Pinned Tweet
Stealing Salesforce OAuth Tokens via the WAF: A write-up on SFRA context and escalating XSS to Account Takeover using the WAF as a gadget. Hope you enjoy it
castilho.sh/salesforce-oau…
castilho.sh/salesforce-oau…
10
96
464
27,634
castilho retweeted
Yesterday we asked: what if you could turn back the clock?
We can’t, but we can see it sooner.
Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing.
zero.ethiack.com
We can’t, but we can see it sooner.
Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing.
zero.ethiack.com
1
6
29
6,882
New blog post targeting Remix Framework and how adding .data to an endpoint could potentially lead to bypass 403 and leak secret information. Hope you guys enjoy it :)
ethiack.com/info-hub/resea…
ethiack.com/info-hub/resea…
1
15
69
9,128
I found a PreAuth RCE chain in GeoNetwork, which is used by many Governments, Internacional Orgs and military across the globe to catalog geospatial data. Here's the writeup about it, hope you enjoy it :)
ethiack.com/info-hub/resea…
0
2
8
1,081
I found a PreAuth RCE chain in GeoNetwork, which is used by many Governments, Internacional Orgs and military across the globe to catalog geospatial data. Here's the writeup about it, hope you enjoy it :)
ethiack.com/info-hub/resea…
ethiack.com/info-hub/resea…
1
7
54
14,955
castilho retweeted
Write once, shell everywhere. Sun Microsystems didn't mean it like this. Our team @0xacb, @s3np41k1r1t0 and @castilho101 just talked at DEF CON's Bug Bounty Village about why AFW is not a medium severity finding.
1
6
18
1,156
Me @0xacb and @s3np41k1r1t0 discovered an Arbitrary File Read on Ruby on Rails instance with default configuration, with allows to be escalated to RCE ! Make sure to patch :)
ethiack.com/info-hub/resea…
ethiack.com/info-hub/resea…
0
3
27
2,125
castilho retweeted
Don't miss the talk "Turning Arbitrary File Writes into RCE" by Bruno Mendes (@s3np41k1r1t0) and Rafael Castilho Silva (@castilho101) on Fri, Aug 7 at 12:00pm at Creator Stage 6 (W226-227).
Read more at bugbountydefcon.com/agenda
#BugBounty #DEFCON34
Read more at bugbountydefcon.com/agenda
#BugBounty #DEFCON34
0
3
9
1,238
castilho retweeted
Think a relative redirect parameter is inherently safe just because it restricts full external URLs?👀
Think again.
In our latest article, Ethiack Security Researcher, Rafael Castilho, reveals how subtle discrepancies between server-side handling and browser navigation behavior abusing how Google Chrome processes URL fragments (#) during validation loops, an attacker can intentionally trigger an ERR_TOO_MANY_REDIRECTS crash, leaving sensitive session tokens and OAuth callback secrets completely exposed inside the browser error page.
Stop trusting "path-only" limits blindly. Learn how the breakdown happens and how to defend your application pipelines.
👉 Read the full article here: ethiack.com/news/research/…
Think again.
In our latest article, Ethiack Security Researcher, Rafael Castilho, reveals how subtle discrepancies between server-side handling and browser navigation behavior abusing how Google Chrome processes URL fragments (#) during validation loops, an attacker can intentionally trigger an ERR_TOO_MANY_REDIRECTS crash, leaving sensitive session tokens and OAuth callback secrets completely exposed inside the browser error page.
Stop trusting "path-only" limits blindly. Learn how the breakdown happens and how to defend your application pipelines.
👉 Read the full article here: ethiack.com/news/research/…
0
2
13
1,457
My first research with Ethiack just came out. Abusing redirect discrepancies to leak secrets in URLs by using the browser's fragment handling. Hope you like it
ethiack.com/news/research/…
ethiack.com/news/research/…
1
16
60
2,789
castilho retweeted
New Video Up! 🔥
A basic XSS → WAF bypass → Stealing OAuth Code -> Account Takeover !!
