Ark (@arkark_) header
Ark (@arkark_) profile picture

Ark

@arkark_

Into experimental/deprecated features | CTF player | ex-traP

 __proto__
arkark.dev
Joined July 2015
  • Tweets4.6K
  • Following876
  • Followers2.5K
621Media
Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)Photo by Ark (@arkark_)
Cross-Site ETag Length Leak blog.arkark.dev/2025/12/26/e… I just posted the author writeup for impossible-leak in SECCON CTF 14 Quals. As far as I know, this is a new XS-Leak technique! The ETag header can become a side channel :)
Cross-Site ETag Length Leak | XS-Spin Blog

Cross-Site ETag Length Leak | XS-Spin Blog

A novel XS-Leak technique that turns ETag length differences into a cross-site oracle via 431 errors and History API.

blog.arkark.dev
5
99
4
356
44,371
IERAE CTF 2026 - FINAL for Humans Round 1 (Web) has started! alpacahack.com/ctfs/ierae-fi…
IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

A platform for exploring cybersecurity through Capture The Flag

alpacahack.com
1
3
18
1,725
github.com/mde/ejs/commit/e2… data object経由でejsの挙動を書き換えるCTFテクニックがついにできなくなった？
Remove options-in-data (Express 2 compat) (breaking) · mde/ejs@e2c015b

Remove options-in-data (Express 2 compat) (breaking) · mde/ejs@e2c015b

Options are no longer read out of the data object. This was compatibility for Express 2, which handed the view engine locals and options in a single object; the test suite itself labeled it &qu...

github.com
9
1,160
CTFを終わらせてくれる人を待ってます >RT
9
1,285
IERAE CTF 2026 — FINAL for Humans #1 One Web challenge. A vanilla AI agent couldn't solve it in testing. AI is welcome. October 10 · 09:00 JST alpacahack.com/ctfs/ierae-fi…
IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

IERAE CTF 2026 - FINAL for Humans Round 1 (Web) - AlpacaHack

A platform for exploring cybersecurity through Capture The Flag

alpacahack.com
31
8
110
25,773
blog.nginx.org/blog/nginx-ro… nginxに、parser differential問に使いやすそうな見た目をしてる機能が追加されてる👀
NGINX Routing on HTTP Request Body

NGINX Routing on HTTP Request Body

Note: Written by a human. In blog diagram graphic made by AI. NGINX processes HTTP requests in phases. Each phase is designed for specific actions and decisions on the qualities of the request....

blog.nginx.org
1
1
49
3,166
あまりにも抽象的なタイトルだから何も内容の言及ができない
419
報告してたFirefoxの脆弱性にCVE採番されました mozilla.org/en-US/security/a…
Image from Ark (@arkark_)
49
2,037
JavaScriptをパースしてASTの木構造を辿って評価するタイプのsandbox、厳密にはJSのsubsetではないのでJSだと認めたくはないけど比較的セキュア寄りな設計だと思う。少なくともproxyベースのsandboxよりは
5
621
JavaScript Sandbox Escape 1. github.com/nyariv/SandboxJS/… 2. github.com/nyariv/SandboxJS/…
Sandbox escape via assignment to __proto__ in scope variable records

Sandbox escape via assignment to __proto__ in scope variable records

### Summary A sandbox escape vulnerability due to a binding named `__proto__` replacing the prototype of the scope variable record. ### Details The three steps below chain a `__proto__` bi...

github.com
6
87
6,131
There are two solutions to this challenge. One lets you leak the full URL using pure CSS in Chrome 150+! Full write-up here: blog.voorivex.team/oauth-tok…
Image from AmirMohammad Safari (@AmirMSafari)
AmirMohammad Safari (@AmirMSafari) profile pictureAmirMohammad Safari
@AmirMSafariAug 18
This page is part of an OAuth callback. Can you hijack the authorization code? 🧪 Try it live on pwnbox.io/challenges/purifie…
Image from AmirMohammad Safari (@AmirMSafari)
5
29
3
183
11,722
Order of the Sinking Star is releasing on October 8, 2026 on PC (Steam & Steam Deck), Nintendo Switch 2, and PlayStation 5! 🌟 🧩 Wishlist and follow today: bit.ly/OSS-Website 📜 Read more details: bit.ly/OSS-RDA-Blog
43
185
42
1,142
97,416
github.com/jailctf/challenge… この出題形式のpyjailに続編が来ると思わなかった。コラッツ数列🤔
challenges-2026/collatz/handout/main.py at master · jailctf/challenges-2026

challenges-2026/collatz/handout/main.py at master · jailctf/challenges-2026

challenges-2026. Contribute to jailctf/challenges-2026 development by creating an account on GitHub.

github.com
6
1,077
BABA IS YOUのボードゲーム気になる
4
710
AIがparser differentialを見つけるのがうますぎる
14
1,191
優勝すごい。おめでとうございます 🎉
5
904
Finally!! We won DEF CON CTF! I’m incredibly proud to have competed as a member of this amazing team. I’m grateful to my teammates for the incredible teamwork that made this experience so special. GG to all the competitors, and thank you to the organizers for an incredible event!
Image from ふるかわ（furukawa） (@_N4NU_)
Image from ふるかわ（furukawa） (@_N4NU_)
11
22
260
8,610
DEFCON CTF Finals優勝しました‼️ 10年以上参加してきて、初めての優勝です。 AIでCTFが終わるという言説は私も概ね賛同(少なくとも違う競技になる)していて、今年が本当に最後だろうなあと思っていたので感無量です。 とりあえず疲れた & 風邪引いたので寝ます！
Image from 小池悠生 (@shojin_comp)
Image from 小池悠生 (@shojin_comp)
5
62
2
471
22,339
DEF CON CTF優勝！めでたい！！！！
Image from もうダニ by 左京区在中 (@tyage)
Image from もうダニ by 左京区在中 (@tyage)
Image from もうダニ by 左京区在中 (@tyage)
Image from もうダニ by 左京区在中 (@tyage)
7
13
1
135
6,033
QuickJS github.com/quickjs-ng/quickj… この立場を明確化しているSecurity .mdが好き
GitHub

GitHub

GitHub is where people build software. More than 225 million people use GitHub to discover, fork, and contribute to over 800 million projects.

github.com
10
1,715
セキュリティエンジニアの世界がAIで静かに終わりを迎えつつある。いま感じていることを話しました。
レバテックLAB（レバテックラボ） (@levtech_lab) profile pictureレバテックLAB（レバテックラボ）
@levtech_labAug 6
AIによって、これまでのハッキング競技や 「脆弱性を発見して報奨金をもらう」バグバウンティの文化は終わりを迎えつつある―― トッププレイヤーから見た「今起きていること」を率直に語っていただきました⏬
Image from レバテックLAB（レバテックラボ） (@levtech_lab)
2
41
4
262
35,353
Load more