Sergey Bobrov (@black2fan) 's Twitter Profile
Sergey Bobrov

@black2fan

ID: 178619771

linkhttps://black.fan calendar_today15-08-2010 06:35:08

585 Tweet

7,7K Followers

398 Following

PT SWARM (@ptswarm) 's Twitter Profile Photo

💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE! Read the research: swarm.ptsecurity.com/exploiting-arb…

💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE!

Read the research: swarm.ptsecurity.com/exploiting-arb…
Masato Kinugawa (@kinugawamasato) 's Twitter Profile Photo

Here is the technical details of MS Teams RCE I used in Pwn2Own Vancouver 2022! #shibuyaxss の資料公開しました!Pwn2Ownで賞金を獲得したTeamsの脆弱性について解説しています。 speakerdeck.com/masatokinugawa… (English) speakerdeck.com/masatokinugawa… (日本語) youtu.be/TMh_WbF9VnM (demo)

slonser (@slonser_) 's Twitter Profile Photo

A writeup analysis of a simple logical vulnerability at Chrome for which Google VRP (Google Bug Hunters) paid me $16,000. Link: blog.slonser.info/posts/cve-2023… P.S. I have very few subscribers, so I am grateful for every repost #0day #Chrome #GoogleVRP #CVE

slonser (@slonser_) 's Twitter Profile Photo

In 2024, I interacted a lot with Extensions. I decided to create a resource that will help with a basic understanding of extensions and key attacks. P.S. I tried to make everything as clear as possible and hope it won’t feel too overwhelming anywhere. extensions.neplox.security

Sergey Bobrov (@black2fan) 's Twitter Profile Photo

I have published a tool based on jadx that helps analyze Java applications. github.com/BlackFan/BFScan BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations. It also searches strings that look like URIs, paths, or secrets.

Sergey Bobrov (@black2fan) 's Twitter Profile Photo

Wrote a Burp Suite Pro extension that uses AI-powered features to replace values in HTTP requests. Useful for guessing data formats based on parameter or header names. For example, for requests from Swagger / OpenAPI or those generated by my tool BFScan. github.com/BlackFan/Burp-…

Sergey Bobrov (@black2fan) 's Twitter Profile Photo

Implemented support for annotation parsing in class constructor arguments in BFScan. github.com/BlackFan/BFSca… If previously a lot of HTTP requests with obfuscated parameter names were generated for your APK, now the result should improve significantly.

dbugs (@ptdbugs) 's Twitter Profile Photo

📄 Cache Poisoning via S3 API: when JavaScript caching becomes an attack vector A common setup: a site stores static assets in S3, proxies requests to it, and caches "200 OK" responses. At first glance, everything looks correct — but one cache configuration detail turns this