HolyBugx (@HolyBugx) header
HolyBugx (@HolyBugx) profile picture

HolyBugx

@HolyBugx

AppSec, and Automation.

hackerone.com/holybugx
Joined July 2020
  • Tweets146
  • Following537
  • Followers12K
1Media
Photo by HolyBugx (@HolyBugx)
Don't rely on WAFs.
Image from HolyBugx (@HolyBugx)
Guillermo Rauch (@rauchg) profile pictureGuillermo Rauch
@rauchg5 Dec 2025
Replying to @infosec_au @assetnote
DM’d you. You have a working repro for bypassing Cloudflare but not Vercel. Would love to correct the record or see the evidence.
16
50
5
1,059
184,560
The results are in! We're proud to announce the Top ten web hacking techniques of 2024! portswigger.net/research/top…
Top 10 web hacking techniques of 2024

Top 10 web hacking techniques of 2024

Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net
24
291
40
862
225,942
HolyBugx retweeted
Sam Curry (@samwcyo) profile picture
Sam Curry@samwcyo23 Jan 2025
New blog post with @infosec_au: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. The issue was reported and patched. Full post here: samcurry.net/hacking-subaru
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United...

samcurry.net
47
312
18
1,015
118,884
HolyBugx retweeted
d4d (@zakfedotkin) profile picture
d4d
@zakfedotkin22 Jan 2025
Introducing the Cookie Sandwich, a tasty technique to steal HttpOnly cookies using legacy RFC features: portswigger.net/research/ste…
Stealing HttpOnly cookies with the cookie sandwich technique

Stealing HttpOnly cookies with the cookie sandwich technique

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie

portswigger.net
2
90
3
265
29,846
Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵
Image from Michael Stepankin (@artsploit)
7
78
1
296
30,743
Research into a unique 0-click deanonymization exploit targeting Signal, Discord and hundreds of platform 🧵
Image from daniel (@hackermondev)
Image from daniel (@hackermondev)
102
462
104
4,215
421,166
HolyBugx retweeted
d4d (@zakfedotkin) profile picture
d4d
@zakfedotkin4 Dec 2024
Did you know you can use an ancient magic cookie to downgrade parsers and bypass WAFs?! Neither did we. Enjoy! portswigger.net/research/byp…

Bypassing WAFs with the phantom $Version cookie

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known

portswigger.net
4
65
1
246
15,329
Check out our latest blog post! We dive into GitHub Enterprise’s SAML implementation and explore an authentication bypass in encrypted assertion mode. CVE-2024-4985 / CVE-2024-9487: GitHub Enterprise SAML Authentication Bypass. projectdiscovery.io/blog/git…
GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487) — ProjectDiscovery Blog

GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487) — ProjectDiscovery Blog

Introduction In light of the recent Ruby-SAML bypass discovered in GitLab, we set out to examine the SAML implementation within GitHub Enterprise. During our research, we identified a significant...

projectdiscovery.io
49
1
178
17,143
1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips gist.github.com/hackermondev…
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500...

1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500...

1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies - zendesk.md

gist.github.com
72
336
60
1,320
2,023,357
Attacking UNIX Systems via CUPS, Part I evilsocket.net/2024/09/26/At…
Attacking UNIX Systems via CUPS, Part I | evilsocket

Attacking UNIX Systems via CUPS, Part I | evilsocket

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…

evilsocket.net
168
1,107
291
3,578
1,061,369
Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company lyra.horse/blog/2024/09/usin…

Using YouTube to steal your files

A writeup of my $4133.70 Google Drive vulnerability chain.

lyra.horse
1
102
3
398
41,841
In August, watchTowr Labs hijacked parts of the global .mobi TLD - and went on to discover the mayhem that we could cause. Enjoy.... labs.watchtowr.com/we-spent-…
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI

We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI

Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas...

labs.watchtowr.com
9
125
13
340
50,011
In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found. Here is our writeup: ian.sh/tsa
Bypassing airport security via SQL injection

Bypassing airport security via SQL injection

We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.

ian.sh
51
610
96
2,175
188,992
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code from 1996
37
648
36
1,900
240,103
Everyone knows that the RFCs for email addresses are crazy. This post will show without doubt that you should not be following the RFC. portswigger.net/research/spl…
Splitting the email atom: exploiting parsers to bypass access controls

Splitting the email atom: exploiting parsers to bypass access controls

Some websites parse email addresses to extract the domain and infer which organisation the owner belongs to. This pattern makes email-address parser discrepancies critical. Predicting which domain an

portswigger.net
11
149
9
428
92,980
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here -> portswigger.net/research/lis…
Listen to the whispers: web timing attacks that actually work

Listen to the whispers: web timing attacks that actually work

Websites are riddled with timing oracles eager to divulge their innermost secrets. It's time we started listening to them. In this paper, I'll unleash novel attack concepts to coax out server secrets

portswigger.net
8
173
9
515
66,737
HolyBugx retweeted
RyotaK (@ryotkak) profile picture
RyotaK@ryotkak2 Aug 2024
I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack. This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack. flatt.tech/research/posts/be…
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking...

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking...

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. In 2023, James Kettle of PortSwigger published an excellent paper titled Smashing the state machine: the true...

flatt.tech
15
243
17
792
123,198
PHP just fixed one of my RCE vulnerabilities, which affects XAMPP by default. Check to see if you are affected and update now! 🔥 blog.orange.tw/2024/06/cve-2…
12
338
26
1,202
136,001
HolyBugx retweeted
Harel (@H4R3L) profile picture
Harel@H4R3L7 Jun 2024
New blog! This time a high severity session takeover in Zoom worth $15,000. Read the story of how @sudhanshur705 , @BrunoModificato and I chained 2 completely useless XSS vulns to steal OAuth tokens, hijack browser permissions, and more: nokline.github.io/bugbounty/…

Zoom Session Takeover - Cookie Tossing Payloads, OAuth Dirty Dancing, Browser Permissions Hijacki...

Here you can read all about my research and techniques I’ve gathered over time!

nokline.github.io
10
129
3
424
36,529
HolyBugx retweeted
Sam Curry (@samwcyo) profile picture
Sam Curry@samwcyo3 Jun 2024
New writeup: "Hacking Millions of Modems (and Investigating Who Hacked My Modem)" samcurry.net/hacking-million… Thanks for reading! Huge thanks to @blastbots, @bbuerhaus, @infosec_au, @d0nutptr, @iangcarroll, and everyone who reviewed the post beforehand.
Hacking Millions of Modems (and Investigating Who Hacked My Modem)

Hacking Millions of Modems (and Investigating Who Hacked My Modem)

Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I...

samcurry.net
45
374
30
1,197
126,558
Load more