Hey, I now own ! I'm also revamping my personal website and thought it made sense to write my first post about where I am in life right now and why I'm taking a step back from popping shells for now!
Unrelated to the corCTF challenge, I was writing about "same-site leaks" using <object>. Maybe I should write something new now that there's the corCTF challenge 🤔
@intigriti
jquery.query-object is vulnerable to prototype pollution. The descriptor object doesn't define the value property so we can pollute descriptor.value. __proto__[value]=true&cmd=alert(document.domain)
I will never be 21 and whining about CTF infrastructure from a luxury suite in Vegas with my teammates again.
Earlier this month, I participated in the DEF CON 31 CTF and Midnight Sun CTF. This post serves as proof that I touched grass along the way.
Wrote many interesting challenges for SEETF this year. Some highlights:
• 0day SSRF bypass in PlantUML
• Client-side desync
• XS-Leak by abusing Chrome's URL length limits
• WASM buffer overflow
Challenge sources and solutions:
Thanks for playing!
offsec/vr is really fun as a hobby, but quickly gets dull as a job. much of my past year has been spent on finding a good balance, but now I've discovered so many other hobbies that I don't spend much time hacking things anymore... maybe I'll find that spark again at defcon?
I stepped out of my comfort zone and gave my first live-audience conference presentation at
@BSidesLondon
today!
Thank you
@roachy
and the rookies team for getting me settled in and easing my nerves! I'm really excited to try speaking to a larger audience in the future.
being in academic environments has always been hard for my mental health, but i was always too afraid to admit it. cambridge is not easy, it has taken a toll on my mental health, and i'm finally willing to admit it. so excited to see a therapist for the first time in my life.
I'm an
@offsectraining
User Generated Content (UGC) author! Recently submitted a machine, Charlotte, based on some security work I did last year. Can't wait for people to try it on Proving Grounds and untangle Charlotte's "web" 🌐 of vulnerabilities!
ez rce in 10 seconds with python
while True:
print("root
@pentagon
~$ ", end="")
os.system(input())
BOOM rooted 🔥🔥🔥
subscribe to my udemy course and patreon for more tips & tricks
#bugbountytips
#rce
#0day
Giving a 45 minute talk on modern client-side web security tomorrow. Fun stuff from novel XS-Leaks to the insecure mess of browser extensions. I'm totally not preparing my talk as I'm typing this.
Cybersecurity is not just about protecting individuals; it is also critical to national security.
#Taiwan
will continue to foster top cybersecurity talent that helps us build a more secure & resilient country that is trusted worldwide.
Wrote up some interesting web challenges from HackTM CTF by
@WreckTheLine
. Pretty cool stuff - I found an unintended solution to "secrets" and some weird Chrome behaviours along the way.
This is my last week securing the kids dancing app. Super grateful to the people who took a chance on me, offering me a pre-uni internship. During my time here, I found 50+ vulnerabilities and worked on cool projects. Excited to start a new chapter - back 2 school after 3 years!
In 2022:
- got accepted into my dream uni
- found my first CVEs
- gave my first conference talk (albeit on Zoom)
- got my OSWE
- lined up an internship for next year
-
@seetf_sg
hosted our first CTF (!)
Super grateful for the opportunities & can't wait for what 2023 holds 💙🤞
I barely have any time to play CTFs (or do any kind of self-learning for that matter, outside of exam revision) nowadays. Ironically I find myself looking forward to the end of the AY to start learning things I care about, instead of random physics applications of vector calc etc
🚀 ACSC 2024 (Asian Cyber Security Challenge) is Happening!🚀
📅 March 30-31, 2024 🌟 Mark your calendars!
🔜 Registration opening soon. Don't miss out!
More details here ▶️
#ACSC2024
#CyberSecurity
#SaveTheDate
having to mention "cybersecurity conference" to US immigration after getting selected for TSA's "SSSS" extra screening is a traumatising experience I won't wish upon my worst enemy
We got 2nd place! Really fun first-time hacker summer camp experience, and had lots of fun meeting teammates for the first time. Thanks to everyone who came down. With this experience I'll be more confident next year 💪
IMO, someone who plays CTFs / does bug bounties / reported legitimate CVEs >> someone who has every cert but does not do any of these. After from the HR screen it doesn't really do much. Of course if someone else (like employer) pays for it then yeah it's worth the effort.
Honestly it's finally dawning on me that I'm actually starting a CS degree at Cambridge in a month's time. 2 years ago I got rejected from almost every US school I applied to. The process was so draining and demoralising that I didn't even want to try studying overseas anymore.
MOCA CTF Quals is over!
Here are the teams who swore the most against our absolutely non-cursed challs. Seems like MarcoG is not the only author to cause PTSD, web authors really need to touch the grass. Very hard, with the face.
See you in Pescara, arrosticini are waiting!
Won 2nd place at a hackathon today as a solo team. Honestly, I think solo-ing a hackathon is a great experience to do once, just to test your skills & limits - never doing it again though... 😴
Some interesting challenges from niteCTF:
Protip for all future subdomain takeover challenges - make sure your exploit page path isn't guessable, or someone (definitely not me) is gonna steal your flag 😅
Nice day in NUS and we got 1st in greyhat CTF 2023 Final.Meanwhile I'm really happy to see friends onsite :D
Thanks for the organizers of greyhat CTF 2023 final.Challenge are interesting and great!
So, SEETF 2023 went really well. But it's missing one thing. One of the best things about CTFs is being able to meet talented individuals in person, and we want to do that with SEETF.
Here comes the problem - hosting an on-site CTF is hard, even more so for a small team like us.
After semi-tryharding some H1 programs over the past few weeks, I finally feel comfortable displaying this valuable skill on my LinkedIn profile. Truly an incredible skill to learn. More to come!
It's a wrap for SEETF 2022! Here's something I wrote from a CTF-organisational point of view. It also talks a bit about our challenge infrastructure, which I was in charge of:
If anyone is interested!
I'm kinda drained from replying to Discord DMs, I guess when people do CTFs it's tempting to just DM the author instead of opening a ticket, but "can I please get a hint" distracts me from legit DMs and I end up forgetting about them
My 4 web challenges that are still unsolved:
- Wasmabism
- ezXXE
- Now You C Me
- Star Cereal Episode 4: The Revenge of the Breakfast
Come be the first one at
🚀 ACSC 2024 registration is LIVE! 🚀 Gear up for the cyber showdown on Mar 30-31. Top 15 CTF players could represent Asia in Chile! 🌎
🔗 Register:
More details →
#ACSC2024
#CyberSecurity
#CTF
#ACSC2024
Craziest hackathon story just happened to me. There was another team with the same name as us. It was announced really early on that they won a (slightly smaller) prize. So naturally we thought they won this prize too. Today I got an email saying we actually won the top prize...