Lauritz
LightNews LightNews
banner
lauritz-holtmann.de
Lauritz
@lauritz-holtmann.de
320 followers 300 following 28 posts
IT-Security Researcher, Pentester and Bug Hunter. Passionate about 💻, 🤽‍♂️, ⚜️, 🎸 and ⚽ #meinVfL

#Kaeferjaeger + H1 Ambassador
🏠 https://security.lauritz-holtmann.de
Posts Replies Media Videos
lauritz-holtmann.de
Recap of our @hacker0x01.bsky.social Hacking Meetup in September 👀

Leaderboard (still in progress): leaderboards.hackerone.live/germany-meet...

👉 h1.community/e/mbkdm3/

#BugBounty #Meetup #HackerOne
October 6, 2025 at 9:15 PM
lauritz-holtmann.de
Hacking Meetup vol. 3 of the German @hacker0x01.bsky.social Club - supported by @exnessofficial.bsky.social - was a blast! 💥

We x6 the overall bounties of our previous meetup and scored over 94,000$ overall bounties. 🤯

Additionally, H1 swag is on the way to all attendees and will arrive soon. 🤞
June 26, 2025 at 4:13 PM
lauritz-holtmann.de
Our @hacker0x01.bsky.social meetup (vol.2) last month was a blast! 🔥

Almost 40 signups, ~25 active remote attendees and 12 attendees from all over Germany who travelled to #Bochum and hacked together in person on Grab's assets. 🤯

#BugBounty #Meetup
March 27, 2025 at 7:03 AM
lauritz-holtmann.de
🧑‍💻 #BugBounty Meetup Vol. 2 of the German
@hacker0x01.bsky.social Club x Grab

The event is organised like a Mini-LHE:
📅 15.02. - 21.02.25 Remote Hacking
📅 22.02.25 In-Person Day
📍#Bochum (Work Inn Bochum-FiftyOne)

‼️ Signup Deadline: Wednesday, Feb 12th.

👉 h1.community/e/mgswsg/
February 4, 2025 at 6:48 AM
lauritz-holtmann.de
True, it does. Whoops 🙈
eval is overwritten using eval=console.log resulting in alert(1) being logged. This indicates jsfuck uses eval.
January 28, 2025 at 9:31 AM
lauritz-holtmann.de
The new year starts with a bang: #BugBounty Meetup Vol. 2 of the German @hacker0x01.bsky.social Club will take place on February 22nd in #Bochum, Germany! 🧑‍💻

We will organize the event like a Mini-LHE: Like last year, there will be again a collaborating H1 program and a leaderboard.

(1/3)
LHE Leaderboard of the last H1 Meetup in Bochum
January 6, 2025 at 4:35 PM
lauritz-holtmann.de
#38c3 was 🚀
December 30, 2024 at 10:21 PM
lauritz-holtmann.de
🔜🚀 #38c3
December 27, 2024 at 4:17 AM
lauritz-holtmann.de
The Flickr ATO using AWS Cognito recently turned "3" and it is still my favorite bug bounty story 😅

Check out the blog post in case you missed it: security.lauritz-holtmann.de/advisories/f...

H1 disclosure: hackerone.com/reports/1342...
November 15, 2024 at 9:50 PM
lauritz-holtmann.de
#BurpSuite #Bambda to detect Blind SSRF via OpenID Connect "request_uri" using out-of-bound detection (e.g. Collaborator).

The vulnerable URL is b64-encoded and included within the canary URL.

👉 gist.github.com/lauritzh/7b3...
📚 security.lauritz-holtmann.de/post/sso-sec...
November 30, 2023 at 11:37 PM