chickenhacking retweeted
Latest: Zelenskyy tells reporters over WhatsApp that restrictions on Ukraine's Starlink systems remain. Interceptor drones can't function, logistics and operations hobbled. The maximum speed is 161 kph; "exceeding this limit causes the Starlink connection to cut out completely, resulting in the loss of the drone."
He says Ukraine has done tests to determine whether SpaceX is truly facing technical issues, as has been told Kyiv by the US side, or if this is a "deliberate operation... to restrict us, cut us off, and prevent us from defending ourselves and protecting our people, both at the front and among the civilian population."
He says Ukraine "sent a couple of vehicles equipped with Starlink terminals into European Union territory."
"They moved at speeds exceeding 180kph, and the Starlink systems worked perfectly. We have the relevant logs and evidence to prove this."
He adds: "The conclusion is clear: the restrictions are in effect within Ukraine but do not apply within the European Union. In other words, this is a planned operation."
chickenhacking retweeted
EXCLUSIVE: Elon Musk came to Donald Trump with the plan to throttle Ukraine’s use of SpaceX’s Starshield satellite internet network, sources have told the Telegraph.
The tech billionaire made the proposal during the US President’s row with Volodymyr Zelensky over strikes on Russian oil refineries.
‘The reality is that they were both in it,’ a senior source said of Musk’s and Trump’s involvement.
But after a night of carnage in Kyiv caused by the slowdown, Musk was alarmed about the possibility of adverse consumer reaction in Europe.
The SpaceX boss then proceeded to tweet, blaming the US administration, and ultimately, President Trump for authorising the slowdown.
‘He tweeted out that he was innocent and that it was the US administration that did it,’ the source said.
chickenhacking retweeted
I found a critical unauthenticated SQL injection that earned a $4,000 bounty. The WAF blocked most SQLi payloads, but I turned HTTP 500 errors into a data extraction channel.
The exploit came down to 3 things:
- SQL injection: A public API passed user input directly into BigQuery SQL.
- WAF bypass: Keyword filtering missed BigQuery scripting techniques.
- Error-based extraction: Detailed database errors exposed query results in HTTP 500 responses.
Here's how I chained all three together:
1. Find the injection
A public analytics endpoint accepted JSON input.
Adding a single `'` to a parameter returned:
`500 → Syntax error: Unclosed string literal`
The error also revealed Google BigQuery was the backend.
2. Build a boolean oracle
The WAF blocked keywords like `UNION`, `SELECT`, `AND`, and `OR`.
But BigQuery scripting constructs like `IF` and `ASSERT` still worked:
`IF TRUE THEN ASSERT FALSE; END IF;` → 500
`IF FALSE THEN ASSERT FALSE; END IF;` → 200
This let me ask the database true/false questions and read the answers from HTTP status codes.
3. Turn the 500 error into an output channel
This was the biggest breakthrough because blind SQLi normally requires guessing data one character at a time using those true/false responses.
But BigQuery supports:
`RAISE USING MESSAGE = 'hello'`
This deliberately throws a database error containing `hello`.
Because the API exposed database error details, the response included:
`500 → ... hello ...`
Now imagine replacing `hello` with a database query result.
The database includes that result in its error message, and the API returns it.
Instead of guessing characters, I could retrieve an entire value in one request.
4. Bypass the WAF using BigQuery's own features
The WAF blocked `EXECUTE IMMEDIATE`, which runs dynamically constructed SQL.
But this worked:
`EXECUTE/**/IMMEDIATE`
The SQL parser understood it, while the WAF's keyword matching didn't.
Another blocked keyword was `INFORMATION_SCHEMA`, used to enumerate tables and columns.
The bypass was:
`REVERSE('AMEHCS_NOITAMROFNI')`
BigQuery reconstructs `INFORMATION_SCHEMA` at runtime.
Using that reversed string in a dynamic query let me access database metadata without sending the blocked keyword literally.
5. What this unlocked
Using those techniques, I was able to:
- Enumerate datasets, tables, and columns
- Query tables unrelated to the original analytics endpoint
- Retrieve customer records, names, and addresses
- Access operational records containing personal identifiers and contact information
- Read sensitive fields that another API intentionally redacted
#BugBounty tip:
When a WAF blocks SQLi, don't just try random payloads. Understand the database dialect, what the WAF filters, and whether verbose errors leak data.
Sometimes a `500` isn't just an error. It may be your output channel.
chickenhacking retweeted
Daughter of White House Chief of Staff Susie Wiles is being paid $35k/month, as a lobbyist, working for the Russians in the Balkans.
