breno_css retweetledi
CVSS' Attack Complexity metric is the bane of bug bounty hunters: "you tried really hard to find that bug, so we'll pay you less".
English
breno_css
130 posts
breno_css retweetledi
CVE-2025-6554: in-the-wild V8 the_hole based vulnerability analysis and exploit
Bug analysis by @r3tr074:
retr0.zip/blog/cve-2025-…
PoC by @mistymntncop:
github.com/mistymntncop/C…
#infosec
English
breno_css retweetledi
breno_css retweetledi
A comunidade de Bug Bounty Brasileira está fazendo um evento GRATUITO e trazendo gringo para palestrar.
Você de São Paulo ou q pode está nessa data em SP simplesmente VÁ nesse evento.
#Bolhasec
Maiores detalhes aqui neste tweet.
Alex Moshkov@amoshkov
🟥 Positive Hack Talks → São Paulo 🇧🇷 Dec 10th, 2025 🗣️ Speakers — submit papers (flights/hotel covered). CFP link in thread 👇 💻 Cybersecurity community — join our most community-driven event. ➡️ phtalks.ptsecurity.com/saopaulo Free · 8 talks · limited spots #PHTalks
Português
Multiple bugs chained to takeover Facebook Accounts which uses Gmail. ( $42k )
ysamm.com/?p=763
English
breno_css retweetledi
🚀 Orgulho nacional! 🇧🇷
Parabenizamos todos os envolvidos por essa conquista histórica! Vocês levaram o nome do Brasil ao topo e mostraram que nossa comunidade de CTF está cada vez mais forte e preparada para desafios globais!
🔗 Assista o vídeo em youtube.com/watch?v=5Yt3HG…
YouTube
Português
breno_css retweetledi
youtube.com/watch?v=5Yt3HG…
Obrigado @mentebinaria !
Não foi dessa vez mas DEFCON que nos espere ano que vem!
Até lá, como todos devem fazer sempre, estudaremos!
Obrigado novamente ao @hackaflag por nos receber!
YouTube
Português
breno_css retweetledi
Brazil made history last weekend, and of course, ELT was a part of it!
Thanks @GaneshICMC , @boitatech , @gris_ufrj and #hawksec_unifei for partnership! We got 17th place, the best brazilian result, at #DEFCONCTF Quals as "pwn de queijo"!
Thanks @hackaflag for hosting us!
Sao Paulo, Brazil 🇧🇷 English
breno_css retweetledi
Where there’s bug bounty, there’s #Bugcrowd. 😉✨
We’re honored to have supported the @BugBountyBr at H2HC in #Brazil, big thanks to @bsysop! Seeing the hacker community come together with such passion was nothing short of amazing (as always). 🥲
Huge thanks to the organizers, sponsors, and everyone who joined—you made it unforgettable! 🎉💚
English
breno_css retweetledi
NEW blog post: Netfilter Universal Root 1-day
Our latest blog dives deep into the state of Linux kernel security and the open-source patch-gap, exploring how we monitored new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.
Read more here →
0xTen@_0xTen
Earlier this year, I used a 1day to exploit the kernelCTF VRP LTS instance. I then used the same bug to write a universal exploit that worked against up-to-date mainstream distros for approximately 2 months. osec.io/blog/2024-11-2…
English
breno_css retweetledi
✍️ Pivoting Capabilities and Conquering the Linux Kernel by @_0xTen
youtube.com/watch?v=bxJhlw…
YouTube
English
breno_css retweetledi
Seeing that Pwn2Win isn't happening this year, here's an unreleased beginner-level XSS challenge I created for it (shouldn't be too difficult).
lbherrera.me/challenge
English
@jobertabma I think it's cool, but I would put this in a mutual-only (the first reporter can see the name of the person who took dup and the dup see the name of the first reporter) and also as an optional flag and only allow to be shared if both sides have this enabled(just like WhatsApp)
English
Hackers, do you have any concerns if we’d show your username + collaborator usernames of your report when someone submits a duplicate? Today we’re only showing severity and submission timestamp.
SergioΩhm@SergioFrami
@archyxsec @jobertabma I’m lately thinking that allowing a hacker to know who was the first in report the issue allows a discussion among hackers that can really help in less mediation cases open, as I could know first hand by another researcher if we have reported the same.
English
breno_css retweetledi
The results are in!🥇
Congratulations to these 32 teams who will move on to the Group Round of the 2024 #AmbassadorWorldCup! 🙌
The next round kicks off at the end of August! Stay tuned for the latest info, and read more about the AWC here. bit.ly/3SwGbkV
English
breno_css retweetledi
breno_css retweetledi
Today at #Troopers24 we released Certiception – the ADCS honeypot we always wanted to have.
Blog: srlabs.de/blog-post/cert…
Source code: github.com/srlabs/Certice…
Slide deck, including our guide to deception strategy: github.com/srlabs/Certice…
English
breno_css retweetledi
Decided to give my childhood game a try now that they relaunched Habbo's 2005 version back again, oops! (It was already reported and fixed).
English
breno_css retweetledi
"Additionally we set Attack Complexity to High because the attack depends on the victim being authenticated in their default browser" - Shopify
English
breno_css retweetledi
