iiinova — where your digital self keeps evolving

Aethlios @aethlios.bsky.social · 24/04/2025

I'm excited to share that I recently found a XSS in Quasar Framework. The CVE-2025-43954 has just been published to document this security issue. You can learn more about it here: - github.com/advisories/G...

060

Reposted by Aethlios

Gareth Heyes @garethheyes.co.uk · 18/03/2025

You might have noticed that the recent SAML writeups omit some crucial details. In "SAML roulette: the hacker always wins", we share everything you need to know for a complete unauthenticated exploit on ruby-saml, using GitLab as a case-study. portswigger.net/research/sam...

portswigger.net

SAML roulette: the hacker always wins

Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library

05323

Reposted by Aethlios

James Kettle @jameskettle.com · 03/02/2025

I’ve updated the bug bounty & content creators starter pack with classic research group @hackerschoice.bsky.social! Let me know if you’re not on this list and would like to be added. go.bsky.app/GD7hKPX

74412

Reposted by Aethlios

James Kettle @jameskettle.com · 22/01/2025

Thanks for your all your votes! The public vote is now closed, and we're kicking off the panel vote with fifteen quality nominations. In the meantime we just published a new technique ourselves - check it out here:

0145

Reposted by Aethlios

James Kettle @jameskettle.com · 21/01/2025

24 hours remaining until voting closes on the Top 10 (new) Web Hacking Techniques of 2024! If you haven't already voted now's the time to do it. portswigger.net/polls/top-10...

portswigger.net

Top 10 web hacking techniques of 2024

Welcome to the community vote for the Top 10 Web Hacking Techniques of 2024.

1116

Reposted by Aethlios

James Kettle @jameskettle.com · 15/01/2025

Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here: portswigger.net/polls/top-10...

portswigger.net

Top 10 web hacking techniques of 2024

Welcome to the community vote for the Top 10 Web Hacking Techniques of 2024.

0248

Reposted by Aethlios

BitK @handle.invalid · 20/12/2024

I've pushed some updates to Dom-Explorer: - Allow multiple pipeline embed - Short links for sharing/sync - Support for DomPurify triggers - User settings Give it a try and share your findings! yeswehack.github.io/Dom-Explorer

yeswehack.github.io

Dom-Explorer

2206

Reposted by Aethlios

Nicolas Grégoire @agarri.fr · 14/12/2024

A younger me, as a pentester and bug hunter, had exactly the bias described in this article 🤫 Luckily, I later worked with and for "the other side" and it changed my mind 🤯 I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞

maxwelldulin.com

Why Can't You Fix This Bug Faster?

Fixing security vulnerabilities in a timely manner is more complicated than you realize.

25816

Reposted by Aethlios

Laluka @laluka.bsky.social · 09/12/2024

Yo ! 🧙‍♂️ Prochain stream demain -mardi 10 Dec- à 21h ! Au programme ? We Deep Dive ! 🧐 - Reset-tolkien par @AethliosIK (X) 🗝️ - Portainer & UID remap par @penthium2 (X) 🐳 www.twitch.tv/thelaluka

Reposted by Aethlios

Gabriel Thierry @gabrielthierry.eurosky.social · 25/11/2024

Bonjour, Bienvenue dans ce live-skeet du procès de Florent Curtet, ce trentenaire poursuivi pour des extorsions numériques, jugé en cette fin de mois à Paris par le tribunal judiciaire.

65127

Aethlios @aethlios.bsky.social · 25/11/2024

A really comprehensive resource on CORS attacks. I'm going to rework my course slides based on this research, thank you for your contribution!

192

Reposted by Aethlios

James Kettle @jameskettle.com · 25/11/2024

Custom lists are super cool! I enjoy reading social posts, but want to make sure I never miss a quality writeup or technique. To achieve this, I'm building a 'high signal web security' list of topic-focused accounts, which you can pin next to 'Following' if you want :) bsky.app/profile/jame...

25416

Reposted by Aethlios

Nicolas Grégoire @agarri.fr · 17/11/2024

In case you're a professional Burp Suite user, there's a few seats left for the Q1 2025 training sessions hackademy.agarri.fr/2025

1158

Reposted by Aethlios

James Kettle @jameskettle.com · 21/11/2024

Any bug bounty people around? I'm creating a starter pack of people to follow but it's pretty brief currently! Let me know if you'd like to be added: go.bsky.app/GD7hKPX

459530

Aethlios @aethlios.bsky.social · 18/07/2024

My second article on time-based secrets has just been published! 🚀 I explore a new usecase of the sandwich attack to set up a scenario for real-time monitoring of web application invitations. - English version: aeth.cc/public/Artic... - French version: aeth.cc/public/Artic...

031

Aethlios @aethlios.bsky.social · 02/04/2024

Following #bugbounty findings, I started focusing my research on time-based secrets. This research began for me a year ago, and enabled me to take the time to implement my open source tool: “Reset Tolkien”. 🚀 I've written an article detailing my research : - 🇬🇧 EN : www.aeth.cc/public/Artic...

010