@_CryptoCat

Security Researcher @rapid7 😈 Hacking Content @ https://xitter.cf/t.co/U7jVhNr9sC 💜

 Not Here
cryptocat.me
Joined May 2016
  • Tweets8.3K
  • Following241
  • Followers9.1K
1.1KMedia
Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚 They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳
Ethical hacking resources

ALT Ethical hacking resources

28
329
5
1,254
132,545
She's a 4, but she's a private key for a intermediary CA.
22
312
13
4,132
47,598
In the middle of working on some @metasploit modules and @github banned my work account 🫠
2
297
Daybreak Blue just stopped working at the same time as all the other models stopped answering *anything* hacking related. When I go to @OpenAI cyber page it says my account is not eligible for individual access and to contact my org (old uni). Support are refusing any refund 💀
2
1
12
1,381
I'm seeing some other people post about Daybreak issues (maybe due to PHP RCE) so hoping my account error is just coincidence! 🤞
1
1
425
No refunds though, apparently 🤷‍♂️
ScamGPT

ALT ScamGPT

2
167
CryptoCat retweeted
Jorian
@J0R1ANOct 22
Everybody talking about php2shell, but wait 'till you hear about shell2php:
8
45
3
1,006
11,492
Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: youtube.com/watch?v=iWpykLFI…

Hacktics & Telemetry, E17: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. Lena Yu)

Episode 17 of Hacktics and Telemetry explores the evolving intersec...

youtube.com
5
10
3,872
Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑 cryptocat.me/blog/research/a…

User Registration & Membership Cross-Site Request Forgery to User Approval and Denial | CVE-2026-...

Root cause analysis of CVE-2026-92978 in User Registration & Membership, where the bulk Approve and Deny actions on the WordPress Users screen never checked a nonce, so any page a logged-in adminis...

cryptocat.me
13
676
How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE
3
5
155
4,450
CryptoCat retweeted
Traceix
@usetraceixOct 21
We’re shutting down too. We don’t use php I just don’t wanna work tomorrow.
MalShare@mal_shareOct 20
We are aware of the PHP vulnerability and are shutting down for the weekend.
79
2,261
94
35,064
513,983
CryptoCat retweeted
SinSinology
@SinSinologyOct 21
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com
52
264
29
1,906
167,465
CryptoCat retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
404
91
3,066
382,694
CryptoCat retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
244
28
748
163,046
CryptoCat retweeted
Kirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
273
1,817
683
16,125
3,656,800
Last Frappe post: GET CSRF in the bulk update endpoint, chained to RCE against a Website Manager. cryptocat.me/blog/research/a…

Frappe Bulk Update GET CSRF and a Browser-to-RCE Chain | CryptoCat's Blog

A GET CSRF in Frappe's bulk update endpoint lets one cross-site link change documents as a logged-in user, and against a Website Manager it chains into remote code execution.

cryptocat.me
10
592
Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: github.com/rapid7/metasploit…
1
5
22
1,804
Part 3/4 pwning Frappe / ERPNext: unpublishing a Frappe Web Form leaves its submission RPC live. A guest who knows the form name creates the backing document, permissions ignored 😬 cryptocat.me/blog/research/a…

Frappe Web Form Publication and Field Authorisation Failures | CryptoCat's Blog

How Frappe kept unpublished Web Forms alive through direct RPCs and trusted protected field values before a privileged document insert.

cryptocat.me
6
462
Part 2/4 pwning Frappe / ERPNext: a guest-triggered email embeds a file by path, the inline-image scanner reads it off disk, and /etc/passwd comes back 🙏 cryptocat.me/blog/research/a…

Frappe Unauthenticated Email Inline-Embed File Disclosure | CryptoCat's Blog

How Frappe let a Guest turn the stock account-deletion email into a local-file disclosure channel.

cryptocat.me
16
915
I have never seen a dog this big 😅
2
3
726
same bar, different dog 🐶
84
7 bugs, 0 CVEs 🥲 Here's part 1/4 of my pwning Frappe / ERPNext series 💥 cryptocat.me/blog/research/a…

Guest Stored XSS and Safe-Jinja File Write to RCE in Frappe and ERPNext | CryptoCat's Blog

An unauthenticated guest stores a script in a Frappe OAuth client name and chains it, through safe-Jinja file write or an ERPNext Genericode path traversal, into remote code execution.

cryptocat.me
6
40
1,357
Load more