I'm a hacker and mainly post about web security. By profession, I am a pentester and team leader @usdAG. I like to explain and understand things and I am convinced that the two go hand in hand. So my posts are mostly of an educational nature. Lately, I spend most of my free time developing CVE Crowd. ⎯⎯⎯⎯⎯⎯ Recent topics: #CveCrowd, #Phishing, #CVSS, #PromptInjection, #OTP, #JavaScript, #HSTS, #BSCP
Public Key
npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Profile Code
nprofile1qqsxent2luaeeys4ynm7yn0w9jz37c0sarx9n724t83smz8wk34ur4spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds8ck6rz
Show more details
Published at
2026-06-02T15:57:51Z Event JSON
{
"id": "8c9a4357e94a1a198209972e4413a512b80396e2ac90a88cf8edae27915f3e4b" ,
"pubkey": "6ccd6aff3b9c921524f7e24dee2c851f61f0e8cc59f95559e30d88eeb46bc1d6" ,
"created_at": 1780415871 ,
"kind": 0 ,
"tags": [
[
"emoji",
"C_H",
"https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/028/316/original/a2bf68b422893606.png"
],
[
"proxy",
"https://infosec.exchange/users/kpwn",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "{\"name\":\"Konstantin :C_H:\",\"about\":\"I'm a hacker and mainly post about web security.\\n\\nBy profession, I am a pentester and team leader @usdAG.\\n\\nI like to explain and understand things and I am convinced that the two go hand in hand.\\nSo my posts are mostly of an educational nature.\\n\\nLately, I spend most of my free time developing CVE Crowd.\\n\\n⎯⎯⎯⎯⎯⎯\\n\\nRecent topics:\\n#CveCrowd, #Phishing, #CVSS, #PromptInjection, #OTP, #JavaScript, #HSTS, #BSCP\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/551/708/143/302/638/original/8f107909c923fd55.png\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/109/551/708/143/302/638/original/d857f54ec7db48c9.png\",\"nip05\":\"[email protected] \",\"fields\":[[\"Pronouns\",\"he/him\"],[\"Developer of\",\"https://cvecrowd.com\"],[\"Blog\",\"https://kpwn.de\"]]}" ,
"sig": "479220f2a12d583dcf84d6083f2c2dcaa7f59433e3d7b208bd639e9fa31b6b3cadb0a3edb1735d43ce5c6615855066e0edab1adf86f986470240f7bde21b54e7"
}
Last Notes npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: If I programmed an app that in 99% did what it was meant for and in the other 1% deleted your entire file system. Would I be legally liable for your loss or the person using it? I guess it depends on the terms of use? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Perfect streak: 2 😊 I solved the daily #CluesBySam, Jun 2nd 2026 (Medium), in 04:42 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: One reason to look forward to mondays. Easy Clues by Sam puzzles. I solved the daily #CluesBySam, Jun 1st 2026 (Easy), in 05:23 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Damn! Close enough. I solved the daily #CluesBySam, May 31st 2026 (Hard), in less than 13 minutes 🟨🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…v5j3 They get trickier throughout the week. The one on Monday will be much more beginner friendly :) npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: This one was cumbersome. Had an early error… This always tempts me to use hints because a perfect solve isn‘t possible anymore. I solved the daily #CluesBySam, May 30th 2026 (Hard), in less than 14 minutes 🟩🟩🟩🟩 🟩🟨🟩🟩 🟠🟩🟩🟡 🟩🟨🟩🟩 🟩🟠🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Perfect streak gone. But I'm still happy with today’s result, given the advanced difficulty 😊 I solved the daily #CluesBySam, May 29th 2026 (Tricky), in less than 8 minutes 🟩🟩🟩🟨 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Perfect solve streak: 2 🎉 I solved the daily #CluesBySam, May 28th 2026 (Tricky), in less than 13 minutes 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Finally a perfect solve again :ablobcatnodfast: I solved the daily #CluesBySam, May 27th 2026 (Medium), in less than 9 minutes 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 🟩🟩🟩🟩 https://cluesbysam.com npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…3zlh @nprofile…d3v6 CVE Crowd is up again. Not sure what was going on. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…g4vn What really hurts about this, is that the AI-assisted group performs better than the control group. This means its tempting to use AI to increase performance. Especially in a competitive setting (like everywhere in capitalism) you'll "win" with AI assistance. And in the end, we are left with a group of winners who have less persistence and independent performance. And there's no way out. https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/529/723/127/981/284/original/9a8db6d20ab9832b.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Exiting vim with an unfamiliar keyboard layout is a whole new level of the challenge! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Just wondered… Before meeting friends, do you also go into yourself and consider what topics to talk about? 