Aethlios
@aethlios.bsky.social
Lead developer | Bug hunter (approximately every 3 months)
> https://aeth.cc
> https://aeth.cc
I'm excited to share that I recently found a XSS in Quasar Framework. The CVE-2025-43954 has just been published to document this security issue.
You can learn more about it here:
- github.com/advisories/G...
You can learn more about it here:
- github.com/advisories/G...
April 24, 2025 at 12:15 PM
I'm excited to share that I recently found a XSS in Quasar Framework. The CVE-2025-43954 has just been published to document this security issue.
You can learn more about it here:
- github.com/advisories/G...
You can learn more about it here:
- github.com/advisories/G...
Reposted by Aethlios
You might have noticed that the recent SAML writeups omit some crucial details. In "SAML roulette: the hacker always wins", we share everything you need to know for a complete unauthenticated exploit on ruby-saml, using GitLab as a case-study.
portswigger.net/research/sam...
portswigger.net/research/sam...
SAML roulette: the hacker always wins
Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library
portswigger.net
March 18, 2025 at 2:57 PM
You might have noticed that the recent SAML writeups omit some crucial details. In "SAML roulette: the hacker always wins", we share everything you need to know for a complete unauthenticated exploit on ruby-saml, using GitLab as a case-study.
portswigger.net/research/sam...
portswigger.net/research/sam...
Great resource on secret leakage, I invite you to read it.
The State of Secrets Sprawl Report | GitGuardian
www.gitguardian.com
March 12, 2025 at 11:42 AM
Great resource on secret leakage, I invite you to read it.
Reposted by Aethlios
I’ve updated the bug bounty & content creators starter pack with classic research group @hackerschoice.bsky.social! Let me know if you’re not on this list and would like to be added.
go.bsky.app/GD7hKPX
go.bsky.app/GD7hKPX
February 3, 2025 at 6:36 PM
I’ve updated the bug bounty & content creators starter pack with classic research group @hackerschoice.bsky.social! Let me know if you’re not on this list and would like to be added.
go.bsky.app/GD7hKPX
go.bsky.app/GD7hKPX
Reposted by Aethlios
Thanks for your all your votes! The public vote is now closed, and we're kicking off the panel vote with fifteen quality nominations. In the meantime we just published a new technique ourselves - check it out here:
Hot out of the oven! The Cookie Sandwich – a technique that lets you bypass the HttpOnly protection! This isn't your average dessert; it’s a recipe for disaster if your app isn’t prepared: portswigger.net/research/ste...
Stealing HttpOnly cookies with the cookie sandwich technique
In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie
portswigger.net
January 22, 2025 at 4:08 PM
Thanks for your all your votes! The public vote is now closed, and we're kicking off the panel vote with fifteen quality nominations. In the meantime we just published a new technique ourselves - check it out here:
Reposted by Aethlios
24 hours remaining until voting closes on the Top 10 (new) Web Hacking Techniques of 2024! If you haven't already voted now's the time to do it.
portswigger.net/polls/top-10...
portswigger.net/polls/top-10...
Top 10 web hacking techniques of 2024
Welcome to the community vote for the Top 10 Web Hacking Techniques of 2024.
portswigger.net
January 21, 2025 at 8:08 AM
24 hours remaining until voting closes on the Top 10 (new) Web Hacking Techniques of 2024! If you haven't already voted now's the time to do it.
portswigger.net/polls/top-10...
portswigger.net/polls/top-10...
Reposted by Aethlios
Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here: portswigger.net/polls/top-10...
Top 10 web hacking techniques of 2024
Welcome to the community vote for the Top 10 Web Hacking Techniques of 2024.
portswigger.net
January 15, 2025 at 3:24 PM
Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here: portswigger.net/polls/top-10...
