I just joined the waitlist for @immunefi Studio Review. Get feedback on your reports before you submit. immunefi.com/studio
Check out my "Audit Competition | ENS" card on @immunefi!
#OnchainDefender immunefi.com/s/pc/?u=crypt0n…
This was my first attempt at working with Web3 on @immunefi platform. Thank you🧡. look forward to future audits )
Security researcher @br0nz3p1ck4x3 identified the Most Valuable Finding in the @ensdomains Audit Competition.
Finding: A lookalike ENS name planted with a zero width space could trick a user into paying to renew an attacker's registration while the dashboard showed the user's own name.
Here's what @ensdomains team had to say:
"This is the clearest case in the competition of a user losing actual money to an attacker through a flow working exactly as the interface described it. The write up is also the most useful one we received, because it found the misconception rather than just the bug. That is the kind of finding internal review does not catch."
Congrats on the finding, @br0nz3p1ck4x3!
The @ensdomains Audit Competition is a wrap!
🏆 Top Winners:
🥇 br0nz3p1ck4x3 - $8,013
🥈 @crypt0n1337 - $6,461
🥉 bugtester - $5,557
🏅 @xylz__1 - $3,194
🏅 I_A_J - $3,032
Congrats to all participants & winners! 🎖
Security researchers are the reason critical bugs get found before attackers reach them.
That will be true no matter how technology changes.
We will keep building better tools for the researchers (human and AI) doing the hard work.
Security researchers are the backbone of onchain security today and across the broader internet. Because of them, we are surviving the AI security apocalypse.
And that has been forgotten.
Too many companies went from valuing SRs one day to abandoning them the next. They weren’t even thrown a life raft to follow along.
At Immunefi, we see things differently.
SRs were the core of security before, they remain the core of security today, and they will be the core of security tomorrow.
We need to figure out, as an industry and as a community, how we’re going to adapt to these changes; how to bring all security researchers with us, along with the recognition and support they deserve for keeping us safe thus far.
SR Summer was our way of showing a little recognition, and with Immunefi Studio, we will continue to put as much power in the hands of SRs as possible.
Thanks to all those who took part, and congratulations to the winners!
crypt0n1337 retweeted
GPT-5.6 Sol found a very cool authentication bypass.
- you submitted the uuid as password, pass confirmation and erp_code and it spilled out the access token for that user.
I couldn't enum uuids so CVSS only 7.4.
crypt0n1337 retweeted
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public.
github.com/MSNightmare/Shiel…
The PoC works with the latest August 2026 patch
crypt0n1337 retweeted
Just showing off some fancy ASCII art wrapper around @KlezVirus’s version of #donut (weaponized with SW3) for generating .NET self-injectors. Consider supporting @porchetta_ind to play with the fresh 🍩 too!
[Video] The 4th episode of my series about Inceptor is out: "Empowering Donut with Direct and Indirect Syscalls".
In this video, we'll show how it is possible to improve the donut loader by intergating it with SW3.
youtu.be/ypX7N4498xE
crypt0n1337 retweeted
Cobalt Strike doing a fork&run to take screenshots is unnecessarily OPSEC expensive, so I made a quick BOF to do it inline using WinAPI.
github.com/CodeXTF2/Screensh… - Cobalt Strike Beacon Object File to take screenshots using WinAPI
crypt0n1337 retweeted
Replying to @GossiTheDog @orange_8361
From one of the successful exploits, something to look for in the IIS logs ..
crypt0n1337 retweeted
Path traversal to RCE worth $12000 on GitLab 😳
Jun 2022
github.com/NafisiAslH/Knowle…
#bugbountytips

















