alex @insertScript

@[email protected] # https://t.co/liE6hop4OX Array(10).join('a'-1)+ Batman! #Cure53 Joined June 2012

Tweets

2K
Followers

7K
Following

217
Likes

13K

skull @brutecat

2 weeks ago

StubZero: $148,337 RCE in Google Cloud Production brutecat.com/articles/googl…

16 171 737 81K 423

0 0 1 1K 3

View Details

alex @insertScript

2 weeks ago

@magicmac2000 I had to double check that this is actually a new post from you. Nice to see back giving browsers a hard time :-D

1 0 1 261 0

View Details

FFFF the axios thing is bad, almost all node.js project use it, we use it. didn't want to install some tool with a bunch of deps just to check if our gcloud/docker images are affected, trivy literally got supply chained two weeks ago lmao built me a small tool. stdlib only, just shells out to docker/gcloud cli. if those are compromised we're all cooked anyway. CHECK YOUR IMAGES. github.com/hacktronai/cull

4 11 78 15K 49

View Details

alex @insertScript

2 months ago

@AmirMSafari Well I learned a lot trying to solve this challenge. But mainly I was reconfirmed that @kinugawamasato is basically living in browsers. Took him 1 hour 11minutes to solve it (assuming he read my message sharing this challenge frame perfect)

0 0 3 332 0

View Details

alex @insertScript

2 months ago

@shhnjk Hm does that work with img and alt text as well 🤔Would be funny especially when you have full control of the remote image

1 0 3 266 0

View Details

alex @insertScript

3 months ago

Again just a quick JS PoC (nothing new, just some PoC to try it): JS Array length of 4294967295, and push vs [][length]=value behavior. Push fails, assignment works but length value isn't increased anymore. Don't really see how this can be abused. insert-script.com/examples/javas…

0 1 7 812 6

View Details

Nadim Kobeissi @kaepora

3 months ago

Your chance to be part of a historic event for cryptography education in the Levant is still open! The CFP for Cedarcrypt, the most ambitious and exciting cryptography event in the Levant region in recent memory, has a deadline of April 10 and we still have room in the program. If you've been meaning to submit a talk, workshop, or research presentation, now's the time. We want hands-on workshops, lectures on both foundational and real-world topics, and research talks including work in progress. Topics range from post-quantum crypto and ZK proofs to secure implementation and protocol verification. We're also still actively seeking sponsors. Sponsorship funds student stipends directly — it's how we make the event accessible to grad students and early-career researchers worldwide. If your organization is in this space, let's talk. Accepted speakers get travel support, free registration, and accommodation help. July 13–16, Paphos, Cyprus. Join us in making a real difference in how real-world cryptography is taught in the Levant! Come meet and engage with excited new students! cedarcrypt.org

0 5 14 2K 0

View Details

alex @insertScript

3 months ago

@rebane2001 The only solutions I can think of: Overwrite the prototypes - Number or Object use document.all as the one exception. Afaik no symbols are utilized sadly for this operator.

0 0 0 127 0

View Details

LiveOverflow 🔴 @LiveOverflow

3 months ago

We take a closer look at the 2nd exploit, and sit down with @_manfp to learn about his research process. youtube.com/watch?v=NT1VCm…

6 67 393 21K 141

View Details

alex @insertScript

3 months ago

@garethheyes Given how much you always implement in your lunch time - do you eat with one hand and program with the other? :-D

1 0 0 185 0

View Details

alex @insertScript

4 months ago

@zhero___ First AmirMSafari publishes an interesting parsing quirk of qs - you are going to (hopefully) publish a report about a new cross-site data exfiltration technique. I like the start of the year .-D

1 0 6 880 0

View Details

alex @insertScript

4 months ago

@LiveOverflow hahaha thats just awesome xD

0 0 1 147 0

View Details

AmirMohammad Safari @AmirMSafari

4 months ago

Thanks for participating in this challenge! I analyzed the qs parser source code and wrote about the inconsistency between the backend and frontend query parsers, along with two possible solutions. Hope you enjoy it! blog.voorivex.team/when-two-parse…

AmirMohammad Safari @AmirMSafari

4 months ago

Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.xyz

34 23 331 156K 268

14 29 183 14K 89

View Details

Justin Gardner @Rhynorater

4 months ago

Chrome auto decodes all url-encoded, non-special characters in the URL for the user. This can be annoying when you're trying to sneak a payload in that looks a little weird. You can bypass this by adding %ff anywhere in the URL.

5 39 387 16K 268

View Details

Nadim Kobeissi @kaepora

4 months ago

Come be part of Cedarcrypt, our historic new initiative to grow cryptography research, development and representation in the Levant region! For too long, the global cryptography community has concentrated its major events in a handful of locations, leaving entire regions underrepresented in the conversations that shape our digital future. Cedarcrypt is here to change that. This July 13-16, 2026, we're bringing together researchers, practitioners, and students at the American University of Beirut - Mediterraneo campus in Paphos, Cyprus, for four days of intensive learning, knowledge sharing, and community building. From secure messaging protocols to post-quantum cryptography, from zero-knowledge proofs to formal verification, Cedarcrypt aims to cover the full spectrum of applied cryptography. Cedarcrypt is about planting a flag and telling the world that real cryptography work can and does emerge from our region. Cedarcrypt aims to create a space where the next generation of cryptographers from the Levant and beyond can learn from established experts, present their own research, and forge connections that will shape their careers. We need you to make this happen. We're seeking workshop leaders to teach hands-on skills, lecturers to share foundational and cutting-edge knowledge, and researchers to present their latest work. Whether you're a seasoned professor or an early-career researcher with fresh ideas, there's a place for you at Cedarcrypt. This is the first edition of what we intend to become an annual tradition. Come be part of our history! Help us build something that will inspire and empower cryptographers for years to come. Our call for proposals is open: submit your workshop or talk, or simply learn more about Cedarcrypt at cedarcrypt.org!

1 7 38 13K 12

View Details

alex @insertScript

5 months ago

@samm0uda uh nice! :-)

0 0 1 174 0

View Details

zhero; @zhero___

5 months ago

Happy to publish our first research of the year on the SvelteKit framework, downloaded over 800,000 times per week, which led to CVE-2025-67647 (w/@inzo____): Avoiding the paradox: A native full-read SSRF and one‑shot DoS in SvelteKit zhero-web-sec.github.io/research-and-t… Enjoy the read

8 61 343 16K 128

View Details

Youssef Sammouda (sam0) @samm0uda

5 months ago

Leaking FXAuth Token leading to account takeover ($65,000) ysamm.com/uncategorized/… Instagram account takeover via Facebook Pixel script abuse ($32,500) ysamm.com/uncategorized/… Multiple XS-leaks disclosing Facebook users in third-party websites ($8,400) ysamm.com/uncategorized/…

16 112 698 30K 389

View Details

alex @insertScript

5 months ago

Quick browser documentation PoCs (nothing new, just some PoCs to try it): Postmessage with null origin and null source- insert-script.com/examples/ifram… Authorization header and redirects - relevant for client side path traversal insert-script.com/examples/redir…