😅 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…d2dq Nein 😭 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Am 08.05. empfangen meine Kollegen und ich euch in Köln zu den usd Hackertagen. Bei Pizza und #Tschunk reden wir übers Hacken und Pentesten. Praktische Hands-On Erfahrung könnt ihr in unserer Trainingsumgebung, dem PentestLab, sammeln. Ich freue mich über jede Person, die vorbeischaut :) 📅 08.05.2025, 13:00 - 18:30 Uhr + Gemeinsamer Ausklang bei Pizza und Tschunk 💲 kostenlos Mehr Infos gibts hier: https://www.usd. de/cst-academy/events/usd-hackertage/ #Hacking #Pentesting #CyberSecurity #InfoSec #Education npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Everything should now be working again! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…cc40 The issue is fixed https://infosec.exchange/@cvecrowd/116381836591366499 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Damn, looks like my OpenClaw cluster deleted cvecrowd.com :( ... Just kidding. I changed my DNS registrar and somehow the new one found it funny to randomize IP addresses. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…cc40 🥶 thanks for mentioning npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Unsettling message to wake up to… "194368 is your Amazon one-time password. Please do not share it with anyone." Seemingly from a valid Amazon mobile number. Does this mean someone had my random 25 character password? 🫠 https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/367/393/996/240/120/original/a7632d878c2e449f.jpeg npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…0xjm What is the way to report spam that actually does something? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…stmg thanks! love it npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Does anyone remember the toot some days ago where someone stated that the Internet only lives through links to other pages and one should have a collection of links on their own website? I really liked the phrasing but just can't find it anymore :blobcatsadreach: npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…9mf3 Is it the absence if profit that makes Mastodon pro-people? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Apart from Mastodon, I'm also on LinkedIn (yes… I know…) The opinions regarding AI couldn't be more different on both platforms. Why do you think is this? 1. Mastodon folks are pro privacy, which contradicts how LLMs are trained? 2. The algorithm on LinkedIn pushes AI because Microsoft got stakes in it? 3. People on LinkedIn post more "hot takes" for monetization? 4. Anything else, I am not aware of? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…dqzr Great idea! 👍 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…jvf8 Nice! And how is the acceptance throughout the Fediverse? I remember many people being very sceptical about the feature :D npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Whoa, since when do we have quote toots? :mind_blown: npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…ulu2 Coming back to your suggestion to add a reverse filter to CVE Crowd. I wonder: Why would you need this? In my mind, this sounds like pure spam. Filtering some keywords would probably not help to reduce this spam because most CVEs are about distinct vendors / products. As a result , you would get an email for nearly every CVE that is mentioned on the Fediverse and BlueSky. How is this information helpful to you or your job? I'm really interested in your view about this! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: That sounds like an incredible opprtunity! https://infosec.exchange/@albinowax/115943969534132620 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…53h4 I'll consider. Thanks :) npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Do you find this feature useful? How could it be improved? As always, feedback and ideas are very welcome. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Thanks to CVE-2025-20393 my Cisco alert already has been triggered. In consequence, I received the following alert email. #NoBot https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/791/770/622/185/814/original/1c6cf813b96fa4e3.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: You can add your keywords on the "Alerts" page. I have defined six keywords here, using vendors (Cisco), products (NetScaler) and package names (OpenSSH). Keywords are case insensitive and also can be substrings of respective names. The keyword "ftp" would trigger an alert if a vulnerability in e.g. vsftpd or ProFTPD was mentioned. https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/791/766/682/009/792/original/456ee5eb27e9d4ae.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: #CVECrowd, your go-to place for #CVE discussions on the Fediverse and Bluesky, now supports email alerts. https://cvecrowd.com Here's how it works: - You define one or more alert keywords - Keywords are matched against vendor, product, and package names from official CVE data - If a post mentions a CVE that matches one of your keywords, you receive an email notification Read more below 🧵 #Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: CVE Crowd just received an update, hopefully nobody will recognize. I've upgraded Tailwind CSS from v3.4 to v4.1 :D npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…mske That sounds exhausting… In my 7 years of pentests, I only came accross a couple of companies / contacts who were not interested in improving their security. