Rhackgondins retweeted
Yesterday at @GrehackConf pre-event by @rootme_org & @TheLaluka, I presented my latest project: Hippie OSINT Toolkit (HOT). It combines techniques and tools I use into one place for quick checks w/o installing multiple tools.
🔗 osint.hippie.cat
🔗 github.com/hippiiee/Hippie-O…
2
10
43
3,620
Rhackgondins retweeted
I'm thrilled to finally share my research on HTML parsing and DOMPurify at @GreHack 2024 📜
The research article is available here: mizu.re/post/exploring-the-d…
The slides are available here: slides.com/kevin-mizu/grehac…
1/3
18
178
715
83,778
Rhackgondins retweeted
I recently reported an RCE to Happy-DOM (a Node.js HTML parser), and it’s now fixed!
The bug itself wasn't complex, but since finding an RCE in an HTML parser isn’t very common, I'm quite happy with this one :D
github.com/capricorn86/happy…
4
53
374
21,464
Rhackgondins retweeted
I was really surprised to see that the Cache API is exposed on window, allowing a simple XSS to hijack a service worker and achieve persistent XSS on most pages of a vulnerable website!
It might not be a new, but I feel like it is an incredible XSS leveraging gadget :D
My @HeroCTF #web challenges write-ups are now available! :D
mizu.re/post/heroctf-v6-writ…
Here's a short list of the topics covered 👇
- Express res.download
- Chromium cache partitioning
- Service Worker hijacking through the Cache API
- Webpack DOM clobbering
1/2
5
24
158
19,832
Rhackgondins retweeted
My @HeroCTF #web challenges write-ups are now available! :D
mizu.re/post/heroctf-v6-writ…
Here's a short list of the topics covered 👇
- Express res.download
- Chromium cache partitioning
- Service Worker hijacking through the Cache API
- Webpack DOM clobbering
1/2
5
31
149
27,985
Rhackgondins retweeted
🔖 Version 1.1 released
- New module: posteo
- New permutations using birth year (--birthyear)
github.com/hippiiee/MailPerm…
✨New tool, MailPermute allows you to find valid emails from a name.
🔹 Search for working emails from name permutations on Gmail, Yahoo, Yandex and DuckDuckGo (more to come)
🔹Choose the email checker to use, or use them all at the same time !
github.com/hippiiee/MailPerm…
3
15
812
Rhackgondins retweeted
Felicitation to :fire:fire: for winning the Wargame, Thales for the 2nd place and to Shell_Troopers for completing the podium.
Big thanks to @Lab_401 @asso_hzv and @epieos for the prizes.
Big thanks also to @OVHcloud and @gokoyeb for providing the infra
🫶to the wargame team
13
74
10,856
Rhackgondins retweeted
✨New tool, MailPermute allows you to find valid emails from a name.
🔹 Search for working emails from name permutations on Gmail, Yahoo, Yandex and DuckDuckGo (more to come)
🔹Choose the email checker to use, or use them all at the same time !
github.com/hippiiee/MailPerm…
2
9
33
3,425
Rhackgondins retweeted
Kubestroyer is returning from the ashes !🔥
After one year since the first version, I updated the tool.
The new release includes new etcd exploit and beautiful cli prompt to chose pod to RCE and object to extract.
Check it here 👇
github.com/Rolix44/Kubestroy…
7
17
1,462
Rhackgondins retweeted
Hey everyone 👋
You have an arbitrary file read on a Flask application launched in debug mode?
You can now use my new python library wconsole-extractor to get the PIN CODE and even get an interactive shell 🔥
Feel free to give me a feedback👇
github.com/Ruulian/wconsole_…
12
46
4,462
Rhackgondins retweeted
Hey everyone! 👋
I am excited to release my first #pwn tool that allows to extract and compress initramfs cpio, useful for Linux kernel exploitation. 🎉
Feel free to send me a message to give me a feedback or to get more information about it!