Reposted by Aethlios
I've pushed some updates to Dom-Explorer:
- Allow multiple pipeline embed
- Short links for sharing/sync
- Support for DomPurify triggers
- User settings
Give it a try and share your findings!
yeswehack.github.io/Dom-Explorer
- Allow multiple pipeline embed
- Short links for sharing/sync
- Support for DomPurify triggers
- User settings
Give it a try and share your findings!
yeswehack.github.io/Dom-Explorer
Dom-Explorer
yeswehack.github.io
December 20, 2024 at 1:54 PM
I've pushed some updates to Dom-Explorer:
- Allow multiple pipeline embed
- Short links for sharing/sync
- Support for DomPurify triggers
- User settings
Give it a try and share your findings!
yeswehack.github.io/Dom-Explorer
- Allow multiple pipeline embed
- Short links for sharing/sync
- Support for DomPurify triggers
- User settings
Give it a try and share your findings!
yeswehack.github.io/Dom-Explorer
Reposted by Aethlios
Reposted by Aethlios
Reposted by Aethlios
A younger me, as a pentester and bug hunter, had exactly the bias described in this article 🤫
Luckily, I later worked with and for "the other side" and it changed my mind 🤯
I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞
Luckily, I later worked with and for "the other side" and it changed my mind 🤯
I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞
Why Can't You Fix This Bug Faster?
Fixing security vulnerabilities in a timely manner is more complicated than you realize.
maxwelldulin.com
December 14, 2024 at 11:02 PM
A younger me, as a pentester and bug hunter, had exactly the bias described in this article 🤫
Luckily, I later worked with and for "the other side" and it changed my mind 🤯
I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞
Luckily, I later worked with and for "the other side" and it changed my mind 🤯
I hope young people reading it will avoid taking years to understand the complexities of fixing bugs in a timely manner 🤞
Reposted by Aethlios
EP 171 | Reset-tolkien Ft. @AethliosIK & @penthium2
YouTube video by Laluka
www.youtube.com
December 13, 2024 at 2:32 PM
Reposted by Aethlios
Yo ! 🧙♂️
Prochain stream demain -mardi 10 Dec- à 21h !
Au programme ? We Deep Dive ! 🧐
- Reset-tolkien par @AethliosIK (X) 🗝️
- Portainer & UID remap par @penthium2 (X) 🐳
www.twitch.tv/thelaluka
Prochain stream demain -mardi 10 Dec- à 21h !
Au programme ? We Deep Dive ! 🧐
- Reset-tolkien par @AethliosIK (X) 🗝️
- Portainer & UID remap par @penthium2 (X) 🐳
www.twitch.tv/thelaluka
Twitch
Twitch is the world
www.twitch.tv
December 9, 2024 at 4:17 PM
Yo ! 🧙♂️
Prochain stream demain -mardi 10 Dec- à 21h !
Au programme ? We Deep Dive ! 🧐
- Reset-tolkien par @AethliosIK (X) 🗝️
- Portainer & UID remap par @penthium2 (X) 🐳
www.twitch.tv/thelaluka
Prochain stream demain -mardi 10 Dec- à 21h !
Au programme ? We Deep Dive ! 🧐
- Reset-tolkien par @AethliosIK (X) 🗝️
- Portainer & UID remap par @penthium2 (X) 🐳
www.twitch.tv/thelaluka
Reposted by Aethlios
Bonjour,
Bienvenue dans ce live-skeet du procès de Florent Curtet, ce trentenaire poursuivi pour des extorsions numériques, jugé en cette fin de mois à Paris par le tribunal judiciaire.
Bienvenue dans ce live-skeet du procès de Florent Curtet, ce trentenaire poursuivi pour des extorsions numériques, jugé en cette fin de mois à Paris par le tribunal judiciaire.
November 25, 2024 at 12:40 PM
Bonjour,
Bienvenue dans ce live-skeet du procès de Florent Curtet, ce trentenaire poursuivi pour des extorsions numériques, jugé en cette fin de mois à Paris par le tribunal judiciaire.
Bienvenue dans ce live-skeet du procès de Florent Curtet, ce trentenaire poursuivi pour des extorsions numériques, jugé en cette fin de mois à Paris par le tribunal judiciaire.
A really comprehensive resource on CORS attacks. I'm going to rework my course slides based on this research, thank you for your contribution!
Excited to release my latest research. Exploiting CORS can be a tricky in modern web apps, but there are still critical cases out there if you know what to look for. If you want to learn more about CORS exploitation, the research is available at
Exploiting trust: Weaponizing permissive CORS configurations
Find out whether you’re underestimating Cross-Origin Resource Sharing (CORS) vulnerabilities in our latest research.
outpost24.com
November 25, 2024 at 2:01 PM
A really comprehensive resource on CORS attacks. I'm going to rework my course slides based on this research, thank you for your contribution!
