English
hashkitten
Report

hashkitten

@hash_kitten

vulnerability research @assetnote // hacking // codegolf // ctf with 🛹🐶

  • Joined
191 Following4.6K Followers31 Posts
  1. hashkitten@hash_kitten
    hashkitten
    RT @TantoSecurity: We are beyond giddy to be releasing tturl, the HTTP/2 CLI for finding tiny timing differences and winning request races. Our Director of Research @justinsteven can't wait to tell you all about it at @BSidesCbr today, 3:15PM on the main stage 😎
    06015
  2. hashkitten@hash_kitten
    hashkitten
    RT @kevin_mizu: Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇
    055028
  3. hashkitten@hash_kitten
    hashkitten
    RT @calif_io: wp2root as promised :-) Our chain is nothing fancy. Its value is in showing what real-world PHP hacking actually looks like, and how far AI has come. Cooking up a chain like this would usually take a skilled operator a few weeks; we did it with Codex in under an hour. The slow part was writing this article, explaining each step for readers without that background. This is how hacking is becoming. You write clear English prose describing what to do, and the model does it. Feed our article to your favorite model and it will happily reproduce the whole chain. But that raises a harder question. Directing the model takes knowing what is possible, and that knowing usually comes from having done the work yourself. If the model does the work from now on, where does it come from? We learned it the slow way, by hand, over years. How the next person learns it, once the slow way is optional, we honestly do not know. We do know one thing, though. You can outsource the hacking, but not the understanding.
    033043
  4. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: Things are getting weird (or interesting?) in the vulnerability research space. I published some of my personal thoughts on what we're seeing and what our broad strategy is here:
    0101021
  5. hashkitten@hash_kitten
    Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself -
    1620171680.1K
  6. hashkitten@hash_kitten
    I reported a pre auth RCE in Wordpress - it can be exploited with no preconditions, patch your instances!
    312281K204K
  7. hashkitten@hash_kitten
    hashkitten
    RT @kevin_mizu: It was a really fun event! Thanks to @Hacker0x01 and Salesforce for the invitation! I'm really happy that we won Best Hacker and Best Team with @Geluchat, @hash_kitten, and @infosec_au! 🎉 :D
    HackerOne @Hacker0x01
    Congratulations to the winners from our Live Hacking Event with @Salesforce in Tokyo! 🎉🇯🇵 First place: Metnew (@v_metnew) Second place: Geluchat (@Geluchat) Hashkitten (@hash_kitten) kevin_mizu Shubs (@infosec_au) Third place: adibou snorlhax Collaboration: Aussie Baguette Best Hacker: Aussie Baguette An incredible week of collaboration, creativity, and impact from the global security researcher community. In the agentic AI era, live collaboration helps organizations identify and remediate vulnerabilities faster. Thank you to everyone who participated and made the internet safer. 💻🔍
    0709
  8. HackerOne✓@Hacker0x01
    Congratulations to the winners from our Live Hacking Event with @Salesforce in Tokyo! 🎉🇯🇵 First place: Metnew (@v_metnew) Second place: Geluchat (@Geluchat) Hashkitten (@hash_kitten) kevin_mizu Shubs (@infosec_au) Third place: adibou snorlhax Collaboration: Aussie Baguette Best Hacker: Aussie Baguette An incredible week of collaboration, creativity, and impact from the global security researcher community. In the agentic AI era, live collaboration helps organizations identify and remediate vulnerabilities faster. Thank you to everyone who participated and made the internet safer. 💻🔍
    Download
    51116234K
  9. hashkitten@hash_kitten
    Thanks everyone for playing! I talk about the solution here, as well as how I discovered this behavior while looking into the Chrome Sanitizer API:
    hashkitten @hash_kitten
    Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only!
    22716641.3K
  10. hashkitten@hash_kitten
    Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only!
    192121163.8K
  11. hashkitten@hash_kitten
    hashkitten
