠 ctf.hackthebox.com/event/details/…