We finished 14th globally and 1st in MENA in CSAW Cybersecurity Games and Conference CTF organised online last weekend, among 900 academic and international teams! We can't wait to participate in the finals at @nyuabudhabi Kudos to everyone in the team for their dedication and huge efforts ❤️ #CSAW #CTF

We are happy to announce that we finished 10th in the NahamCon EU 2022 CTF! Thanks @nahamsec, @JustHackingCo, John Hammond, and everyone involved for the great challenges and the super infrastructure. #NahamCon2022EU

We played bi0s CTF this weekend and got 8th, enjoyable and creative challenges. Forensics was really missed though! Congratulations to our members and the other teams, and thanks to teambi0s for the CTF ❤️ #ctf #cybersecurity #bi0sctf

I'll drop this here. An analysis for exploiting _dl_fini function in libc 2.31 and 2.35 In 2.31, we had plenty of attack points to control the execution flow. In 2.35 __rtld_lock_lock_recursive became in a read only area so we have less options. Enjoy. github.com/M0ngi/CTF-Writ…

I'am dropping a writeup for Two tasks released at securinets CTF Quals 2k23. 0 CSP: XSS through Service worker cache poisoning and CRLF injection. Mark4archive: Race condition, Websocket request smuggling, LFI, Deserialization -> RCE. nzeros.me/2023/08/08/sec…

Here is a write-up of a fun web challenge from the securinets CTF I worked on with xanhacks and xThaz, featuring CRLF injections and service worker cache poisoning. log-s.xyz/posts/securine… Enjoy 😁

just wrote about an issue in flask_sock package which allows executing HTTP requests in the same WebSocket stream, which effectively bypasses frontend server rules, it was part of a CTF challenge at Securinets CTF: repzret.blogspot.com/2023/08/analyz….

CVE-2023-38831 Winrar exploit generator github.com/b1tg/CVE-2023-… #cve #infosec #pentesting

I wasn't knowing what to do yesterday night so, I decided to create an XSS challenge 🚩 There is nothing to win, I made it just for fun! If you want to try it out, click on the link below 👇 mizu.re/challenges/xss… The final goal it to pop an alert without any interaction 🔥

Excited to launch my first browser extension, DOMLogger++! Now available for both Firefox and Chromium! 🎉 DOMLogger++ allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations 🔥 Check it out 👇 github.com/kevin-mizu/dom… 1/5

I contributed with 7 web challenges for #BHMEA2023 this year, hope you like them! Congrats to strellic for blooding today’s insane chall 🤯

I'm speechless

Just wrote a ~2.5 page blog post on Client Side Path Traversal, covering what CSPT is, why it can be so impactful, some advanced exploitation and WAF bypass techniques, and a bug which I found in a live hacking event (redacted ofc) matanber.com/blog/cspt-leve…

Dropping my kernel exploitation notes I've been working on since I first started researching in this I'll keep updating the repo so please, let me know if there's smthg unclear or must be fixed You'll also find future writeups & challenges authored there. github.com/M0ngi/Kernel-E…