Offensive security research. Assembly, C, C++, Rust. Binary analysis, exploit development, complex adaptive systems. IA32_LSTAR
Riyadh, Saudi Arabia 🇸🇦
Joined January 2015
- Tweets735
- Following228
- Followers1.1K
- Likes1K
Pinned Tweet
JIT code can be freed while the CPU still remembers an old indirect-branch target.
Branch Target Reuse (BTR) turns that stale predictor state into a speculative execute-after-free: when the code cache reuses the region, speculation can jump to an obsolete offset in the new code.
VUSec demonstrated it in Linux cBPF, SpiderMonkey and GraalVM. Their cBPF exploit leaks arbitrary kernel memory at ~8 B/s.
In SpiderMonkey, BTR reaches speculative arbitrary code execution; no end-to-end browser exploit was demonstrated.
vusec.net/projects/btr/
Huda retweeted
Node2Shell goes beyond Node.js.
CVE-2026-111497 affects Google’s Brotli C decoder, also used by Bun, Python’s Brotli/brotlicffi, and Envoy/Istio when Brotli decompression is enabled.
The upstream fix landed in February but wasn’t released until October 21.
RCE is demonstrated on Node.js only; other consumers’ exploitability depends on whether untrusted Brotli data reaches the decoder.
patchtheplanet.org/brotli
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Node2Shell goes beyond Node.js.
CVE-2026-111497 affects Google’s Brotli C decoder, also used by Bun, Python’s Brotli/brotlicffi, and Envoy/Istio when Brotli decompression is enabled.
The upstream fix landed in February but wasn’t released until October 21.
RCE is demonstrated on Node.js only; other consumers’ exploitability depends on whether untrusted Brotli data reaches the decoder.
patchtheplanet.org/brotli
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Huda retweeted
Express5のbodyParserだけではなくfetchもダメなんだ・・・。すぐにアップデート出来ない場合は、WAFでContent-Encoding: brをブロックしましょう
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Huda retweeted
A debugger can read memory, modify state, and control execution. MCP exposes that power to AI agents.
A source-level investigation of x64dbg, GhidraMCP, and IDA Pro MCP: authentication flaws, tool privileges, and prompt-injection risks.
Huda retweeted
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Huda retweeted
Burp Suite for Pentester: Autorize
🔥 Telegram: t.me/hackinarticles
✴ Twitter: xitter.cf/hackinarticles
Autorize is a Burp Suite extension that automates authorization testing by replaying requests with different user tokens to identify access control flaws in web applications.
📚 Vulnerabilities Detected with Autorize
🔐 Broken Access Control
🆔 Insecure Direct Object Reference (IDOR)
👥 Horizontal Privilege Escalation
⬆️ Vertical Privilege Escalation
📂 Forced Browsing
🧠 Business Logic Flaws
⚠️ Insufficient Authorization
📚 Topics Covered in This Guide
⚙️ Installation & Setup
🧩 Configuration & Filters
📡 Request/Response Analysis
🔄 Token & Cookie Replacement
🎯 Authorization Testing Workflow
📊 Interpreting Results (Bypassed / Enforced)
📖 Article:
hackingarticles.in/burpsuite…
#CyberSecurity #EthicalHacking #BurpSuite #Pentesting #BugBounty #WebSecurity
Huda retweeted
Crit pre-auth RCE for PHP core CVE-2026-109618+619
PoC: github.com/ikow/php2shell-po…
sess.upload_progress flaws; chain via sess-file inj, mem corr or deser → RCE in specific apps.
CVSS 9.2 Crit
Aff: PHP 5.4.0–8.5.11
Fix: 8.2.35, 8.3.36, 8.4.27, 8.5.12
Repo: PoCs (sess inj, heap UAF, handler-mismatch deser), Docker lab, analysis.
Crit pre-auth RCE for PHP core CVE-2026-109618+619
PoC: github.com/ikow/php2shell-po…
sess.upload_progress flaws; chain via sess-file inj, mem corr or deser → RCE in specific apps.
CVSS 9.2 Crit
Aff: PHP 5.4.0–8.5.11
Fix: 8.2.35, 8.3.36, 8.4.27, 8.5.12
Repo: PoCs (sess inj, heap UAF, handler-mismatch deser), Docker lab, analysis.
Huda retweeted
NIST P-256's unexplained curve seed was candidate #1,842 from `lrand48`, seeded with a Unix timestamp.
Anthropic recovered truncated PRNG states using lattice reduction and traced four other prime-curve seeds to the same generator.
Provenance, not an ECDSA break.
anthropic.com/research/ecdsa…
Huda retweeted
CVE-2026-21589: pre-auth file read across Atlassian products.
watchTowr traced it to shared web-resource handling: `::` decodes to `/`, enabling traversal through reachable resource routes into application files.
File disclosure, not RCE.
labs.watchtowr.com/you-wont-…
Huda retweeted
TLS ≠ package integrity.
Trail of Bits tested 25 package managers against a malicious repository.
Only Go and vcpkg verified every downloaded package in the tested configurations. Lockfiles alone aren't a universal integrity guarantee.
blog.trailofbits.com/2026/10…
Huda retweeted
Agentic security research has a task-scoping problem.
In an exploratory eval, James Kettle found models steering broad research cascades toward easy, low-impact findings.
Tighter tasks worked better. The underlying cause remains unproven.
portswigger.net/research/the…
Huda retweeted
MLIR's static memory planner turns eligible `memref.alloc`/`dealloc` pairs into views of one arena.
Lifetime-aware packing reuses offsets. Alias analysis and a reverse-alias guard prevent erasing deallocs that could free unmanaged buffers.
blog.llvm.org/posts/2026-08-…
NIST P-256's unexplained curve seed was candidate #1,842 from `lrand48`, seeded with a Unix timestamp.
Anthropic recovered truncated PRNG states using lattice reduction and traced four other prime-curve seeds to the same generator.
Provenance, not an ECDSA break.
anthropic.com/research/ecdsa…
MLIR's static memory planner turns eligible `memref.alloc`/`dealloc` pairs into views of one arena.
Lifetime-aware packing reuses offsets. Alias analysis and a reverse-alias guard prevent erasing deallocs that could free unmanaged buffers.
blog.llvm.org/posts/2026-08-…
Huda retweeted
Here's my WORKING php2shell exploit:
<?php
$exploit = true;
if ($exploit) {
echo "#whoami<br>";
echo "Ur fkin root bro.";
}
?>
(Credit: Claude)