👇
github.com/Ruulian/initramfs…
1
7
31
2,766
Rhackgondins retweeted
I've finally finished my writeups for #FCSC2024, which covered:
- Nginx X-Accel-Redirect file read
- Werkzeug error-based request smuggling
- HTTP/1.1 and HTTP/0.9 browser confusion
- Connection: close bypass via Expect: 100-continue
- ...
Link 👇
mizu.re/tag/FCSC2024
1/2
2
35
176
27,561
Rhackgondins retweeted
From April 5 to 14, the FCSC 2024 took place (organized by @ANSSI_FR ) and I am glad to have finished 1st of the Junior/Pwn category and 7th of Junior scoreboard!🔥
You can find my writeups on my (new 👀) website:
- ruulian.me/post/FCSC2024-hol… (v8 exploit)
- ruulian.me/post/FCSC2024-zar…
4
9
35
2,595
Rhackgondins retweeted
Challenge time is now over ⏰
TL;DR
- HTML injection
- Axios DOM Based CSPP
- Axios CSPP response overwrite gadget
- jQuery DOM Clobbering + CSPP selector overwrite gadgets
- Setting src attr to "javascript:" for each HTML node ➝ XSS
Detailed writeup 👇
mizu.re/post/intigriti-janua…
GG to all the solvers! However, no one solved it in the intended way :p
Before giving my solution, I'm extending the challenge for another week with a fixed version!
If you find the solution, please send me a DM 📮
The challenge is accessible here 👇
mizu.re:3000/
13
78
15,770
Rhackgondins retweeted
I think it's time for a solution ⏰
To solve this challenge, you had to abuse the DOMPurify namespace misconfiguration to trigger an XSS this way 👇
Solution link: challenges.mizu.re/xss_02.ht…
1/6
Small XSS Challenge Time 🚩
Rules 📜
- You should only use the provided endpoint.
- The solution must not involve user interaction.
If you find the solution, please do not send it in the comments; send me a DM instead 📩
Challenge link 👇
challenges.mizu.re/xss_02.ht…
3
35
162
39,951
Rhackgondins retweeted
Small XSS Challenge Time 🚩
Rules 📜
- You should only use the provided endpoint.
- The solution must not involve user interaction.
If you find the solution, please do not send it in the comments; send me a DM instead 📩
Challenge link 👇
challenges.mizu.re/xss_02.ht…
3
20
135
61,107
Rhackgondins retweeted
For the @GrehackConf 2023 #CTF, I made 2 hard #web challenges 🚩
They were about:
[1] Python class pollution to RCE on Flask application
[2] HTTPOnly cookie leak due to Werkzeug improper Cookie parsing
Detailed writeups 👇
[1] mizu.re/post/insecure-sessio…
[2] mizu.re/post/another-html-re…
1
62
214
23,672
Rhackgondins retweeted
Challenge time is now over, I hope you've liked it! 😁
TL;DR
- mXSS via client-side / server-side confusion
- auto download to store the payload on file://
- puppeteer bot without SOP ➝ devtools (CDP)
- open file:// ➝ leak the flag
Detailed writeup 👇
mizu.re/post/intigriti-octob…
📚 Can't get enough of this challenge? Here's the official writeup by @kevin_mizu 💜
mizu.re/post/intigriti-octob…
23
76
11,457
Rhackgondins retweeted
Excited to launch my first browser extension, DOMLogger++! Now available for both Firefox and Chromium! 🎉
DOMLogger++ allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations 🔥
Check it out 👇
github.com/kevin-mizu/domlog…
1/5
9
105
334
42,644
Rhackgondins retweeted
Hi friendz ! 🧙♂️
Prochain Stream : Mardi 17 Octobre à 21h ! 🔥
Topics :
- Open-Sourcing push-my-diffs by @TheLaluka 🔭
- Kubestroyer, HowTo & WhatNot by @Rolix_cy 🧊
- Hooking client side sinks using DOMLogger++ by @kevin_mizu 🕸️
A très vite ! 😎🛠️
twitch.tv/thelaluka
1
9
34
5,534