Pinned Tweet
Took more than 2 years, but just released the postMessage-tracker Chrome Extension!
github.com/fransr/postMes…
Look at the functions receiving postMessages directly in the extension, look at the messages and sender/receiver window locations and track everything using a log-URL.
github.com/fransr/postMes…
Look at the functions receiving postMessages directly in the extension, look at the messages and sender/receiver window locations and track everything using a log-URL.
40
592
1,824
Frans Rosén retweeted
HackerNotes TLDR for episode 195! blog.criticalthinkingpodcast.io/p/hackernotes-…
►⠀Discussing with a OG hacker @fransrosen about the new AI era in the Bug Bounty scene
⠀•⠀AI is just the scanner era again. Everyone runs the same tools the same way, so the first step gets duped and your whole chain dies with it
⠀•⠀You are still the edge. The prompt is the new scan config, and threat modeling is different for every company. Plant a seed nobody else has
⠀•⠀AI is great at fingerprinting and parser bugs, but still weak at race conditions, blind XSS, and SSRF when it has no context
⠀•⠀Programs should pay for impact bumping, not just first report. Turning a known low into a critical is real work that goes unpaid today
►⠀Discussing with a OG hacker @fransrosen about the new AI era in the Bug Bounty scene
⠀•⠀AI is just the scanner era again. Everyone runs the same tools the same way, so the first step gets duped and your whole chain dies with it
⠀•⠀You are still the edge. The prompt is the new scan config, and threat modeling is different for every company. Plant a seed nobody else has
⠀•⠀AI is great at fingerprinting and parser bugs, but still weak at race conditions, blind XSS, and SSRF when it has no context
⠀•⠀Programs should pay for impact bumping, not just first report. Turning a known low into a critical is real work that goes unpaid today
3
4
42
4,581
Frans Rosén retweeted
I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
8
42
208
9,641
Frans Rosén retweeted
how i hacked 320+ companies that replaced their cs team with "smart" ai agents:
1. drafted a gdpr request to support@
2. changed the FROM header from my e-mail to yours (spoofing)
3. put myself in CC
4. ai agent responds with YOUR data to BOTH of us 😈
more tricks: @intigriti
1. drafted a gdpr request to support@
2. changed the FROM header from my e-mail to yours (spoofing)
3. put myself in CC
4. ai agent responds with YOUR data to BOTH of us 😈
more tricks: @intigriti
34
122
1,427
135,785
Frans Rosén retweeted
Got an arbitrary file write that got closed as medium? It shouldn't have been.
Most AFWs get downgraded because nobody could prove RCE 🥷
Some research we've been doing for years just dropped! Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE - Our talk from @BugBountyDEFCON 👇
ethiack.com/info-hub/resea…
Most AFWs get downgraded because nobody could prove RCE 🥷
Some research we've been doing for years just dropped! Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE - Our talk from @BugBountyDEFCON 👇
ethiack.com/info-hub/resea…
2
20
104
7,189
Frans Rosén retweeted
Stop blaming AI slop for what bug bounty platforms did to themselves.
👇 wrote down some thoughts about the state of triage
clawd.it/posts/14-to-ka…
👇 wrote down some thoughts about the state of triage
clawd.it/posts/14-to-ka…
5
49
242
61,456
Frans Rosén retweeted
Shoutout to @JonathanBouman @fransrosen @avlidienbrunn for another great year of collaborations. Always a pleasure hacking alongside these legends , we’ve found some really really good crits this year and I get the feeling 2026 will be the same 🫣
6
3
127
12,478
Thanks for the mention @cbrocas, great post!
"A BRIEF HISTORY OF ACME" BLOGPOST
📣 I would like to share with you an article I wrote about the ACME protocol, which I "fell in love with" about ten years ago:
👉️ blog.brocas.org/2025/12/01/ACM…
Hope you will find interesting things inside!
RT appreciated🙏
1
1
19
6,472
Frans Rosén retweeted
fun times hacking amazon with @JonathanBouman and @fransrosen!! only 14 reports (crits/highs) but managed to win a few awards:
pwnership - most impactful report overall
most impactful issue on scope 1
most # of critical issues on scope 1
most # of critical issues on scope 2
pwnership - most impactful report overall
most impactful issue on scope 1
most # of critical issues on scope 1
most # of critical issues on scope 2
8
7
262
19,559
Frans Rosén retweeted
Shoutout to my boys @avlidienbrunn, @fransrosen, and @BarrettJ for hanging in there til 2AM on this bug.
Gotta say, I think @BarrettJ takes the cake for most technically proficient & invested program staff around.
Now to sleep in peace with `/tmp/pwned` where it belongs.
Gotta say, I think @BarrettJ takes the cake for most technically proficient & invested program staff around.
Now to sleep in peace with `/tmp/pwned` where it belongs.
