@KERRO__

OffSec CTF (REV/PWN) @the3000org

 Tunisia
pwn-diaries.com/
Joined September 2018
  • Tweets84
  • Following596
  • Followers252
KERRO retweeted
xyzeva@xyz3va18 Dec 2025
how to hack discord, vercel and more with one easy trick kibty.town/blog/mintlify/
167
328
114
4,854
2,367,326
KERRO retweeted
adam
@theCTO6 Dec 2025
the person who discovered the #react2shell vulnerability should get paid $1m
20
40
8
1,138
119,736
KERRO retweeted
0b1d1@_0b1d16 Nov 2025
CloudRip Fast Cloudflare bypass scanner Find real server IPs behind Cloudflare by scanning subdomains. Multi-threaded for speed, skips Cloudflare-owned IPs, supports custom or built-in wordlists, and exports results. Built-in rate limiting to avoid getting blocked REPO ⤵️
7
129
4
685
33,923
I have seen lot of stupid things lately concerning CS, EDR's and Windows drivers. I wrote a, not so bad I guess, long blog post explaining how to build a windows driver, why EDR's need them, and how EDR's work, might be helpful 🤪 blog.whiteflag.io/blog/from-…

From Windows drivers to a almost fully working EDR

In this article we will see how Windows drivers work, how to create one and, in the end, we will develope a custom EDR that will rely on kernel callback functions, static analysis and API hooking.

blog.whiteflag.io
5
150
5
480
35,729
And we're live! dorkme.com/ Google ✅ Bing ✅ Baidy ✅ DuckDuckGo ✅ Yahoo/AOL ✅ CLI Tool ✅ Take your dorking to the next level, all feedbacks are appreciated! <3 #bugbounty #infosec #dork #dorking #seo #automation
7
60
1
287
31,194
BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution google.github.io/security-re…

BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

google.github.io
22
60
5,036
Remote Code Execution - Insecure Deserialization in a Helpdesk application CVE-2023-50978
1
1
1
11
1,134
You can now discover subdomains with HackerGPT.
18
78
5
644
77,658
KERRO retweeted
Saif@wr3nchsr25 Nov 2023
I published a new blog post about how I chained two vulnerabilities I found in Huawei NetEngine AR617VW to achieve post-auth RCE wr3nchsr.github.io/huawei-ne…

Huawei NetEngine AR617VW Authenticated Root RaCE

The journey of finding two post-authentication vulnerabilities (CVE-2022-48615, CVE-2022-48616) in Huawei NetEngine AR617VW and chaining them to achieve RCE as root.

wr3nchsr.github.io
7
3
51
9,666
KERRO retweeted
raptor@0xdea25 Nov 2023
Your printer is not your printer ! - Hacking Printers at Pwn2Own by @d3vc0r3 devco.re/blog/2023/10/05/you… devco.re/blog/2023/11/06/you… infosec.exchange/@raptor/111…

Your printer is not your printer ! - Hacking Printers at Pwn2Own Part I | DEVCORE 戴夫寇爾

In 2021, we found Pre-auth RCE vulnerabilities(CVE-2022-24673 and CVE-2022-3942) in Canon and HP printers, and vulnerability(CVE-2021-44734) in Lexmark. We used these vulnerabilities to exploit Canon...

devco.re
14
49
8,189
We stand with Gaza
2,702
19,225
629
114,117
5,525,652
KERRO retweeted
mav
@MavLevin1 May 2020
Per popular demand, here are my 30 reversing tips all together in one blog post 🤩 blog.vastart.dev/2020/04/guy…

Mav's 30 Reverse Engineering Tips & Tricks

During April I challenged myself to tweet 1 reverse engineering tip every day. For your viewing pleasure, here I aggregated all 30 tips.Be sure to follow me ...

mavlevin.com
12
262
11
632
new ctf tactic for pwners: a flexible arbitrary write -> rce primitive that doesn't rely on the linker, io objects, or malloc. it's in how your program chooses between SSE or AVX when doing a memcpy! hackmd.io/@pepsipu/SyqPbk94a

setcontext32 - HackMD

Once you’ve obtained an arbitrary write primitive, converting it into RCE tends to be a messy process: house this, house that, edge case this, edge case that. I’d just like to specify the function I...

hackmd.io
2
50
1
197
20,518
Like many others, I'm very excited for #37C3. It does however seem like there will be no #CTF this time. We did some brainstorming in the CTF Discord and came up with the idea of a "CCC Potluck CTF". Please read about it and potentially contribute: forms.gle/FaPGE492s9rPzCGQ6

37C3 Potluck CTF - Interest form

We are all very happy that CCC is making a return. However, as it currently stands, it seems that there will be no CCC CTF. After some brainstorming in the CTF Discord we came up with the idea of a...

docs.google.com
1
13
44
19,036
Replying to @Farenain @yates82 @vector35
api is amazing, lifting new arch is sooo simple with binary ninja. I'm currently lifting vm based obfuscation, following @samrussellnz amazing blog series lodsb.com/lifting-vm-based-o…

Lifting VM based obfuscators in Binary Ninja

Building a Binary Ninja architecture plugin to reverse a software protection challenge

lodsb.com
1
8
49
3,047
Replying to @RahmatQurishi @zseano
Google has a built in Open Redirect you can chain: https://google[.]com/amp/s/poc.rhynorater.com
6
53
2
242
40,948
Route to Bugs: Analyzing the Security of BGP Message Parsing i.blackhat.com/BH-US-23/Pres… [PDF]
2
35
2
79
13,697
Bypassing vtable Check in glibc File Structures: blog.kylebot.net/2022/10/22/…

[angry-FSROP] Bypassing vtable Check in glibc File Structures

IntroductionThe story began with a student, @Ramen, asking me about the status of file structure attacks nowadays two days ago. He told me there were no public attacks that grant PC-control solely fro

blog.kylebot.net
5
14
1,346
Load more