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Small scope decisions can hide big risks. How do you convince customers to let you check connected but out-of-scope systems? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: In this case, access was not possible. So I took a different approach: I scheduled a meeting with the customer midway through the pentest where they shared their screen and demoed the admin panel. I quickly recognized a distinct string I had previously probed as an unauthenticated attacker. Within five minutes we turned it into an unauthenticated blind XSS affecting the admin interface. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: While that's true, it misses something important: blind attack vectors. Some issues can only be discovered or validated by looking into those otherwise blind spots. For that reason I usually request admin access as a cross-check. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Change the scope a little, and you might miss the attack that matters most! Just five minutes of screen sharing made me find an unauthenticated XSS in #Weblication's admin panel. Many pentesters would have missed this vulnerability. And it's not for lack of skill, but because of how projects are scoped. ? #Hacking #BugBounty #Scoping #InfoSec #CyberSecurity #Pentesting #AppSec #CVE_2025_52161 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Web apps often have an admin panel. The ideal is to get credentials and include that panel in the test. But this can inflate the scope and surface low-risk findings. When the threat model is an external attacker, customers often ask: "External attackers don't have admin access. Why would you need it?" npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: „Ich musste immer wieder erzählen, was passiert ist - zuerst der Polizei, dann dem Jugendamt, später vor Gericht. Jedes Mal tat es weh, jedes Mal fühlte ich mich wieder klein und hilflos.“ - ein von sexualisierter Gewalt betroffenes Mädchen. Die Petition setzt sich für eine kindgerechte Justiz ein, die Kinder wirksam schützt, Verfahren beschleunigt und Betroffene stärkt. Beispielsweise durch flächendeckende Childhood-Häuser in denen Polizei, Justiz, Jugendhilfe, Medizin & Psychotherapie zusammenarbeiten. Video-Erstvernehmung binnen 14 Tagen: Ein Kind, eine Aussage, kein zweites Trauma. Mit 30.000 Unterschriften geht es vor den Bundestag. Hier ist eure Hilfe gefragt! https://innn.it/kindgerechte-justiz npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…3rhw Searches are pretty heavy database transactions in comparison. Thus, search is limited to logged in users and also has a quota. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…5lc3 Well played! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Hi @nprofile…r0kn, since 2 September, I am experiencing great lags when querying the public timeline of infosec.exchange with Mastodon.py. Requests sometimes take multiple seconds to finish. It seems, the API itself is responding quite fast (250ms) but the pre- / post-processing is sluggish. While this is none of your business, I wonder if you changed anything recently, which may be the cause for the issue. I‘d love to hear from you :3 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…82k3 Naturally! Thanks for your great post 😊 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Rank 1: CVE-2025-53770 Product: Microsoft SharePoint Enterprise Server CVSS: CRITICAL (9.8) Known Exploited Vulnerability Zero-Day A deserialization of untrusted data in on-premise deployments of Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. There was no patch available as expoitation was detected. Post by @nprofile…82k3: https://swecyb.com/@nopatience/114895790819680601 #CveCrowdDeny npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Did you enjoy my Top 3? Did you notice which popular vulnerability from July is still missing? 🔔 Follow me for more web security insights! 🔁 Also, boost the first toot to spread the word! I've linked it again for you: https://infosec.exchange/@kpwn/114970676603609432 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Did you enjoy my Top 3? Would you like to see this as a monthly update? 🔔 Follow me for more web security insights! 🔁 Also, boost the first toot to spread the word! I've linked it again for you: https://infosec.exchange/@kpwn/114789459047972864 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: CVE Crowd's Top 3 Vulnerabilities from June! These stood out among the 528 CVEs actively discussed across the Fediverse. For each CVE, I’ve included a standout post from the community. Enjoy exploring! 