Elektrine lite

← Feed

Rubén Santos García

rsgbengi@infosec.exchange

<p>Cybersecurity Engineer | OSCP | CRTO</p><p>I do offensive cybersecurity content, maybe not the best, but it&#39;s free :) <br /><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="tag">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="tag">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="tag">#<span>hacking</span></a> </p><p>You can find me at <a href="https://www.kayssel.com/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://www.</span><span class="">kayssel.com/</span><span class="invisible"></span></a></p>

Posts

  • View post

    XS-Leaks steal data the same-origin policy swears it protects. SOP hides response contents, not response behavior. This issue covers error-event oracles, frame counting via window.length, the single global socket pool that turns any browser into a stopwatch, and cache probing (terjanq leaked private Google emails this way). Blind injection, cross-origin, against a site you cannot read. https://www.kayssel.com/newsletter/issue-62/ #InfoSec #CyberSecurity #WebSecurity #BugBounty #AppSec #XSLeaks

  • View post

    In an upgradeable proxy, the funds live in the proxy and the logic is swappable. Own the pointer, own everything. This issue covers delegatecall storage collisions (Audius), uninitialized implementations (Wormhole&#39;s other bug), UUPS selfdestruct bricking (Parity froze 513k ETH), and the 2025 mempool bots front-running initialize() on fresh proxies. Plus slither-check-upgradeability to catch it. https://www.kayssel.com/newsletter/issue-61/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBou...

  • View post

    Browser exploitation isn&#39;t web bugs. It&#39;s memory corruption across three processes. This issue walks the full chain: V8 JIT type confusion for arbitrary read/write, WebAssembly RWX pages to run shellcode, WebGPU/Dawn as the softer GPU-process target, and the renderer→GPU→broker sandbox escape that ends in --no-sandbox. https://www.kayssel.com/newsletter/issue-59/ #InfoSec #CyberSecurity #Pentesting #BugBounty #BinaryExploitation #WebGPU

  • View post

    Cross-chain bridges lost ~2B USD in 2022 alone. Every major hack lived in the same place: the attestation layer that decides a deposit really happened. Ronin (stolen validator keys), Wormhole (forged guardian signature via unchecked account), Nomad (0x00 trusted root looted by hundreds), BNB Token Hub (forged IAVL Merkle proof). New issue breaks down all five. https://www.kayssel.com/newsletter/issue-58/ #InfoSec #CyberSecurity #Web3 #SmartContracts #BugBounty #DeFi

  • View post

    Reentrancy forked Ethereum in 2016 ($60M DAO hack). It drained $52M from Curve in 2023 because Vyper 0.2.15-0.3.0 silently gave each @nonreentrant function its own independent lock. Cross-function reentrancy bypasses guards via shared state. Read-only reentrancy bypasses them via view function oracles. CEI is the foundation, guards are just backup. https://www.kayssel.com/newsletter/issue-57/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #Solidity

  • View post

    Flash loans: borrow $500M with zero collateral, manipulate AMM spot price oracles, hijack governance votes in a single block, run MEV sandwich attacks via Flashbots bundles. The only cost is gas. Euler Finance lost $197M via a donated-reserve trick that manufactured fake insolvency and turned Euler&#39;s own liquidation engine against itself. https://www.kayssel.com/newsletter/issue-56/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #Web3 #DeFi