Pinned Tweet
Published my write-up regarding two vulnerabilities in the Tekton Dashboard.
blog.flomb.net/posts/tekton/
21
64
10,294
flomb - @fl0mb.bsky.social retweeted
The blog that hosted the 2011 to 2015 Top 10 Web Hacking Techniques lists is gone. So are hundreds of the articles those lists cite.
I rebuilt all of it. Every nominee since 2006, all 1,136 of them, plus 351 more the nomination rounds missed.
webhacklist.com
10
26
99
12,772
Sometimes a stupid idea get stuck in your head. And will not disappear after a while.
Anyway, here is a new blogpost, just a little hoax this time.
badoption.eu/blog/2026/02/28…
1
3
11
784
incredibly excited to share that my research 'Playing with HTTP/2 CONNECT' made the final @PortSwigger Top 10 Web Hacking Techniques of 2025!
A huge thank you to everyone who voted. It’s a privilege to be featured alongside such talented researchers.
portswigger.net/research/top…
1
17
3,238
flomb - @fl0mb.bsky.social retweeted
👼GatewayToHeaven (CVE-2025-13292).
I discovered a cross-tenant vulnerability in @GoogleCloud's #Apigee, allowing me to access other organizations' data (and sometimes even plaintext JWTs of end users).
Below is the full breakdown of the exploit chain⛓️
ALT Technical architecture diagram titled 'GatewayToHeaven' showing a 5-step exploitation chain in Google Cloud Apigee. It illustrates an attacker pivoting from an isolated tenant project through an SSRF, poisoning Dataflow dependencies, and exfiltrating tokens via GCP APIs to access cross-tenant metadata and logs.
ALT A redacted screenshot of JSON log data serving as proof of exploit. The image highlights captured sensitive fields including a 'client_ip' and a cross-tenant 'access_token' (JWT), demonstrating successful unauthorized data access.
12
109
554
64,704
flomb - @fl0mb.bsky.social retweeted
You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post by @0xor_solo about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01-…
52
137
18,652
Honored to be nominated for the @PortSwigger Top 10 Web Hacking Techniques 2025 with my research "Playing with HTTP/2 CONNECT".
Make sure to check out the full list and cast your vote!
portswigger.net/polls/top-10…
1
4
165
flomb - @fl0mb.bsky.social retweeted
Our 2024 applicants challenge is officially #roasted: the full BeanBeat × Maultaschenfabrikle walkthrough is now online. Unwrap the write-up at apply-if-you-can.com/walkthr… and revisit the hacks that escalated from cold brew to full breach.
12
34
2,923
flomb - @fl0mb.bsky.social retweeted
Latest ≠ Greatest? A Retrospective Analysis of CVE-2025-59287 in Microsoft WSUS from our very own @mwulftange who loves converting n-days to 0-days code-white.com/blog/wsus-cve…
1
51
97
15,557
flomb - @fl0mb.bsky.social retweeted
Did you encounter the Supabase? Might wanna try my newest tooling or have a read about quickwins? There you go:
blog.m1tz.com/posts/2025/10/…
4
7
497
flomb - @fl0mb.bsky.social retweeted
CODE WHITE proudly presents #ULMageddon which is our newest applicants challenge at apply-if-you-can.com/ packaged as a metal festival. Have fun 🤘 and #applyIfYouCan
2
14
34
5,105
flomb - @fl0mb.bsky.social retweeted
Just out of stealth mode last week, @TeamCyata reports on their "deliberate, weeks-long effort [...] to uncover logic-level vulnerabilities" in HashiCorp Vault and CyberArk Conjur. And uncover they did.
cyata.ai/blog/cracking-the-v…
cyata.ai/blog/exploiting-a-f…
1
5
8
1,718
flomb - @fl0mb.bsky.social retweeted
New writeup:
Early last month, @samwcyo, @sshell_, and I found a Django ORM injection in an online shooter game that let us steal cryptocurrency from the game's wallet.
Read the blog post here:
blog.p1.gs/writeup/2025/07/0…
36
72
264
20,095
flomb - @fl0mb.bsky.social retweeted
Here is a really cool blog post by wasamasa whos is a past student of our FSWA class: emacsninja.com/posts/cve-202…. You can find them on Mastodon: lonely.town/@wasamasa/
9
25
5,960
flomb - @fl0mb.bsky.social retweeted
"Funky chunks: abusing ambiguous chunk line terminators for request smuggling" - quality research by @__w4ke! Also thankfully it doesn't overlap with my upcoming presentation 😅
w4ke.info/2025/06/18/funky-c…
1
45
202
14,201
flomb - @fl0mb.bsky.social retweeted
A quick-and-dirty late night blog post on discovering an nday variant in Zyxel NWA50AX Pro devices
frycos.github.io/vulns4free/…
2
22
55
8,299
flomb - @fl0mb.bsky.social retweeted
Three unexpected attack scenarios:
1. Marshaling private data with misconfigured tags
2. Parser differentials in a microservices architecture
3. Cross-format confusion attacks (JSON→XML)
blog.trailofbits.com/2025/06…
2
35
132
21,265
flomb - @fl0mb.bsky.social retweeted
One-Click RCE in ASUS’s Preinstalled Driver Software
mrbruh.com/asusdriverhub/
2
19
83
21,951
flomb - @fl0mb.bsky.social retweeted
Here is a short writeup for my recently discovered CVE: hesec.de/posts/cve-2025-4666…
1
2
15
430
flomb - @fl0mb.bsky.social retweeted
Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-d…
49
106
16,460