If the server-side relies on the browser's incoming Content-Type as a #CSRF protection, you can omit the CT entirely using a Blob object as a fetch() body to perform the state-changing operation, and if #CORS is permitted, leak the unleakable.

nastystereo.com/security/cr... #BugBounty

Changed my mind...

A nice and a sunny day 🌞

/proc/self/cwd/ is a symlink pointing to the current working directory of the process that is accessing it ... Never lose sight of the process's CWD and what underneath again 🫡

I hate this unilateral company emailing approach! In sum, you have the right to send me a message and I can't do the same, And reply, WTH?

✌🏼 Hello@ rocks 🥊

You were supposed to destroy them, you were the chosen one !

Hurry and kill. The waiting to. Celebrate 🎉 ego. I. Me

@boredabdel.bsky.social master, can you give us advices regarding the pace and speed of running

WOOOOT ? poke @pentesterlab.com

Seriously @hacker0x01.bsky.social do I look to be a joke to yaa, I saw others as security leopard 🐆 or at least a fox 🦊 not that, for the review of a whole year!!!

Minutes ago...