Here she is in a photo uncovered by CBS, posing with the Interior Minister of the pro-Russian authoritarian government of Republika Srpska.
chickenhacking retweeted
Let's be clear:
The Lincoln Reflecting Pool was not vandalized.
Donald Trump poisoned it by hiring unqualified cronies in a no-bid contract.
He is lying.
He is having innocent people arrested to cover for his life.
TRUMP. IS. LYING.
chickenhacking retweeted
A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.
He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.
His name is Fabrice Bellard.
Here is the story, because almost nobody outside the systems programming world knows what one man has built.
Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.
In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.
Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.
He was not done.
In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.
He kept going.
In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.
In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.
Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.
Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org
He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.
A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.
He is still shipping.
chickenhacking retweeted
Nick Shirley came to Ukraine to pretend there wasn’t a war happening. He pumped out Russian propaganda from Kyiv and insinuated life was great here.
Unfortunately for @nickshirleyy, I spoke to his fixers today who told me he was terrified the entire time. He told them he didn’t want to visit frontline cities despite being offered to go. So he knew how bad it was and decided not to show it.
All of this contradicts Nicks posts saying he didn’t have accreditation to go anywhere outside Kyiv so ‘couldn’t show the reality of the war’
Nick has been caught lying.
chickenhacking retweeted
The Moscow Times reports that Trump’s White House Ballroom Commissioner will attend Putin’s speech at St. Petersburg Economic Forum
Rodney Mims Cook Jr. - overseeing new ballroom, DC arches etc - will be first American official to attend forum in 10 yrs
themoscowtimes.com/2026/05/2…
chickenhacking retweeted
Newly hacked files offer rare insight into Kremlin propaganda operations.
These include planting bloody pig heads in front of mosques in Paris; election interference campaigns and propaganda laundering through Israeli media.
Let’s dive into #FactoryofFakes🕵️♂️AGAIN!
1/10
🚨Breaking news:
Leaked docs from a Kremlin-controlled propaganda machine reveal a campaign backing far-right parties in EU elections and spreading disinformation to undermine Ukraine.
Read further:
vsquare.org/leaked-files-put…
Let’s dive into the #FactoryofFakes🕵️♂️🧵
1/15
chickenhacking retweeted
🚨Breaking news:
Leaked docs from a Kremlin-controlled propaganda machine reveal a campaign backing far-right parties in EU elections and spreading disinformation to undermine Ukraine.
Read further:
vsquare.org/leaked-files-put…
Let’s dive into the #FactoryofFakes🕵️♂️🧵
1/15
chickenhacking retweeted
Not enough people are talking about this.
A Florida airport was renamed after Donald Trump. He walked away with the trademark, the licensing rights, and a deal that lets him profit off every piece of merchandise sold there.
But the story of how he got it is even worse.
County staff told commissioners that rejecting the name change would put state transportation funding at risk. DeSantis has already removed state attorneys and school board members who dared to cross him. That is the reality the Democratic commissioner who cast the deciding vote was living in when she made her choice: hand Donald Trump control of a public airport or watch Florida Republicans strip funding from the very people she was elected to represent.
That is absolutely insane.
Florida Republicans handed Trump a money machine and called it a naming rights deal, and the people of Palm Beach County never got a say in any of it.
theguardian.com/us-news/2026…
chickenhacking retweeted
💥Instead of acting like a sovereign state, instead of apologizing for the disgrace of Itamar Ben Gvir, the Israeli foreign ministry is mocking Spain for, in it's turn, also abusing the flotilla activists. Congrats to all.
chickenhacking retweeted
The Trump admin is quietly deleting info about the Capitol attack from the DOJ website as it prepares to give funds to J6ers. This week, DOJ deleted a press release about one man with an ongoing child solicitation case who came to the Capitol with bear spray. Before and after:
chickenhacking retweeted
1. What I found in Trump's new 113-page financial disclosure report. It doesn't look good.
How is this not treason?
chickenhacking retweeted
Austria scrambled Eurofighter jets twice in two days after US Air Force PC-12 aircraft entered Austrian airspace without permission. On Sunday the planes turned back to Munich when intercepted. The incident is being handled through diplomatic channels - Welt
chickenhacking retweeted
Remember when they said Trump would get us into a full-blown war with Iran?
Times like these should make us all realize how lucky we were to have Trump, his strength and his resolve.
Readers added context they thought people might want to know
Trump got us into a war with Iran.
en.wikipedia.org/wiki/Timeline_…