👇 #Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking #CVE #CVECrowd npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Set your password: QUrMotr8nSEe0YprOPEu Error: Your password must contain a special character! QUrMotr8nSEe0YprOPEu! So more secure! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: How rude 😟 #SEO #Spam #InfoSec #CyberSecurity https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/579/207/224/354/043/original/951ab8a0612cc28e.jpeg npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…u00a I tried half an hour with a plastic card 😅 But yes, depends on the door. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Just a reminder to always lock your door! #LatchSlipping #Pentesting #PhysicalPentesting #Security https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/553/368/859/226/356/original/c1876388ff574a2b.mp4 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Am 16.05. empfangen mein Kollege Nick Lorenz und ich euch in Köln zu den usd Hackertagen. Bei Pizza und Tschunk reden wir übers Hacken und Pentesten. Praktische Hands-On Erfahrung könnt ihr in unserer Trainingsumgebung, dem PentestLab, sammeln. Wir freuen uns auf alle, die vorbeischauen. 📅 16.05.2025, 13:00 - 18:30 Uhr + Gemeinsamer Ausklang bei Pizza und Tschunk 💲 kostenlos Mehr Infos hier: https://www.usd.de/cst-academy/events/usd-hackertage/ #Hacking #Pentesting #CyberSecurity #InfoSec #Education npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…v9cj They wouldn't need to sign up to harvest data. I assume some kind of bot network that just registers accounts on as many as possible services on the Internet. Just in case that they need a lot of fake accounts in future. Another theory was that they want to lower the reputation of my mail address to disrupt the service. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Looks like this helped a lot. 4 bot sign-ups in the last 3 days 👍 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: I have now blocked the above IP ranges. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…4ut3 Nope, never heard of them before. The assumption of those is that bots would fill every present field in a form. I wonder how "my" bots would treat them. I’d assume, a bot solving a CAPTCHA should try to leave such fields untouched. If I have the time, I‘ll implement it in a sort of dry mode. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…4ut3 @nprofile…6q5v This looks great. Thanks! I'll consider it. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: We're "down" to ~5 bot registrations per day. As the CAPTCHA is still active, they all come from the second bot type. Here are some characteristic usernames: - JamesGed - RodneyTop - JoshuaMAG - RonaldSmaks - Matthewquafe ... All of these come from the following IPv4 address ranges: - 91.219.148.0/22 - 94.198.54.0/24 - 178.255.127.0/24 - 185.130.251.0/24 - 188.127.224.0/20 These all belong to Smart Ape. I'm currently considering blocking all IPs of this service provider. https://ipinfo.io/AS56694 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…gqp6 Is this so? Never heard of this advice before. A quick search on the Internet said it would disrupt cyber attacks. Like if they had a shell session on my device, it would get destroyed? How likely is that? I am honestly interested in the topic - not trying to nag. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Interim Conclusion: The CAPTCHA is a UX pain but currently necessary to keep the simple bots (from various IPs) away. The sophisticated bot that bypasses CAPTCHAs but operates from only a few IPs simultaneously had four successful sign-ups today due to new IP addresses. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Next day: 300 new fake sign-ups. The first type of bot returned (in fact it never went away). What I didn't see at first was that all those sign-ups come from different IP addresses. I redeployed the CAPTCHA and the sign-ups stopped. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: As I got tired of updating the name list and IP addresses to block, I came up with a new approach: Most of the fake sign-ups never verify their email nor do they log in. So, I removed the block list of names and implemented an automated block on IP basis: When someone signs up, their IP address is stored. As soon as they verify their email and log in, the IP address is deleted. Future sign-ups are only allowed for IP addresses which are not currently stored. I was super convinced that this method will effectively prevent sign-ups from bots Confident in the solution, I removed the CAPTCHA with the same deployment. