random thoughts and other stuff
this blogpost was a collaboration with two people, their articles are here: hackermon and mdl this started when i was notified that discord switched documentation platforms to mintlify , a company i briefly looked into before, and i thought it would be a good idea to take another look now that theyre bigger. introduction mintlify is a b2b saas documentation platform that allows companies to make…
this started when i was looking into cursor , an ai text editor. also, i use lulu by objective-see on my laptop, so when i downloaded the cursor installer, i got this pop-up: now, what the hell is todesktop? i thought i was downloading cursor? well, looking at their website, they seem to be an electron app bundler service alongside providing a SDK for electron apps. so it appears the installer i…
we start at the homepage of arc. where i first landed when i first heard of it. i snatched a download and started analysing, the first thing i realised was that arc requires an account to use, why do they require an account? introducing arcs cloud features so i boot up my mitmproxy instance and i sign up, and i see that they are using firebase for authentication, but no other requests, are they…
background i like to do this thing where i search twitter, looking for companies, and then try giving them a quick pentest. i've done a lot of my hacks this way and its more effective than you think it is. on this search, i use the "Relevant People" tab more often than you think, this is how i got to a16z crypto bullshit -> venture capital firms for crypto -> a16z crypto -> a16z the hack while…
check out mrbruhs blogpost if you havent already so recently i was on call with some friends messing with some other stuff when we remembered the existence of a scanner we made for firebase and found https://chattr.ai and realised they used firebase, we didnt know much about firebase at the time so we simply tried to find a tool to see if it was vulnerable to something obvious and we found firepwn…
at the time of writing this is all patched, dont come to me asking if it still works and how you can do it. so, recently i was looking into a microsoft partner called gamersafer which promotes facial recognition KYC to log into games (fun stuff) and also notably runs the official minecraft serverlist which is riddled with servers that are against mojangs own rules the start im in some cringy…