Hxuu

@ippsec It seems that the more accessible information is, the less likely people seek it (at least in my undergrad experience, and correlation doesn't imply causation). I'm really excited by the fact that I can learn pretty much everything nowadays.. Can't wait to be a better hacker

It's really crazy to think about when I was in school, we could play a game called Oregon Trail. Essentially an RPG where you travel across the US and figure out which of your friends dies of horrible diseases like Dysentery. The crazy part here is we are in a computer lab, not knowing what Dysentery was. So we had to leave the computer, go to the library, find the book and look it up. Nowadays, my phone may accidentally think I'm asking it a question and tell me the answer "unprompted". People underestimate just how accessible information is nowadays. Also wtf. Looking back, I'm sure the computer had a built-in dictionary... Was that the teacher's cruel joke of "if you knew how to use a computer, you wouldn't need to use the library?" lol. Did I miss the lesson completely because I thought it was leisure time?

@ippsec thanks for the therapy session. I still haven't invested money on AI as much as I should have. How do you recommend a undergrad student to learn the most about it while it's cheap?

I see many people demotivated due to AI and feels like its been a while since I ranted. Probably a mild take but here is how I stay motivated. Nothing really new just how I use what people have said to keep my motivation up. The normal 2026 disclaimer, what is in this post isn't actually 100% in line with my opinion; yes I know there are holes in my logic but some rabbit holes are best "on read". The biggest change for me is Linus Torvalds saying something along the lines of idk why people say AI makes things, people make thing. If communication was so global in the 70's I am sure people would have said similar things during the conversion from assembly to C. Humans are creating instructions for the compiler to make a program. So why didn't we think the compiler made it? Without internet I think it would take me around 2 minutes to write hello world in C (i know embarrassingly slow but man have i gotten lazy over the years). Do it in assembly? That's probably an hour. Which is a 30x difference of time. Okay now lets say we are in the year 2010 and have Python. I timed myself and it was 3 seconds. That's a 40x time difference from my C. Why did I think I made the program and not python made it? Unfortunately, the only thing I can come up with is how much we communicate and how quick ideas/sentiments can form. I'm sure C/Python got hate when they first came out. Hate can be a really goo fuel -- Most engineers I know have their best work come out of "hate coding" something to prove someone wrong. Only to later realize they social engineered themself into doing an amazing thing. Could be wrong here, but I think Pythons Flask is a good example of this as it started as an April fools joke. Quite literally "the most engineer thing ever" to have a funny joke spiral out of control and grow beyond their wildest dreams... Kind of like that guy that was vibe coding games last year when AI was "bad", or heck even the W̷a̷r̷e̷l̷a̷y̷ C̷L̷A̷W̷D̷I̷S̷ ̷C̷l̷a̷w̷d̷B̷o̷t̷ ̷M̷o̷l̷t̷B̷o̷t̷ ̷ err OpenClaw person. Really with all those name changes I'm shocked they landed at OpenAI instead of MSFT. Anyway, our hate on vibe coding created the sentiment that we aren't creating things anymore (AI makes things). I don't really view it that way, AI just makes me 20-30x faster; which is similar to the jumps between Assembly -> Compiler -> Scripting. Actually now that I think about it, I remember trying to learn C many times because scripting wasn't a "real language" and it would never run a web server or it wasn't capable of editing memory (silly times indeed). AI is enabling us to develop faster and expanding the number of people that can do things, which is not new; quite literally every time we come up with a new way to interact with machines -- it does the same thing. So yes - Anyone can make a cool demo that looks real now but they are still going to spend hours getting AI to work out all the bugs and do it better. To me they are still making something, it is other people telling them they aren't -- Funnily enough, those people trying to convince others they aren't making things, is what in return demotivates themself because it poisons their thought process when it comes to this topic. So uh. If you look for my permission to learn something? Vibe on and let the good times roll. Just make sure you do things safely, obey terms of service, and try not to end humanity. Oh wait. That disclaimer. Using AI in a way that causes humans to spend a lot more time than they are used to is bad mmkay? Seeing all the low effort CTF Work, blog posts, bug bounty, etc does get annoying... oh wait I have a diclaimer to the disclaimer. If you use AI to eat up time of scammers, like tricking call center scammers into chatting with robots for hours, I thank you for your token donation to helping fight that plague.

