Sabitlenmiş Tweet
[Blog Post] Flickr: Zero User-Interaction Account Takeover
👉 security.lauritz-holtmann.de/advisories/fli…
👉 hackerone.com/reports/1342088
#appsec #sso #aws #cognito #flickr #bugbounty
English
Lauritz
1.6K posts
Lauritz
@_lauritz_
IT-Security Researcher, Pentester and Bug Hunter. Passionate about 💻, 🤽♂️, ⚜️, 🎸 and ⚽ (@VfLBochum1848eV ) #Kaeferjaeger + H1 Ambassador
Germany Katılım Nisan 2012
997 Takip Edilen2.1K Takipçiler
Lauritz retweetledi
🚨 ZERODAY: ImageMagick 🚨
Our autonomous pentester pwn.ai just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯
💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰
pwn.ai/blog/imagemagi…
English
Lauritz retweetledi
I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏
clawd.it/posts/10-repla…
#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai
English
Honored to be selected as a Hacker Ambassador for Germany 🇩🇪 in the new @intigriti Ambassador Program.
Excited to support the ethical hacking community and help grow bug bounty 🤝
Learn more 👇
intigriti.com/blog/business-…
Badge 🏅
app.intigriti.com/profile/c1phy?…
English
@MrTuxracer @Hacker0x01 @printfection Extra work for paper receipts (if any) handed out by delivery persons. Plus having to pay in cash (while the delivery person in most cases has no change). 😂
English
@_lauritz_ @Hacker0x01 @printfection If you received the gift in connection with your freelance work, you can fully deduct the costs as a business expense and reclaim the VAT with your preliminary VAT return. So why do you even care 🙂?
English
Swag from @Hacker0x01 is sent by @printfection (now Swag Pro).
It is sent with "Recipient pays VAT": help-center.swag.com/hc/en-us/artic…
I see that switching to "Shipper Pays Customs" would increase the costs for H1. Would it be possible to pay these additional costs as recipient? 1/3
English
Why am I asking?
While the VAT is not that much (€1,41), @DHLPaket is so nice to add €7,50 to each swag item received from @Hacker0x01, which is suboptimal IMO.
To my understanding, this could be prevented if someone covers the extra costs for "DDP" via @printfection.
2/3
English
@ITSecurityguard @senorarroz Yeah, I also do not get their wording and especially marketing and timing.
Weren't the first concerns regarding the TOS changes posted already early this week? Why not transparently address these first?
Instead, vague marketing videos like x.com/hacker0x01/sta… are posted.
HackerOne@Hacker0x01
Point-in-time pentests can’t keep up, while fully autonomous testing creates noise. The solution? HackerOne Agentic PTaaS pairs specially trained AI agents with elite human validation to deliver results based on real-world exploitability, not theory. This 50-second video shows you how it works.
English
@senorarroz Where is that "years of pentest experience" coming from? I do want to believe that the agents are not trained on researcher submissions, but your vague marketing material does not do it any favour.
hackerone.com/blog/agentic-p…
English
Lauritz retweetledi
A researcher found that the List-Unsubscribe email header, designed to help users leave mailing lists with one click, can become a stored XSS and blind SSRF gadget when webmail clients auto-render unsubscribe buttons. A single malicious email header becomes a cross-surface attack as JavaScript URIs execute when clicked in Horde Webmail (CVE-2025-68673), while server-side unsubscribe handlers in Nextcloud Mail App trigger blind SSRF to internal destinations.
Full write-up by @_lauritz_ 👇
security.lauritz-holtmann.de/post/xss-ssrf-…
#BugBounty
English
Bug Bounty Meetup vol. 5 of the German @Hacker0x01 club will be held Feb 14th to Feb 22nd (remote). 👨💻
20 seats, swag, remote space for networking, a bug bounty target and lots of collaboration.
RSVP now: h1.community/e/mbcd6v/
English
[Blog Post] Turning the List-Unsubscribe SMTP Header into an SSRF/XSS Gadget
security.lauritz-holtmann.de/post/xss-ssrf-…
Once again, ancient RFCs and overlooked security hot spots in specifications turned out to be worthwhile for security research.
Read the spec!
English
This is really cool writeup.
Self-XSS + Login CSRF + SSO gadget to ATO
Nice find @_lauritz_!
security.lauritz-holtmann.de/post/xss-ato-g…
English
I realized this is indeed an issue.
Good to see, that BB has become somewhat the new expectation towards companies, as IMO it is a crucial tool for security.
BUT: Keep in mind what VDP/BB policies brought us: Safe Harbour Agreements and PERMISSION TO TEST in a certain scope.
dawgyg - WoH@thedawgyg
Bug hunting on random sites without written permission or a publicly posted VDP/BBP is a crime.
English