iiinova — where your digital self keeps evolving

renniepak @renniepak.nl · 25/05/2026

None of this happens without the people who make it happen. A massive thank you to our sponsor @intigriti.com , to my incredible co-organiser @g0053.me, and above all, to the 22 of you who travelled from near and far to be part of our HackerHideout community. See you next time!

040

renniepak @renniepak.nl · 08/04/2026

򫑰򚁲򚐩򯑽򬡥򬑵򩑳Ꝋ򫡩򫑡򭁩򫱮򡡲򨑭򩐨򬰩򯐻򬰨򚑽򚀩`.replace(/u\D*/g,``)))

121

renniepak @renniepak.nl · 07/02/2026

Added a small feature to cspbypass.com to warn the user if unsafe-inline is detected, in which case you typically don’t need to waste time hunting for 3rd-party whitelisted CSP bypasses and go straight to inline scripts / event handlers.

075

renniepak @renniepak.nl · 23/05/2025

The security team running a bug bounty program as soon as your report comes in:

060

renniepak @renniepak.nl · 20/05/2025

If you’re into bug bounty hunting and like finding weird XSS bugs (like me 😊) in places most people overlook, come check out my talk at NahamCon 2025 this Friday, May 23. "Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Checks"

1133

renniepak @renniepak.nl · 03/04/2025

Bug bounty in a nutshell.

010

renniepak @renniepak.nl · 29/03/2025

Wow. Sora is pretty insane.

020

renniepak @renniepak.nl · 13/02/2025

Found a handy new CSP bypass gadget on Snapchat: cspbypass.com#snapchat

<script src="https://tr.snapchat.com/config/com/%27%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d%28%29%3b%61%6c%65%72%74%28%31%29%2f%2f.js"></script>

1224

renniepak @renniepak.nl · 12/02/2025

Yesterday I discovered a tweet of mine was referenced in the book "Attacking and Exploiting Modern Web Applications: Discover the mindset, techniques, and tools to perform modern web attacks and exploitation" www.amazon.nl/-/en/Simone-... Since I deleted my account, this is the tweet:

0122

renniepak @renniepak.nl · 02/12/2024

Just deleted all my tweets and unfollowed everyone. Kept my account so it cannot be used to impersonate me. 😅

4170

renniepak @renniepak.nl · 29/11/2024

This is so pathetic. Company with a annual revenue of 25 BILLION USD reduces my bounty by $5 because I didn't supply my IP address. For a postMessage XSS, so the only thing showing up in their logs would be me opening the homepage...

5191

renniepak @renniepak.nl · 20/11/2024

account banned bitcoin blocked coins crypto ethereum facebook fortnite help instagram private key lost metamask minecraft need nfts nft recover roblox scammed steam stolen support tiktok tokens twitter ubisoft unban unbanned unblock

350

renniepak @renniepak.nl · 20/11/2024

I started my day by reviving the "Harlem Shake Bookmarklet". Code here: 0-a.nl/harlemshake....

150

renniepak @renniepak.nl · 20/11/2024

Why can I only send messages with a max of 300 characters while I can use 2000 characters in the alt text of an image?

270

renniepak @renniepak.nl · 14/11/2024

Hey BlueSky! I case you missed it: I've created cspbypass.com A site where you can search for known CSP bypass gadgets to gain XSS. It already contains a bunch of useful gadgets with contributions from your favourite hackers. If you have some CSP bypasses to share, feel free to contribute!

17124

renniepak @renniepak.nl · 06/08/2023

I've created a javascript bookmarklet that will extract all endpoints (starting with /) from your current DOM and from all the all the external script sources embedded on the page. You can find it here, if you want to try it out: 0-a.nl/jsendpoints.txt #bugbountytips

081