@rdjgr

Security Researcher @v12sec - CTF with Superflat / @0rganizers / ICC team Europe 22/23/24/25

bricked.tech
Joined November 2018
  • Tweets141
  • Following677
  • Followers2K
24Media
May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨ Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)
63
674
34
8,303
304,752
Rick de Jager retweeted
V12
@v12secOct 22
V12 found 25 vulnerabilities in the x402 protocol. Critical findings included: - Requests approved without any payment - Maliciously high requests being paid by default - Session takeover from relayed login signatures Here's how. 🧵
5
15
2
158
12,503
Rick de Jager retweeted
V12
@v12secOct 8
Here's our PoC for AnyDesk RCE: github.com/v12-security/pocs…
V12
@v12secJun 22
AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow) we will release PoC post disclosure and patch
3
73
4
463
25,272
another year, another file format bug 🥳
TrendAI Zero Day Initiative
@thezdiOct 7
Another printer bites the dust by Rick de Jager and Filippo Cremonese of @zellic_io/@v12sec earning him $5k and 2 Master of Pwn points in his successful exploit of Lexmark CX532adwe #Pwn2Own
1
34
1,029
Rick de Jager retweeted
V12
@v12secOct 5
Saturday was national boyfriend day so we forgot to post, but here's a Libreoffice RCE
7
33
5
336
17,145
Rick de Jager retweeted
V12
@v12secOct 1
We found a critical auth bypass in @better_auth, one of the most popular auth libraries in 2026 with over 9.5 million weekly downloads. CVSS 9.1. Fixed in Better Auth 1.7.7 PoC below 👇
7
47
2
357
18,907
How it _feels_ to write thumbnailer exploits on my own system
V12
@v12secSep 25
Memory corruption in Ghostscript 👻 This 1980's image parser might still get you shells in the big '26 PoC below
3
5
1
67
7,739
Rick de Jager retweeted
V12
@v12secSep 25
Memory corruption in Ghostscript 👻 This 1980's image parser might still get you shells in the big '26 PoC below
7
20
4
197
39,522
Rick de Jager retweeted
V12
@v12secSep 25
We can use our Ghostscript exploits to directly attack KDE's file manager from a single link click in Chrome. This PoC Downloads the file, then pops open the file manager for unsandboxed RCE (lovingly refered to as the full chain from temu)
V12
@v12secSep 25
Memory corruption in Ghostscript 👻 This 1980's image parser might still get you shells in the big '26 PoC below
7
36
6
420
28,480
Rick de Jager retweeted
Zellic
@zellic_ioSep 22
Security researchers from Zellic and V12 are presenting at BSides Canberra this week! @farazsth98 on weaponizing a subtle kernel bug. @rdjgr on heap corruption bugs in ghostscript, and the many targets affected. Both talks will be on main stage on Friday morning, come say hi!
2
9
63
3,329
Interestingly this is a very similar primitive to one of the "unexploitable" dead ends in @trailofbits recent article about sandbox escapes. (although this is a slightly different bug) It did take some manual nudging for me to convince 5.6-sol that AppArmor could be bypassed :)
V12
@v12secSep 17
user → root privesc 0-day in CUPS a free PoC while we wait for some bigger disclosures to go through 😇
5
31
3,777
Rick de Jager retweeted
Rick de Jager@rdjgrJul 15
Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.
44
250
36
2,365
499,932
Rick de Jager retweeted
V12
@v12secSep 15
Default configuration of WKWebView can cause downloaded files to instead be rendered on the host page. This allows HTML injection, and sometimes even XSS, in countless iOS and WebKit apps. PlayStation 5. Firefox. X. Instagram. TikTok. Telegram. Binance... Breakdown and POC. 🧵
5
56
3
333
48,252
Rick de Jager retweeted
V12
@v12secSep 8
Stored XSS in Forgejo, leading to full control over a victim's account:
1
10
42
4,785
Rick de Jager retweeted
V12
@v12secSep 2
XSS to full account takeover and wallet drain in Ditto. V12 found a deeplink parser bug that steals Nostr private keys with just one click. Here's how. 🧵
5
13
2
101
21,016
Rick de Jager retweeted
V12
@v12secAug 26
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵
17
152
42
731
140,449
Rick de Jager retweeted
V12
@v12secAug 18
another one (poc) for redis server RCE: github.com/v12-security/pocs… handleClientsBlockedOnKey() use-after-free. patched in release 8.8.2.
V12
@v12secJun 30
found another one! redis 8.8.0 bidirectional RCE we will release poc after the patch
2
17
1
127
23,017
Rick de Jager retweeted
V12
@v12secAug 17
and here's our poc for postgres server RCE: github.com/v12-security/pocs… CVE-2026-14669. patched postgreSQL 18.6. poc for client RCE 🔜
V12
@v12secJul 3
And here's postgres bidirectional RCE no admin required, client infects server, server infects client ♻️🐛
4
56
1
299
33,276
Rick de Jager retweeted
V12
@v12secAug 10
🐬🐬🐬 dolphin rce 🐬🐬🐬
41
104
17
2,157
205,999
Rick de Jager retweeted
V12
@v12secAug 5
Type text into Wikipedia. Get the shell's output back on the page. A bug introduced 22 years ago. Still alive in the wild, until it was found by V12. Here's how EasyTimeline allowed arbitrary code execution (RCE) directly from wikitext.
9
86
12
661
123,158
If you like my reverse-engineering, deobfuscation or malware work, I'm looking for a job - I am a security researcher with a knack for deep tooling/capability development and I've also done blue-team/pentesting work. DM me if you want my resume or if you want to ask questions!
эйвери_артемис.py.bak@nullableVoidPtrFeb 11
I continue being a reverse-engineering thing. LyticEnzyme has been updated to support both closed and open type worlds, and to enable recovery of method symbols even from stripped bins! Stretch goal is pseudocode cleanup of SubstrateVM snippets using a custom Lang. Repr.
2
15
127
9,823
Load more