    RT @slonser_: I didn't really want to get involved in the discussion about the "death of CTF" because of AI. But the conversations on Twitter keep going, so I'll express my thoughts in this thread. For those too lazy to read — CTF will live on. For the rest, I suggest reading the thread below.
    040030K
  12. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: Sometimes you spot a sink and know it's vulnerable, but proving it is a challenge. @SLCyberSec's team broke through layers of crypto to reach a pre-auth deserialization sink in OpenText Directory Services. Breaking the encryption was a journey.
    068017.9K
  13. hashkitten@hash_kitten
    hashkitten
    RT @kevin_mizu: Two weeks ago, I did my first (in-person) @Hacker0x01 LHE in Singapore! I worked with @hash_kitten and @infosec_au, and I'm really happy with how it went and what we found :D (We won the Best Team and Best Bug awards! 🔥) It was an amazing event, thanks @Hacker0x01! 😁
    HackerOne @Hacker0x01
    Our #H165 live hacking event with @tiktok_us and @okx in Singapore was a big success! It's time to celebrate this year's winners. Here we go... 🥁 For TikTok: Eliminator: avishai Exterminator: kevin_mizu, shubs, hashkitten Vigilante: m4II0K For OKX: Eliminator: hackerontwowheels, ledz1996 Exterminator: corraldev Vigilante: corraldev Overall: Community choice: nadino Best collab: kevin_mizu, shubs, hashkitten & hackerontwowheels, ledz1996 Most valuable hacker: corraldev
    06014.1K
  14. HackerOne✓@Hacker0x01
    Our #H165 live hacking event with @tiktok_us and @okx in Singapore was a big success! It's time to celebrate this year's winners. Here we go... 🥁 For TikTok: Eliminator: avishai Exterminator: kevin_mizu, shubs, hashkitten Vigilante: m4II0K For OKX: Eliminator: hackerontwowheels, ledz1996 Exterminator: corraldev Vigilante: corraldev Overall: Community choice: nadino Best collab: kevin_mizu, shubs, hashkitten & hackerontwowheels, ledz1996 Most valuable hacker: corraldev
    Download
    4613430.5K
  15. hashkitten@hash_kitten
    hashkitten
    RT @sk8boardingdog: LET'S GET THE BALL (BEARINGS) ROLLING ONLY 4 WEEKS LEFT UNTIL SKATEBOARDING DOG CTF @BSidesCbr 2025 WATCH THE COUNTDOWN ON OUR WEBSITE:
    0905.1K
  16. hashkitten@hash_kitten
    hashkitten
    RT @orange_8361: Turns out my #PHRACK article is live! 🔥 > The Art of PHP — My CTF Journey and Untold Stories! Kinda a love letter to those CTF players & PHP nerds! Hope all the credit goes to the right ppl. Also huge thanks to @0xdea for not forgetting me, @guitmz for the edits, and the @Phrack crew for keeping it real! 🎉
    0220067.6K
  17. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: This month's Christmas in July release from @SLCyberSec's Security Research team is a pre-authentication RCE vulnerability in Sawtooth Lighthouse Studio (CVE-2025-34300). This software is prevalent and hidden in plain sight. Read more on our blog:
    02709.9K
  18. hashkitten@hash_kitten
    hashkitten
    RT @BSidesCbr: Pre-auth bugs in enterprise software? Yes please. @hash_kitten takes us inside their research on Adobe Experience Manager—uncovering critical, pre-auth vulnerabilities in a platform powering 45,000+ sites. Live at BSides Canberra 2025:
    02809.8K
  19. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: To kick off our Christmas and July research posts, we explain how we achieved persistent XSS on every Adobe Experience Manager Cloud instance, not twice, but thrice! This is now patched across all of AEM cloud, but what an interesting attack surface!
    040017.2K
  20. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: We discovered a pre-authentication RCE vulnerability in Craft CMS caused by an obscure PHP foot gun (CVE-2024-56145), approx 150k sites created with Craft CMS. You can read @Assetnote's Security Research team's blog on the issue: #attacksurfacemanagement
    088029.4K
  21. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here:
    0218073.7K
  22. hashkitten@hash_kitten
    hashkitten
    RT @infosec_au: At @assetnote, we published our research on Magento's pre-authentication XXE (CVE-2024-34102). @hash_kitten and I reproduced this issue together. It is a brilliant vulnerability originally found by Sergey Temnikov. You can read our research here:
    0131031.6K
  23. Show more posts