m0z
@LooseSecurity
The greatest trick the devil ever pulled, was convincing the world that cyber security existed.
It's been a while since I last had a personal blog. Created a new one and we start off with a pretty cool chain. "Developing a Docker 1-Click RCE chain for fun" m0z.ie/research/2025-…
150k lifetime bounties 1 million audit 😂
A lot of people probably wonder what my company, Pantheon Labs, actually is and what the goal is. Basically, in a couple months, once I build more of a name in the cybersecurity space, we’ll be offering full audits to blockchain companies directly. Each audit will guarantee that…
Finally arriving today, 32GB RAM, 2TB SSD and a RTX 5070. Can't wait for it to still struggle to handle all the CTF web docker containers. 😅
It's a sad day for mankind.
Blink: Intent to Deprecate and Remove: Remove auto-detection of ISO-2022-JP charset in HTML bit.ly/3FUL2Je
Why does Python's webbrowser.open() method literally run arbitrary commands on Windows?? ("calc.exe") why?? 😅
I found a cool technique to make onblur fire without any user interaction. Open a window to the XSS payload and focus it: <bla tabindex=1 onblur=alert() autofocus> Then using the opener, redirect the window to hash of some element ID. This will unfocus and fire blur! 😀
They're really clutching here. Big budget propaganda 😭bestreamwise.com/#risks
Nicely done 😄
🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace. When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete. #mXSS #XSS
"If you want to make your parents proud you have to learn to exploit cloud"
Let's go! What an event 👀 Had a lot of fun and always a pleasure to play with such a talented team 😃
🏆It's a three-peat! Team Europe wins again the International Cybersecurity Challenge 2024 in Santiago, Chile 🇨🇱! Congratulations to all the players and coaches for their outstanding performance!👏 Find out more and get ready for ICC 2025: europa.eu/!x6tPFW
👏👏👏
Here's my quick and dirty PoC for the CUPS vulns. I wrote it after spotting the patches in the public CUPS repo. As always, expect CTF-quality code :D github.com/RickdeJager/cu…