Sign in

#1 skybucks millionaire

@richardwrites672.bsky.social
77 followers 7 following 44 posts

adrianus websites try not to have every vulnerability type challenge adrianus count: 4 xss (technically 5 if you count the firstpost xss), 10 sqli non-adrianus count: 15 xss, 6 sqli, 1 hamburger, 5 auth bypass, 10+ "chatDisabled":true 6v.pages.dev

PostsRepliesMedia
#1 skybucks millionaire @richardwrites672.bsky.social · 12/08/2024
oh wow, twexit's back, i sure hope adrianus has done literally anything to improve his website's security
160
#1 skybucks millionaire @richardwrites672.bsky.social · 08/06/2024
This virtual session is intended for McDonald's Employees, Market Staff and Suppliers. If you were not invited, please disconnect now.
100
#1 skybucks millionaire @richardwrites672.bsky.social · 26/05/2024
Pro tip: you can send messages from banned accounts, and people will still receive it (although the message is only visible in the preview)
010
Reposted by #1 skybucks millionaire
mimonelu 🦀 みもねる @mimonelu.net · 26/05/2024
SkyBucksというスパムDMが一部で横行しているようです。コードのコメントを見る限りイタズラっぽいんですが、リンク先には飛ばないようにしましょう(キーストロークなどもトラッキングされているようなのでアカパスとか入力しちゃダメ)。ちなみにClaim Giftすると「Blueskyに広告を出稿したりポストに色を付けられる」らしいです。すごいね
0143228
#1 skybucks millionaire @richardwrites672.bsky.social · 09/03/2024
Here's a screenshot of BitView's admin panel.
330
Reposted by #1 skybucks millionaire
Skyname @skyna.me · 16/01/2024
Skyname is back online. Please read below for a detailed postmortem of the incident: darn.blog/2024-01-14-s...
0207
Reposted by #1 skybucks millionaire
Skyname @skyna.me · 14/01/2024
Skyname experienced a brief incident today where a malicious third party was able to overwrite DNS records pointing to registered usernames. All usernames have been successfully restored, and you should expect to see yours update in 24-48 hours if you're still seeing Invalid Handle.
1111
#1 skybucks millionaire @richardwrites672.bsky.social · 14/01/2024
I now control every skyname handle :) (Well, every skyname handle that has appeared in plc.directory/export )
A log output showing various usernames on skyna.me being redirected to richardwrites672.bsky.social.The skyname web portal, showing richardwrites672.bsky.social having 846 usernames linked to the account.
031
#1 skybucks millionaire @richardwrites672.bsky.social · 28/12/2023
@twexit.nl @adrianus.twexit.nl Check your twitter DMs
100
#1 skybucks millionaire @richardwrites672.bsky.social · 26/12/2023
By the way, this isn't just twexit and mastochist. Every single website that Adrianus has ever made is vulnerable to SQLi.
The database for the Adrianus site RealTopTweeps.com (and also twintov.com)The database for the Adrianus site yalphax.comThe database for the Adrianus site simplegymtracker.comThe database for the Adrianus site twuizzle.com (and also worldtoptweets.com)
4468
#1 skybucks millionaire @richardwrites672.bsky.social · 25/12/2023
2100
#1 skybucks millionaire @richardwrites672.bsky.social · 25/12/2023
Merry christmas. mastodon.nl/@adrianus/11... archive.is/kwqQB
040
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
There it is. Seems like twexit is actually dead now-- no page is working anymore. twexit.nl archive.is/LJnFd (For clarity's sake-- I am not the one that put the image on the website. That seems to have been the action of the actual admin of the site.)
070
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
Bingo.
020
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
Finally, here's XSS in twexit post-shutdown 6v.pages.dev/final :)
010
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
Alright, looking into it more it seems the sql injection bug I found isn't actually exploitable in terms of getting database contents, just calling some functions. Could be wrong, though. If anyone else wants to give it a try: POST twexit.nl/js_output_te... w/ data first=0(sql here)
130
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
database() like 'admin_twexit' (this bug is very annoying to exploit)
010
#1 skybucks millionaire @richardwrites672.bsky.social · 22/12/2023
that was fast (:
000
#1 skybucks millionaire @richardwrites672.bsky.social · 21/12/2023
Just pushed an update to the payload that will hopefully sign everyone out from twexit that views an affected user/clicks the link. I have no confidence that twexit will actually invalidate the PHPSESSID but hopefully the redirect will get people to revoke their app passwords.
280