Bug chain got completely out of control. 💀🙏
youtu.be/16UNZNY2euo?si…
A basic XSS → WAF bypass → Stealing OAuth Code -> Account Takeover !!
Bug chain got completely out of control. 💀🙏
youtu.be/16UNZNY2euo?si…
6
23
189
8,090
In collaboration with @renniepak, I just pushed a new (and probably final) update to the CallMe extension.
Now you're one click away from contributing your passive callback findings to the community, as it lets you export them in the right format and standards to submit to the cspbypass.com repo. Make sure to update!
Now you're one click away from contributing your passive callback findings to the community, as it lets you export them in the right format and standards to submit to the cspbypass.com repo. Make sure to update!
Today, I'm open-sourcing an extension that I vibe-coded to find callback endpoints in the background while browsing the web. With this, I just pushed 25 new callback endpoints to CSPBypass, including from companies like Dashlane, WhatsApp, RecordedFuture, and more :)
github.com/castilho101/Ca…
1
10
83
8,257
Today, I'm open-sourcing an extension that I vibe-coded to find callback endpoints in the background while browsing the web. With this, I just pushed 25 new callback endpoints to CSPBypass, including from companies like Dashlane, WhatsApp, RecordedFuture, and more :)
github.com/castilho101/Ca…
github.com/castilho101/Ca…
4
18
129
18,590
Solution write-up:
1. DOM Poisoning to CSPT using https:: so we don't get URL encoded and can do path traversal on fetch().
2. Quirk with Quarkus Java Framework because it accepts parameters like using the delimiter ";" instead of "&", bypassing sanitization using /read?;file=... as frontend Flask doesn't see the file parameter.
3. DOM Poisoning to CSPT again to exfiltrate the data out using another parser difference between the browser and Python library furl ( uses urllib underneath ), allowing us to bypass sanitization using NFKC encoding: https://webhook＼localhost.
1. DOM Poisoning to CSPT using https:: so we don't get URL encoded and can do path traversal on fetch().
2. Quirk with Quarkus Java Framework because it accepts parameters like using the delimiter ";" instead of "&", bypassing sanitization using /read?;file=... as frontend Flask doesn't see the file parameter.
3. DOM Poisoning to CSPT again to exfiltrate the data out using another parser difference between the browser and Python library furl ( uses urllib underneath ), allowing us to bypass sanitization using NFKC encoding: https://webhook＼localhost.
The CTF competition organized by my college CTF team, upCTF, ended today. I created one of the web challenges, Ouro no Pescoco, which was solved by only 2 teams. You can check it out here:
github.com/castilho101/CT…
1
4
63
5,572
The CTF competition organized by my college CTF team, upCTF, ended today. I created one of the web challenges, Ouro no Pescoco, which was solved by only 2 teams. You can check it out here:
github.com/castilho101/CT…
github.com/castilho101/CT…
1
1
33
6,867
castilho retweeted
My first research in 2026! It's an extension of @Black2Fan's Content-Type research. Hope you'll enjoy reading it!
(I've been procrastinating on this one for while, should have finished it much earlier 🤣)
(I've been procrastinating on this one for while, should have finished it much earlier 🤣)
How can a simple comma trick MIME parsers into XSS?
Check out this article by @siunam321:
lab.ctbb.show/research/parse…
2
25
151
12,377
Great tip. One example of this is that the browser's URL parsing converts \ to /, while Python's official library urlparse doesn’t take \ as a delimiter and instead parses the URL through the @.
Thus, we can still bypass the following check to point to whatever we want
Thus, we can still bypass the following check to point to whatever we want
Looking into a potential SSRF or OR but the server checks against a URL whitelist?
Try the backslash trick! Due to a difference in URL specifications, some parsers will treat '\' the same as '/', while others will not.
Here's an example payload: https://<attacker-url>\@<whitelisted-url>/
0
8
74
5,922
castilho retweeted
@LooseSecurity @castilho101 Yeah any URI schemes except file:// and http:// will work.
1
2
8
1,055