caon retweeted
I haven't posted a crazy XSS vector for a while...
Works on every browser
Works on every browser
![<alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>](/pic/orig/media%2FHNx0WfkWMAAFJqL.jpg)
12
78
620
32,522
Título: Leak de PII de ~10k clientes + admins
Severidade: Crítico
Status: Aprovado e Corrigido
Bounty: Não ❌
Jaqueta: Não ❌
Severidade: Crítico
Status: Aprovado e Corrigido
Bounty: Não ❌
Jaqueta: Não ❌
Quando alguém consegue hackear a AUVP, a gente costuma enviar alguns presentes legais (e pagamos para erros críticos). Mas desta vez o time de produto resolveu fazer algo diferente.
Criamos uma versão "bugada" da nossa jaqueta: logo de cabeça para baixo, elementos desalinhados e e propósito.
Ela é exclusiva para quem encontrar bugs nas nossas aplicações.
Legal ou cringe?
6
6
78
30,571
caon retweeted
<svg>
<script><?marker name="script"></script>
<style><?marker name="style"></style>
</svg>
<template for="script">alert()</template>
<template for="style">*{background:red}</template>
おもしろい
<script><?marker name="script"></script>
<style><?marker name="style"></style>
</svg>
<template for="script">alert()</template>
<template for="style">*{background:red}</template>
おもしろい
3
11
71
4,559
caon retweeted
Not even in Brazil yet, and the @BugBountyBr guys already gave me such a warm welcome 😁
@Highustavo @zeroc00i @locs3c @_caon__ — thanks for the live, guys. That was insanely genuine!
@Highustavo @zeroc00i @locs3c @_caon__ — thanks for the live, guys. That was insanely genuine!
2
5
17
1,546
caon retweeted
🟥 Positive Hack Talks → São Paulo 🇧🇷
Dec 10th, 2025
🗣️ Speakers — submit papers (flights/hotel covered). CFP link in thread 👇
💻 Cybersecurity community — join our most community-driven event.
➡️ phtalks.ptsecurity.com/saopaulo
Free · 8 talks · limited spots
#PHTalks
Dec 10th, 2025
🗣️ Speakers — submit papers (flights/hotel covered). CFP link in thread 👇
💻 Cybersecurity community — join our most community-driven event.
➡️ phtalks.ptsecurity.com/saopaulo
Free · 8 talks · limited spots
#PHTalks
3
34
87
18,106
Ótima oportunidade para a comunidade!
🚨 LHE – Mercado Livre Hacking Event 2025 🚨
🗓 25/10 a 01/11
Escopo ampliado, desafios, bounties e premiações exclusivas!
Inscreva-se: forms.gle/Cs35PeYcoGsm8e…
🚨 LHE – Mercado Livre Hacking Event 2025 🚨
🗓 25/10 a 01/11
Escopo ampliado, desafios, bounties e premiações exclusivas!
Inscreva-se: forms.gle/Cs35PeYcoGsm8e…
2
2
18
3,955
caon retweeted
🚨 CALL 4 PAPERS — Bug Bounty Village @ H2HC 2025 🚨
Caçou um bug insano? Tem case real ou técnica nova? Esse é seu palco!
Envie sua proposta pelo form:
bit.ly/4n4hXf9
#H2HC #BugBountyVillage #Call4Papers #HackerCulture
Caçou um bug insano? Tem case real ou técnica nova? Esse é seu palco!
Envie sua proposta pelo form:
bit.ly/4n4hXf9
#H2HC #BugBountyVillage #Call4Papers #HackerCulture
1
8
8
3,306
🚨 CFP aberto — Bug Bounty Village @ H2HC 2025 🚨
Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty?
Manda sua talk!
👉 docs.google.com/forms/d/e/1FAI…
#H2HC #BugBounty #Call4Papers #HackerCulture
Achou um bug insano, bypass criativo ou tem case real de pentest/bug bounty?
Manda sua talk!
👉 docs.google.com/forms/d/e/1FAI…
#H2HC #BugBounty #Call4Papers #HackerCulture
1
7
19
4,261
caon retweeted
Hackers,
To make our pricing fairer worldwide, we’re trying out localized pricing.
