Pr0xxxy is the goat🔥

One of the first Uzbeks to sell zeroday on ZDI🔥

Let's start this year with insane challenge

It's just a joke, let me try guys.

Btw, im late for 20 minutes, but yes, happy new year, i mean hope we can make some good things this year.

AI helps to reduce our need for world's elites, it enables them to lay off as much as possible employees while saving the budget.

There is no meaning to pay for loose, they have been doing this for decades. So, they don't need population who they really don't need on running this world, so they start small wars to erase mass population while keeping most part still to run what AI cannot make it done.

They are waiting for the evolution of AI, so they have no dependency on us.

They don't care about us, they don't care if AI goes rogue (it's sht from movies), peace.

some conspiracy theory same as flat earth

its cool

RCE on Google Chrome up to 141.0.7390.65 version through Use after free in Storage (CVE-2025-11460) - ASLR, CFG bypass

PoC exploit: https://issues.chromium.org/issues/446722008

Bounty: $100,000

Should be useful👍

https://youtu.be/D0oWS0Ua-Rw?si=edO4Ok7uyw8U3QeH

Qanaqasiga?

.json endpointga to'g'ridan to'g'ri SQLi payload kiritish faqat Bug hunterlarni qo'lidan keladi, rasmda shuni qilishgan)

Bunaqa holat uchramasa kerak umuman, lekin finding case qiziq, ozgina o'ylab ko'ramiz.

Rasm bo'yicha Stacked/Batched queries SQLi ishlatilgan:

GET /displays/anythingforcheck.json'; select pg_sleep(6) --?org_id=2

Bu degani

1) Backend berilgan json file nomini oladi;

@app.get("/displays/{filename}")
async def get_display_vulnerable(filename: str, org_id: int = None):

2) Olingan json file nomini to'g'ridan to'g'ri Database ga jo'natadi:

query = f"SELECT * FROM displays WHERE name = '{filename}'"

    async with pool.acquire() as conn:
        result = await conn.fetch(query)

kod judayam noto'g'ri ko'rsatilgan, oddiy qilishga harkat qildim, org_id masalan qolib ketyapti

Endi tushinishga harakat qilamiz, shunda dasturchi json fayllarni lakatsiyasi yoki o'zini Database da saqlab keyin ishlatmoqchi bo'lgan?

Bu arxitektura xatosi bo'lishi kerak))

1) Nimaga bunaqa qilingan?
2) Nimaga SQL injection payloadda comment qo'yilgan ohirida lekin space qo'yilmagan? Space siz payload qanday ishladi?

mysql/postgresqlda -- comment qo'yilganda orqasida space - bo'sh joy bo'lmasa comment ishlamaydi

Judayam ko'p savollar bor, Bug hunterlar ko'pincha kamdan kam chiqadigan case larni tarqatadi, iloji bor lekin iloji yo'q. Hullas postni Dark Shadow qo'ygan, share qilgani zo'r, lekin kamida bilish kerak payload qanaqa ishlaydi olib ishlatishdan oldin.

@AppSec_guy