@Merl1ng
Account based inUnited States!
About this account
- Account based in
- United States
- Connected via
- Web
X says this location may be affected by a proxy or VPN.
Account-level information from X, not a live location or the device used for a specific post.
Joined July 2017
- Tweets18
- Following4K
- Followers76
- Likes6
kolten retweeted
During my time at @QED_Audit I circled back and took another quick look at browser/JSE vulnerability research. AI agents flying high, seemingly finding & exploiting bugs everywhere, and there's this: a **constant integer overflow** in V8, alive for over 3.5 years. (1/5)
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
kolten retweeted
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…
kolten retweeted
Hacking Google with A.I. for $500,000
brutecat.com/r/hacking-googl…
kolten retweeted
A program that triages your report within hours and pays within a month is giving you more than a bounty. It’s helping you validate that you invested your time in the right target. Every clear triage decision, payout, and thoughtful interaction builds confidence that the program is worth going deeper on.
That’s part of why Steve built the Bug Bounty Maturity Framework around the researcher’s experience. Across the programs studied, the lowest scoring pillar was the Researcher Interface: response consistency, communication quality, escalation handling, and decision transparency.
Researchers are the primary ICP of every bug bounty program. Without sustained participation from skilled researchers, there is no security signal. Programs that consistently earn researcher trust don’t just create a better experience. They attract the participation that makes bug bounty work in the first place.
kolten retweeted
Playing with Headless, PDF or Image rendering for SSRF and are you able to control/inject HTML but JS is disabled?
This may refresh the page and send the browser to a new location, like internal hosts.
Some filters may block // to avoid changing the location, so you may try using \\\\ instead:
ethiack.com">
The browser normalizes \\\\ to // so you may be able to perform a redirect.
Same applies to file:\\\\etc\\passwd if you are in a file:/// origin.
kolten retweeted
1. Fuzz all the things.
This is my favorite. Every word in your word list is a potential info discourse or sqli when you think about it. Fuzz paths with ffuf/intruder. Fuzz params with param miner. Fuzz vhosts. Fuzz headers.
kolten retweeted
You've heard of SSRF.
You've heard of IDOR.
But have you heard of SSRDOR?
😅 Me neither. But Secondary Context bugs are pretty much the combo of the two.
*Rolls up sleeves* Allow me to explain...
kolten retweeted
CSPT is my favorite vuln type - and I yap about it on @ctbbpodcast all the time.
I've been reporting CSPTs for the past 2 years+ now, so in light of the new research dropped by @Doyensec, let me drop a couple of takes on this🔥research:
kolten retweeted
Here's the solution for the XSS-challenge from last week.
🧵 (1/10)
I found a bug and made a XSS-challenge out of it: fransrosen.com/payment-chall…
I'll reveal the solution in a week.
kolten retweeted
Found some fun vulnerabilities on Instapage and HubSpot with @bbuerhaus, @sshell_, and @xEHLE_. Here's a thread with a couple mini writeups for them:
There are a few routes on the Hubspot CMS which are actually reverse proxies to Hubspot's CDN, you can see the "hs-fs" one below:
kolten retweeted
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here ->
portswigger.net/research/lis…
kolten retweeted
Bug bounty can be a cruel mistress sometimes.
Dupes, downgrades, mass closes and misunderstandings get us all down.
Solid tips were dropped on the pod last week to help in these times.
Here are 14 of them.
kolten retweeted
New blog! This time a high severity session takeover in Zoom worth $15,000. Read the story of how @sudhanshur705 , @BrunoModificato and I chained 2 completely useless XSS vulns to steal OAuth tokens, hijack browser permissions, and more:
nokline.github.io/bugbounty/…
kolten retweeted
⚠️"Attacking Organizations with Big Scope - from 0 to Hero" was my talk at #HitBxPhdays in Bangkok 🇹🇭. Happy to share the slides and recording with the community.
🔴 Slides: drive.google.com/file/d/1bAL…
🔴 Recording:
youtu.be/vFk0XtHfuSg?si=hlrp…
Enjoy!
#bugbounty #infosec #bugbountytips
kolten retweeted
Just published a writeup on my account takeover vulnerability in ChatGPT, using a really cool web cache deception technique. Waited a while to finally publish this, enjoy :)
nokline.github.io/bugbounty/…
