Co-Founder @neploxaudit. CTF team @C4TBuTS4D Security Researcher.
London
Joined December 2023
- Tweets196
- Following226
- Followers4.7K
- Likes324
Pinned Tweet
In 2024, I interacted a lot with Extensions.
I decided to create a resource that will help with a basic understanding of extensions and key attacks.
P.S. I tried to make everything as clear as possible and hope it won’t feel too overwhelming anywhere.
extensions.neplox.security/
We've been working with x402 for a while. Now that it’s taking off, we wrote down everything we’ve learned in an article
Also, we've refreshed our website design. Check it out, along with our previous articles if you missed them 👇
We found multiple ways to bypass the 402 paywalls 💸 neplox.security/research/bre…
:~$ "402 Payment Required" sat unused for 30-ish years - Now, the protocols reviving it let us skip the paying part; Here's how paywalls in TypeScript / Go / Java served paid content for free:
[1] - x402 verify() checked the amount, the asset and the network; but not the recipient. What if we rewrite payTo in the console and payTo ourselves? 👀
[2] - MPP credential proved an invoice was paid, not what for. What if we pay 1 sat for /cheap, but spend it on the 100 sat /expensive? 👀
[3] - The middleware priced one path, the server served another; & here is just 1 example out of many:
→ GET neplox.security/premium HTTP/1.1
Host: app.example
← HTTP/1.1 200 OK
{ "served":"PREMIUM CONTENT" }
<!-- READ MORE: "Breaking HTTP (pay)walls" -->
👉 neplox.security/research/bre…
slonser retweeted
> Highlights – the bugs you might find interesting:
0️⃣ PrivEsc TO Admin: through Privy Google account linking
1️⃣ Data Leak: when users can link the same address → they collide
2️⃣ Another sign-in flow + Privy / Google Auth bypasses = Account Spoofing
👉 link.neplox.security/nabu-au…
"We used to be magician on the board ... and now it's just like press a button and there's no mystery anymore" - @MagnusCarlsen on how chess changed once engines came along
I'm getting pretty much the same vibes from the AI in CTF...
(and IT/InfoSec in general)
slonser retweeted
Sometimes I feel like yapping about security issues; but not in a shitposting way - 🥀
So I recorded a series of videos – “Security Ensh!*$ttification”: each episode covers a certain hot topic + introduces you to research articles!
👁️ Ep.00 – Backdoors:
youtu.be/Uc8J81VZ6W0
I didn't really want to get involved in the discussion about the "death of CTF" because of AI.
But the conversations on Twitter keep going, so I'll express my thoughts in this thread.
For those too lazy to read — CTF will live on.
For the rest, I suggest reading the thread below.