m1tz retweeted
Happy announcement: My colleague and me will present a talk at hardwear.io NL 2026, "Vulnerabilities That Get Under Your Skin: Targeting the World’s Best-Selling Infusion Pumps". 100% human-brain VR 😛
m1tz retweeted
Last week, I joined a special educational #BugBounty event in Iceland, hosted by a private program and @Hacker0x01 🇮🇸
Two intense days of knowledge sharing, meeting old and new friends, exploring Reykjavík - and even spotting whales and dolphins.🤯
Grateful for this experience!
m1tz retweeted
Just released a new write-up: "From a Sanitized Name Field to One-Click Account Takeover":
zere.es/posts/self-xss-accou…
m1tz retweeted
SHA Pinning Is Not Enough rosesecurity.dev/2026/03/24/…
m1tz retweeted
Why can the ArgosDNS.io database look smaller in some cases?
Because bigger subdomain counts can just mean more wildcard noise.
This article explains why:
argosdns.io/blog/wildcard-dn…
m1tz retweeted
Some german IP (who are you :P) tried to "hack" argosdns.io using Strix Pentest Agent... it failed,ran into each protection mechanism ... so smart, so AI...
m1tz retweeted
I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏
clawd.it/posts/10-replaced-b…
#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai
m1tz retweeted
Thrilled to announce the start of a new chapter @codewhitesec 🙂 Thank you for the welcome package 🙃
m1tz retweeted
You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post by @0xor_solo about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01-…
m1tz retweeted
Latest ≠ Greatest? A Retrospective Analysis of CVE-2025-59287 in Microsoft WSUS from our very own @mwulftange who loves converting n-days to 0-days code-white.com/blog/wsus-cve…
m1tz retweeted
CVE-2025-55315, a 9.9 HTTP smuggling vulnerability in dotnet Kestrel webserver disclosed this week, caught my attention this morning due to lack of information, so I put together a very limited analysis of it. turb0.one/pages/Abbreviated_…
More to be done here for those interested!
Did you encounter the Supabase? Might wanna try my newest tooling or have a read about quickwins? There you go:
blog.m1tz.com/posts/2025/10/…
m1tz retweeted
Playing with HTTP/2 CONNECT blog.flomb.net/posts/http2co…
m1tz retweeted
Ten days left. The warm-up fades. Maultaschen were soft. Bean Beats were dark and burnt. But the beats of #ULMageddon will be brutal! #applyIfYouCan
m1tz retweeted
We've added a new demo to NewRemotingTricks that makes deploying a MarshalByRefObject (e.g., WebClient) even easier: System.Lazy<T> creates an instance of T on serialization, which is probably more likely to be allowed than a XAML gadget getting through. github.com/codewhitesec/NewR…
Stumbled upon your next Firebase target? You might want to take a closer look at this.
blog.m1tz.com/posts/2025/07/…
m1tz retweeted
We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange
m1tz retweeted
First experience with the @SamsungMobile Bug Bounty Program. Takes a looong time to get rewarded and the reward was not as expected…but anyways what stays is a CVE for Samsung (Browser App) 😅 Thanks @_m1tZ for the collab!#bugBounty #hacking
nvd.nist.gov/vuln/detail/CVE…
m1tz retweeted
Yes, we're beating a dead horse. But that horse still runs in corporate networks - and quietly gives attackers the keys to the kingdom. We're publishing what’s long been exploitable. Time to talk about it. #DSM #Ivanti code-white.com/blog/ivanti-d…
m1tz retweeted
My blog post on some vulns in GFI MailEssentials
frycos.github.io/vulns4free/…