Reposted by Aethlios
Custom lists are super cool! I enjoy reading social posts, but want to make sure I never miss a quality writeup or technique. To achieve this, I'm building a 'high signal web security' list of topic-focused accounts, which you can pin next to 'Following' if you want :)
bsky.app/profile/jame...
bsky.app/profile/jame...
November 25, 2024 at 1:09 PM
Custom lists are super cool! I enjoy reading social posts, but want to make sure I never miss a quality writeup or technique. To achieve this, I'm building a 'high signal web security' list of topic-focused accounts, which you can pin next to 'Following' if you want :)
bsky.app/profile/jame...
bsky.app/profile/jame...
I'm glad to see so many people switching over to Bluesky and following me!
Take the time to discover my open source tool on sandwich attacks :
👉 github.com/AethliosIK/r...
Take the time to discover my open source tool on sandwich attacks :
👉 github.com/AethliosIK/r...
GitHub - AethliosIK/reset-tolkien: Unsecure time-based secret exploitation and Sandwich attack implementation Resources
Unsecure time-based secret exploitation and Sandwich attack implementation Resources - GitHub - AethliosIK/reset-tolkien: Unsecure time-based secret exploitation and Sandwich attack implementatio...
github.com
November 25, 2024 at 11:28 AM
I'm glad to see so many people switching over to Bluesky and following me!
Take the time to discover my open source tool on sandwich attacks :
👉 github.com/AethliosIK/r...
Take the time to discover my open source tool on sandwich attacks :
👉 github.com/AethliosIK/r...
Reposted by Aethlios
In case you're a professional Burp Suite user, there's a few seats left for the Q1 2025 training sessions
hackademy.agarri.fr/2025
hackademy.agarri.fr/2025
I'm using burp for like 15 years now, but @agarri.fr's training was absolutely mind blowing and really super charged my burp skills!
November 17, 2024 at 4:55 PM
In case you're a professional Burp Suite user, there's a few seats left for the Q1 2025 training sessions
hackademy.agarri.fr/2025
hackademy.agarri.fr/2025
Reposted by Aethlios
Any bug bounty people around? I'm creating a starter pack of people to follow but it's pretty brief currently! Let me know if you'd like to be added: go.bsky.app/GD7hKPX
November 21, 2024 at 3:23 PM
Any bug bounty people around? I'm creating a starter pack of people to follow but it's pretty brief currently! Let me know if you'd like to be added: go.bsky.app/GD7hKPX
My second article on time-based secrets has just been published! 🚀
I explore a new usecase of the sandwich attack to set up a scenario for real-time monitoring of web application invitations.
- English version: aeth.cc/public/Artic...
- French version: aeth.cc/public/Artic...
I explore a new usecase of the sandwich attack to set up a scenario for real-time monitoring of web application invitations.
- English version: aeth.cc/public/Artic...
- French version: aeth.cc/public/Artic...
July 18, 2024 at 9:33 AM
My second article on time-based secrets has just been published! 🚀
I explore a new usecase of the sandwich attack to set up a scenario for real-time monitoring of web application invitations.
- English version: aeth.cc/public/Artic...
- French version: aeth.cc/public/Artic...
I explore a new usecase of the sandwich attack to set up a scenario for real-time monitoring of web application invitations.
- English version: aeth.cc/public/Artic...
- French version: aeth.cc/public/Artic...
Following #bugbounty findings, I started focusing my research on time-based secrets. This research began for me a year ago, and enabled me to take the time to implement my open source tool: “Reset Tolkien”. 🚀
I've written an article detailing my research :
- 🇬🇧 EN : www.aeth.cc/public/Artic...
I've written an article detailing my research :
- 🇬🇧 EN : www.aeth.cc/public/Artic...
April 2, 2024 at 9:57 AM
Following #bugbounty findings, I started focusing my research on time-based secrets. This research began for me a year ago, and enabled me to take the time to implement my open source tool: “Reset Tolkien”. 🚀
I've written an article detailing my research :
- 🇬🇧 EN : www.aeth.cc/public/Artic...
I've written an article detailing my research :
- 🇬🇧 EN : www.aeth.cc/public/Artic...