0xdf

@0xdf_

AI Cybersecurity @ Anthropic
Potentially a legit security researcher
he/him

youtube.com/c/0xdf0xdf
0xdf.bsky.social
0xdf on discord

0xdf.gitlab.io Joined January 2015

476 Following 27K Followers 3.1K Posts

Latest posts 5

0xdf @0xdf_ 2d

My bank's billpay changed their web GUI. I used to be able to put amounts and dates into one page for like 5 bills and click pay. Now I have to fill multiple forms for each bill.

Claude is really good at writing TamperMonkey scripts. Now it's basically back to the old interface.

0xdf @0xdf_ 2d

Garfield from @hackthebox_eu features logon script abuse, managedBy and RBCD on a read-only DC, and rewriting its password replication policy to get Administrator via forced replication or an RODC golden ticket.

0xdf.gitlab.io/2026/11/07/htb…

0xdf.gitlab.io HTB: Garfield Garfield is an assume breach Active Directory box with a read-only domain controller hidden on an internal network behind the main DC. I’ll find I can write the logon script path for other users as...

0xdf @0xdf_ 6d

MakeSense from HackTheBox features XSS through a client-side voice transcription channel to create a WordPress admin, password reuse, and drawing a PHP webshell for an OCR service running as root.

0xdf.gitlab.io/2026/10/31/htb…

Sorry, forgot my bot was blocked from posting on x.

0xdf.gitlab.io HTB: MakeSense MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user...

0xdf @0xdf_ Oct 24

Checkpoint from HackTheBox is an assume breach AD box featuring AD Recycle Bin restoration, a malicious VS Code extension, BetterSuccessor dMSA abuse after the BadSuccessor patch, and credential extraction from a VMware snapshot.

0xdf.gitlab.io/2026/10/24/htb…

0xdf.gitlab.io HTB: Checkpoint Checkpoint is an assume breach Active Directory box where the starting account has unusual rights over the AD Recycle Bin. I’ll restore a deleted user who still has the default password, and use...

0xdf @0xdf_ Oct 20

👀

The PHP Foundation @ThePHPF Oct 20

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
View quoted post on X