@fancymalware thank you!!

@hxuu0 incredible work - gg!

Sekai challenges done :) Moving onto the next thing. All web writeups can be found here: vhxuu.xyz/tags/sekai26/

- devilhunter_55: Crypto – apbq-rsa-iv drive.google.com/drive/folders/… - el_s1na: Pwn – ppp epsilons1na.github.io/posts/sekai_ct… - @hxuu0: Web – <\w+ vhxuu.xyz/blog/sekai26/l… - mushsh: Web – EnD mushroom.cat/ctf/http-desyn… (2/4)

@0xrudrapratap How can I extend this? Good blogs like huli's, mizu's and the others are goldmine in client-side

The best hackers I know aren't smarter than me. They've just read more than me. Somewhere in their memory is the one obscure writeup that turns a dead end into a finding. Preview is that memory, on tap. For you, and for your agent. -> rag.preview.is

@es3n1n lesgooo

a quick sekaictf 2026 infra writeup (with a new blog theme) blog.es3n1n.eu/posts/sekaictf…

Sekai 2026 was fun. Definitely doing writeups for all the challenges inshallah

@Alra3ees أسأل الله أن يطهرك من المرض كما يطهر الثوب الأبيض من الدنس. Come back stronger! We're praying for you

I have been suffering from an acute heart attack in the coronary artery for twenty days now, with surgery scheduled for the end of this month, and I need your prayers. If I don’t tweet again, please pray for my mercy. And if I have wronged anyone, I sincerely ask for forgiveness.

@fwarashi lesgoo, looking forward :)

今日か明日、新作動画出ます❗️

@fwarashi Indeed true. I felt the exact feeling you felt when we held a local CTF for which a video of someone thanking for my challenges made me feel awesome. On the other hand, we banned a team that used AI (We had no AI policy) Challenge was about github action poisoning btw :)

作問者的には参加者が悩んだり、色々試行錯誤して楽しかった！と言ってもらえることに意義を感じており、 なんかわからんけどAIが解けたわ！と言われると、悲しい

@adibhanna @the_yamiteru I second this, my workflow is very terminal heavy, but I just like separation between my playground and my notes

@the_yamiteru i created one already. Im building this separately because it adds flexibility to how i render the notes. Also, i personally like the separation between vim and my notes

I'm building a note-taking app that is Vim first; you can't use it if you're not familiar with Vim motions. It will be open source

@deadvolvo I always feel lazy after 3-4 months of continuous work. Maybe take rest?

I have never seen such lazy bug hunting in my life so far.

@medusa_0xf Ugh, that sucks. A dup doesn't invalidate that you found the bug though, I find that appreciable

Welcome to Bug Bounty 🤍

@deadvolvo What do you need to start and what are some resources?

I am getting more and more interested in Cellular Telecom Security Research as a side project. 🤔

@fwarashi I'm curious to know what other activities those can be, if you find anything interesting, please do share!

CTFもいいけど、CTF以外の楽しい活動にもそろそろ目を向けていきたい

Solved @ptrYudai's OpenBio :) Wonder if there's some meta analysis about cookie ordering in different frameworks, the RFC mentions that some frameworks "erroneously" depend this order. Anyways, excellent challenge. Thank you Yudai ! vhxuu.xyz/blog/alpacahac…

@piyushgarg_dev algorithm confusion? do {"alg": "RSA"} or something like this

There’s a very dangerous JWT vulnerability hidden in these 7 lines 👀 Most developers won’t spot it. If exploited successfully, an attacker can: - Bypass login entirely - Impersonate any user

@dudcom3 I'm new to rev, up to what level do you consider it "overkill" in the ai era? or it's always good to learn more?

rev is dead its so horribly dead, you either can't make it rev or you have to make stupid guessy rev fuck this !

3/idk_how_many solved :) This one was about POP Chains vhxuu.xyz/blog/alpacahac…