We’re starting with Brazil 🇧🇷, with Individual plan prices dropping by about 50%.
💸 Monthly: ~110 BRL → 55 BRL
💸 Yearly: ~1,100 BRL → 550 BRL
Which country should we do next?
caido.io/blog/2025-08-2…
To make our pricing fairer worldwide, we’re trying out localized pricing.
We’re starting with Brazil 🇧🇷, with Individual plan prices dropping by about 50%.
💸 Monthly: ~110 BRL → 55 BRL
💸 Yearly: ~1,100 BRL → 550 BRL
Which country should we do next?
caido.io/blog/2025-08-2…
47
25
312
36,290
caon retweeted
I don't know who this will help but I put together a page listing JavaScript APIs that can break Shadow DOM encapsulation :)
github.com/masatokinugawa…
github.com/masatokinugawa…
2
50
204
19,040
caon retweeted
New Android host validation bypass technique!
[1/4] All parsed URIs in Android are android.net.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter
[1/4] All parsed URIs in Android are android.net.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter
5
73
300
29,479
caon retweeted
How to find viable targets for client-side desync attacks:
1️⃣ Open Burp Suite and intercept requests.
2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater.
3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to HTTP/2.
equest and look for this error message:
"Server ALPN does not advertise HTTP/2 support"...
5️⃣ Enable ALPN Override in request settings and send again.
If you see "Stream failed to close correctly" then you've confirmed that the server does not support HTTP/2 and is a valid target for desync testing!
Want to learn more about desync attacks? On August 6, at Black Hat USA, James Kettle from PortSwigger Research will reveal new classes of desync attack that enabled him to compromise multiple CDNs and kick off the desync endgame! 😲
Stay up to date here: http1mustdie.com
1️⃣ Open Burp Suite and intercept requests.
2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater.
3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to HTTP/2.
equest and look for this error message:
"Server ALPN does not advertise HTTP/2 support"...
5️⃣ Enable ALPN Override in request settings and send again.
If you see "Stream failed to close correctly" then you've confirmed that the server does not support HTTP/2 and is a valid target for desync testing!
Want to learn more about desync attacks? On August 6, at Black Hat USA, James Kettle from PortSwigger Research will reveal new classes of desync attack that enabled him to compromise multiple CDNs and kick off the desync endgame! 😲
Stay up to date here: http1mustdie.com
3
51
333
16,607
caon retweeted
If the origin server treats a delimiter, but the cache doesn’t and the cache normalizes paths before applying static directory rules you can leverage path traversal!
Take this payload:
/myAccount$/..%2Fstatic/any
- The cache sees: /static/any
- The origin sees: /myAccount
The is cached under /static/any and anyone that visits that static URL gets leaked data.
Take this payload:
/myAccount$/..%2Fstatic/any
- The cache sees: /static/any
- The origin sees: /myAccount
The is cached under /static/any and anyone that visits that static URL gets leaked data.
1
67
337
16,310
caon retweeted
RFC 2047 "encoded-word" is crazy!
It lets you smuggle encoded payloads into email addresses and the craziest thing is that some parsers decode it before validation 👇
Shout out to @garethheyes for this 🔥
It lets you smuggle encoded payloads into email addresses and the craziest thing is that some parsers decode it before validation 👇
Shout out to @garethheyes for this 🔥
5
67
432
32,493
caon retweeted
I've just released my proof-of-concept tool called pugDNS. It's an experimental high-performance DNS bruteforcer built with AF_XDP. It's up to 3x faster than massdns, and 30x faster than dnsx. github.com/c3l3si4n/pugdns
1
48
237
13,363
caon retweeted
🚨 AI Security Failure 🚨 @AnthropicAI
I bypassed the #constitutionalclassifiers designed to block harmful content and extracted detailed chemical information on a restricted substance.
Despite passing multiple safeguards, the content checker failed to flag it as harmful.
I bypassed the #constitutionalclassifiers designed to block harmful content and extracted detailed chemical information on a restricted substance.
Despite passing multiple safeguards, the content checker failed to flag it as harmful.
2
1
13
1,603