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: A month later, I recognized a new wave of fake sign-ups. This time, the accounts used real-looking names like DanielVek, EdwardFruby, JamesPak. The amount of accounts created like this was around 50 per day. My assumption: The operators improved their bot to solve my CAPTCHA. By analyzing server logs, I identified three IP addresses responsible for these sign-ups and blocked them manually in my webserver's config. After 2 days or so, the sign-ups started again from a different IP. I recognized that many of the names were repetitive and implemented a list of names for which the sign-up fails silently (I know that this is not an effective security measure). This indeed reduced the number of successful sign-ups but never stopped them entirely. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Short recap: Since the update to cvecrowd.com that allows the creation of user accounts, the service receives a lot of sign-ups by fake accounts. These accounts use real-looking email addresses but have gibberish usernames ([a-zA-z]{10,20} or so). Most never verified their emails or logged in. Around 300 fake accounts are created per day. A self-hosted CAPTCHA on the sign-up page stopped these sign-ups. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: https://infosec.exchange/@kpwn/114123329924867878 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: https://infosec.exchange/@kpwn/114100879047810403 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: https://infosec.exchange/@kpwn/114078108393046064 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: https://infosec.exchange/@kpwn/113936616152666255 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: The bots ain't going away - but neither am I. This is the start of a long-running thread where I will be tracking bot activity on CVE Crowd. The first few posts will be references to earlier updates I shared before deciding to compile everything here. Let's see where this takes us... #CyberSecurity #InfoSec #Bots npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: With #CVE_2025_29927, Next.js has now suffered its second major vulnerability in just three months, following #CVE_2024_51479. I originally built CVE Crowd with #NextJS. However, as the application became more complex (especially with authentication), I decided to switch to a framework I was more familiar with. Honestly, I’m feeling a bit relieved about that right now... #Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking #CVE #CVECrowd npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: I've just published the code to run the vulnerable Ping Service, I am attacking in my blog post: https://github.com/KwnyPwny/js-deobfuscation-cmd-inj https://infosec.exchange/@kpwn/110446195657516997 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Anyone knows what happens to Not Simon 🐐 [email protected] ? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…s6wl Fixed it 😇 https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/162/881/237/340/983/original/e1ce13510cf819b5.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: That moment when Apache Felix HTTP Webconsole Plugin destroys your layout… 🫠 https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/156/661/765/345/637/original/9210ee88656cbf0f.jpeg npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…ejzc Thanks for the suggestion. I haven't considered it yet, but I assume it has similar privacy implications to reCAPTCHA since it analyzes user behavior to determine whether they're a bot. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: BTW, the #bots managed to bypass my (admittedly weak) #CAPTCHA. I prefer not to use reCAPTCHA for privacy reasons, though it would probably solve the issue. 15 accounts were successfully created just today. I've blocked their IPs. Let's see what happens next! 😆 https://infosec.exchange/@kpwn/113936616152666255 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Did you enjoy my Top 5? Would you like to see this as a monthly update? 🔔 Follow me for more web security insights! 🔁 Also, boost the first toot to spread the word! I've linked it again for you: https://infosec.exchange/@kpwn/114098649297288152 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Rank 1: CVE-2025-0108 Product: Palo Alto Networks PAN-OS CVSS: High (8.8) Known Exploited Vulnerability A vulnerability in Palo Alto Networks PAN-OS allows an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. While this does not allow remote code execution, it can compromise the integrity and confidentiality of PAN-OS. Post by @nprofile…ss20: https://mastodon.ie/@ciaranmak/113995497652149824 #CveCrowdDeny npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Rank 2: CVE-2025-24200 Product: Apple iPadOS Known Exploited Vulnerability An authorization vulnerability in Apple's iOS and iPadOS allows a physical attacker to disable USB Restricted Mode on a locked device. This flaw has reportedly been exploited in highly sophisticated attacks targeting specific individuals. Post by @nprofile…0rgr: https://infosec.exchange/@zaufanatrzeciastrona/114007217527892626 #CveCrowdDeny npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Rank 4: CVE-2025-26465 Product: OpenSSH A vulnerability in OpenSSH, triggered when the VerifyHostKeyDNS option is enabled, allows a machine-in-the-middle attack by a malicious server impersonating a legitimate one. The flaw stems from mishandled error codes during host key verification. However, the attack requires exhausting the client’s memory first, making it complex to execute. Post by @nprofile…u4u4: https://ioc.exchange/@char/114035381025422444 #CveCrowdDeny npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: I'm excited to share CVE Crowd's Top 5 Vulnerabilities from February 25! These five stood out among the 352 CVEs actively discussed across the Fediverse. For each CVE, I’ve included a standout post from the community. Enjoy exploring! 