I was away for a while, dropping my current side-project here.
Password cracking in your browser. Think of it as a mini-@hashcat it uses WebGPU to perform the cracking.
NT/LM/DCC/DCC2/MD5 currently implemented with bruteforce/mask/wordlist/hybrid attacks.
https://webcrack.octopwn.com/

RE: https://infosec.exchange/@zak/115793005915790340

This is a metaphor about cybersecurity products.

🔺This is the first talk I've given in 6 years – featuring formal verification of post-quantum cryptography, the evolution of the Secure Page Table Monitor, a view into Memory Integrity Enforcement, updates to Apple Security Bounty… and a personal note.
https://bird.makeup/users/hexacon_fr/statuses/2002020791865532704

I'm parsing the #IDA type info library and it turns out:

- Sometimes struct member names are not returned. Sometimes!
- The first struct member is at offset 94489263476241, but amazingly the second one is at 8.

Just in case you wonder why I drink...

Edit: that weird value is somewhat random too, so I suspect a memory leak

IT IS NO LONGER POSSIBLE TO STOP ME

At the https://gpg.fail talk and omg #39c3

You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message.

Won’t even blame PGP here. C is unsafe at any speed.

gpg has not fixed it yet.

Disobedience in Helsinki coming soon! #Disobey2026 https://disobey.fi/2026/

We're happy to announce that the first recordings are now available at https://media.ccc.de/c/39c3!

#39c3

^ta

Admirable reflection on past years fails (and successes) by @starlabs_sg :

https://starlabs.sg/blog/2025/12-2025-reflection/

#fail

TOCTOU in the AMD boot rom? Wow wow wow. #39c3

You! Yes, you, at #39C3 ! Come to our self-organized-session-talk thing!

“FAFO: How we stopped worrying and bought an Electron Microscope”

SoS Stage H, at 00:01 on day 3 (so in ~34 hours after this was posted).

More details: https://events.ccc.de/congress/2025/hub/en/room/detail/sos-stage-h/

I've added the slides and the source code for the Sokoban game to the links for my presentation; it appears on the app, but seemingly not the website... For reference, they are:

Links
Source Code (wasm)
Source Code (web)
Slides
Sokoban Fuzzer

I'll be changing out the sokoban puzzle every 30 minutes from hereon out :)

#39c3 #fuzzing

Not related to the latest MongoDB vulnerability (since it doesn't require authentication), but does anyone know of a good MongoDB honeypot? You know, one that masquerades as a real MongoDB database server and logs the login attempts while returning a "bad credentials" error? (It clearly won't be able to log the passwords because of SCRAM but anything else would be useful.)

All I could find was a logging proxy to a real MongoDB server or a MongoDB server running in a Docker image - but I don't want that.

Apparently on #Fediverse - where safety is so critical that you got burned at the stake when dared to say that searching for things would be actually useful - when I block a user or mute a thread they still show up when my client is not in the mood of hiding them?

#Akkoma

Hey #39c3, Come see my lightning talk on a safe variant for `.innerHTML ` that is built right into the browser. https://events.ccc.de/congress/2025/hub/event/detail/lightning-talks-tag-2 on Day 2.

Ah Saturday morning! What a great time to...

...write a 1-page article for Paged Out! zine!

Deadline is 4th Jan - just a week away.

CFP: https://pagedout.institute/?page=cfp.php

[RSS] Hunting CVE-2025-59287 in Memory Dumps

https://medium.com/@Debugger/hunting-cve-2025-59287-in-memory-dumps-b70afd7d2dcf?source=rss-3ba65b326b28------2

Edited: Wrong diagnosis, sry!

RE: https://pawb.fun/@itsOasus/115787031750775789

Anyone pushing this shit with "Engineer" in their title needs to get torn to pieces.

The documentation for this image processing library by @vruba is one of the most interesting things I've read in weeks:

https://github.com/celoyd/potato/blob/main/docs/personal.md
https://github.com/celoyd/potato/blob/main/README.md
https://github.com/celoyd/potato/blob/main/docs/concepts.md

Philosophical discussion of the nature of seeing and what am image is vs a map, fascinating technical details about how satellite imaging works and why it looks as bad as it often does, a lot of really thoughtful conversation about engineering and aesthetic process, and even an amusing unit of measurement — grams per terrapixel.