1
2
127
11,082
Frans Rosén retweeted
While playing a challenge by @salvatoreabello, I found a pretty interesting way to exploit Dangling Markup with a strict CSP.
All you need is an <iframe>, <object> or <embed> set to about:blank, with a dangling name= attribute. This vulnerable page should be iframable.
All you need is an <iframe>, <object> or <embed> set to about:blank, with a dangling name= attribute. This vulnerable page should be iframable.
1
38
246
28,659
Frans Rosén retweeted
I won the Most Valuable Hacker award for the Salesforce H1-6102 live hacking event in Sydney (my hometown)! I enjoyed working with some very talented hackers, including @ryotkak, @Geluchat, and @kevin_mizu. This is my third MVH award, and I'm grateful to be able to compete.
88
38
771
48,397
Frans Rosén retweeted
Double-Clickjacking, or "press buttons on other sites without preconditions". After seeing and experimenting with this technique for a while, I cooked up a variation that combines many small tricks and ends up being quite convincing.
Here's a flexible PoC:
jorianwoltjer.com/blog/p/hacking…
Here's a flexible PoC:
jorianwoltjer.com/blog/p/hacking…
2
53
216
25,465
Been using this for a while and I have now forgotten all correct arguments to tar
I made a tool to help test archive (zip/tar) extraction bugs (synk working directory into archive, add path traversals, links, permissions, etc): github.com/avlidienbrunn/…
0
3
52
7,795
Frans Rosén retweeted
another amazon event win :D had lots of fun with @JonathanBouman @fransrosen @avlidienbrunn , DREAM TEAM :)) can't wait for the next one!
28 researchers. 9 days. 45 valid critical or high severity issues uncovered.
@amazon's first-ever In-Person Challenge brought together top security researchers to test its systems.
A HackerOne Challenge is more than just a bug bounty—it’s an invite-only, time-bound offensive on finding high-impact vulnerabilities fast.
Here’s what this one produced:
👀 222 vulnerability submissions triaged by a dedicated HackerOne pod
💪 129 valid issues: ~60% of all submissions!
💥 12 critical & 33 high-severity findings
🧠 The opportunity for in-house teams to observe researchers’ reconnaissance & attack methodologies firsthand—gaining a deeper understanding of potential security issues
This is what modern, proactive security looks like.
6
7
247
36,707
Frans Rosén retweeted
Banana for scale.
Thx for the bugs @itz_mg_ @Iustinbb @zseano @JonathanBouman @fransrosen @avlidienbrunn @gr3pme and everyone else who participated in our Seattle event!
Thx for the bugs @itz_mg_ @Iustinbb @zseano @JonathanBouman @fransrosen @avlidienbrunn @gr3pme and everyone else who participated in our Seattle event!
0
6
21
6,958
Congrats @mgianarakis and @infosec_au!
In 2018, @mgianarakis and I set off to build a platform that would provide enterprises with a realistic attacker perspective of their entire network. At the time, we had just begun to try the phrase "attack surface management" in peer conversations. But the vision was always *every* asset and operationalize leading vulnerability research to provide customers with verifiable exposures before attackers even get a chance to exploit them.
Over the past 7 years of bootstrapping Assetnote, I am proud to say we were able to build something that has made a significant positive impact for customers like Checkpoint, Canva, LinkTree, and more.
I am also proud of the hard work and dedication of the Assetnote Security Research Team, who over the years, have discovered significant vulnerabilities in Citrix, Fortinet, Zoom, and many more. Being able to quickly operationalize these findings and protect our customers before the CVE is even assigned has always been a highlight of the work we do here.
Today, I’m excited to share that Assetnote has been acquired by Searchlight Cyber as the next step in our journey. Not only will we continue to improve our market-leading Attack Surface Management solution, it will include the power of Searchlight’s dark web intelligence capabilities to provide our customers with even more high-signal and actionable information.
You can check out the full press release here:
assetnote.io/acquisition
1
0
52
7,114
Frans Rosén retweeted
The moments when I'm most proud of CTBB Podcast are the moments when we're discussing original, HQ research on the pod.
So, that's why we're starting the Critical Research Lab with this tremendously talented group of researchers:
So, that's why we're starting the Critical Research Lab with this tremendously talented group of researchers:
15
23
276
47,301
Frans Rosén retweeted
Sharing a technical writeup, which goes over an almost year long responsible disclosure process:
jdomeracki.github.io/2024/11/09/ske…
The severity of disclosed shortcomings, resulted in googlecloudcheatsheet.withgoogle.com getting decommissioned 🚧
Greatly appreciate the cooperation with @GoogleVRP! 🎉
jdomeracki.github.io/2024/11/09/ske…
The severity of disclosed shortcomings, resulted in googlecloudcheatsheet.withgoogle.com getting decommissioned 🚧
Greatly appreciate the cooperation with @GoogleVRP! 🎉
0
31
125
17,475