👇 #Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking #CVE #CveCrowd npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…nnws At least it took me a lot of effort 😅 npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: @nprofile…kgua If it was just about URLs: Yes. But I am parsing CVEs from the complete post. So I would have to exclude the content inside <a>-tags from the parser. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: I now have fixed this by stripping out all <span> tags before running the regex. Any better ideas? npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: All of these parts are then surrounded by HTML span-tags with certain CSS classes. If the link is shortened: • The prefix and suffix get the CSS class "invisible" and are not displayed. • The display_url gets the CSS class "ellipsis" This leads to the following appearance: https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/070/660/162/449/487/original/97cb9a6a53e56127.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Before displaying a link, Mastodon splits it into three parts: 1. prefix: For example https://www. 2. display_url: 30 characters after prefix 3. suffix: remaining characters Here's an example: https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/070/656/302/832/656/original/ec2cb6b67b61137f.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Mastodon's Formatting of Shortened Links May Break Your Parser (It broke mine…) Read more below 🧵 #Coding #Programming #RegEx #InfoSec #CyberSecurity #Hacking #CVE #CveCrowd npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: In order to find posts about CVEs, I parse them with a regex. However, in some cases my parser detected CVEs that weren't actually in the post. The problem was caused by shortened links in Mastodon. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Developing these updates took a lot of work, and I hope you find them useful! Let me know what you think. 🔔 Follow me for more web security content! 🔁 Also, boost the first toot to spread the word! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: 3️⃣ Custom Feeds Custom feeds work like the Dashboard but with a new layout and action buttons to track what you've read: - News feed: Displays all posts you haven’t marked as read. - Read Feed: Stores posts you've marked as read for easy reference. - Bookmark Feed: Allows you to save specific CVEs for later review. These improvements help you manage CVE information more efficiently, so you never miss important updates - even after time off. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: 5️⃣ User interface The UI has been refined to highlight key information: - KEV entries are now more visible, making it easier to spot critical issues. - MITRE links have been added directly to the overview for quick access to more details. - NVD links have been removed for now. - CVSS and EPSS scores remain clearly visible, ensuring that risk assessment stays straightforward. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: 2️⃣ Search Feature Previously, once a CVE was no longer "hot", its information would disappear. With the new search feature, you can look up past CVE posts anytime. This ensures that valuable information remains accessible - even after the initial buzz fades. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: 1️⃣ Different Timeframes CVE Crowd always showed the last 24 hours of posts. Now, there are 3 timeframes to choose from, making it easier to track vulnerabilities over time while retaining the platform's core functionality. - 24 hours: The default view, showing the most recent vulnerabilities. - 7 days: Available for logged-in users, offering access to a full week's worth of posts. - 30 days: A broader view for paid subscribers, providing insights over the past month. npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: Wow! 119 new users joined #CVECrowd in just two days - except… they're all bots! 😂 Anyway, there’s a CAPTCHA now for sign-ups. https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/936/596/053/291/714/original/b98afa543fbcc968.png npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: CVE Crowd is back online and better than ever! npub1dnxk4lemnjfp2f8hufx7uty9raslp6xvt8u42k0rpkywadrtc8tqrd5nfe Konstantin :C_H: CVE Crowd is now undergoing maintenance downtime.