thanks to everyone who attended my #TheSAS2025 talk "Typographic hit job: when fonts pull the trigger". 🙏
I've written an accompanying blogpost that goes over all the details: haxx.in/posts/2025-09-23-can…
HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:
If you want to learn how to construct epic payloads like this? You need JavaScript for Hackers.
Requires this hash:
#<img/src/onerror=alert(1)>
amazon.com/JavaScript-hacker…
ALT <svg/onload=innerHTML=URL,innerHTML=textContent>
#<img/src/onerror=alert(1)>
Ok guys, and that's it for this year! PraSec "11"th edition concluded yesterday. We hope you had a great time. Again, we thank our speakers and attendees for super atmosphere. See you in a year!
So… I was hacked. Pwned. Big time. And I’m not kidding.
It turned out to be the very same malware used in massive DDoS campaigns against DeepSeek and Twitter (erm… X).
It was RapperBot... I was angry with me and with the malware. Honestly, more with me than with the malware.
This is my story of how I dove deep into its guts, from infrastructure mapping to binary analysis, and what I uncovered along the way.
Buckle up and grab some IOCs:
bitsight.com/blog/rapperbot-…