Jorian

We just released the first episode of our new video series: Proof of Concept! Where we explain the vulnerabilities we find at Aikido with visuals and an interview-style. This episode is about the Gogs RCE vulnerability affecting default configuration: youtu.be/QIgr61KhcDo

It finally happened!! Check out the latest @ctbbpodcast.bsky.social episode packed with client-side fun: www.youtube.com/watch?v=eV81...

🇳🇱 Voor de Nederlanders, ik help mee met het organiseren en challenges bouwen bij de National Hackers Cup 2026! Kom 19 september naar Purmerend, we hebben plek voor 500 deelnemers. Zoek een team van 4 of ga solo, en meld je aan: nhc.sh/aanmelden

There's never enough Unauthenticated RCE's. Here I took a limited AI finding and through some clever Git structures, escalate it to Remote Code Execution on the default installation of Gogs 0.14.2! Read this and more in our latest blog post: www.aikido.dev/blog/fixed-r...

shaderghost.gg

What started with a simple question on Discord, ended in *reviving an old XS-Leak technique* for probing status codes in background requests! Unravel the mystery with me in the latest @ctbbpodcast.bsky.social blog post: lab.ctbb.show/research/sol...

Playing L3akCTF this weekend with my teammates in Superflat was a blast! The challenge that stood out to me was "Squid", showcasing a werkzeug Race Condition with file descriptor symlinks that I'm sure can be applied elsewhere. Check out the writeup below: jorianwoltjer.com/blog/p/ctf/l...

We took a look at popular open-source forum platform NodeBB! This resulted in interesting vulnerabilities involving the ActivityPub protocol My favorite is *translation templates* causing XSS everywhere, requiring a large rewrite of the codebase in v4.14.0 www.aikido.dev/blog/eight-h...

Simple IDOR turned into an interesting question of "how do we find the IDs?" The answer: Continuously probe ObjectId()'s from MongoDB and search through the predictable gaps! Check out the full explanation & implementation below: www.aikido.dev/blog/predict...

It's friday so you know what that means, time for a critical vulnerability! Okay... we announced it 4 weeks ago already to be fair, but now we can talk about the technical parts 🙌 Read how authentication could be bypassed on every online phpBB instance: www.aikido.dev/blog/authent...

This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀 github.com/WICG/declara...

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer! The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below: jorianwoltjer.com/blog/p/stori... (and thanks @garethheyes.co.uk for making Shazzer!)

i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values! check it out if you're into ctfs or wanna challenge your javascript skills lyra.horse/fun/jscrossw... <3

Thanks @cryptocat.me for inviting me to my first ever podcast! Check out the section at 29:36 😄

Happy to have made some web chllaenges for Plfanzen CTF. The evetn runs next weekend, cehck it out! plfanzen.lol

We tested another mail client, Roundcube this time. The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing. Scary for password reset tokens... Blog post below: www.aikido.dev/blog/roundcu...

New blog post is out! A few vulnerabilities in Mailcow. A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab. Check it out: www.aikido.dev/blog/xss-vul...

Fun parser differential to fallback SVG sanitizer bypass: github.com/freescout-he...

WebSockets are not yet affected by Local Network Access permission in Chrome. Check out this blog post from my colleague Robbe! www.aikido.dev/blog/storybo...

XSS on a password manager, about the scariest impact you can have... github.com/aliasvault/a... Luckily it was fixed super quick! Here's a simple script you can use to send raw HTML in emails. I think a lot more clients will benifit from sanitizer testing. gist.github.com/JorianWoltje...

Software can now secure itself. → www.aikido.dev/attack/infin...

Just a few days later, there's the next blog post for @aikidosecurity.bsky.social! Another framework-level vulnerability this time affecting Astro, resulting in SSRF if an unvalidated connection can be made to the webserver. Read the details here: www.aikido.dev/blog/astro-f...

My first disclosed vulnerability since joining @aikidosecurity.bsky.social, and it's a banger! SvelteKit + Vercel = Cache Deception. This shows how AI agents can find framework-level vulnerabilities, and that caching will continue to cause headaches. Enjoy :) www.aikido.dev/blog/sveltes...

Had a fun XSS gadget chain with antoniusblock on a real world target, he made an awesome writeup: blog.antoniusblock.net/posts/dom-cl...

Every year I look through this list with amazement for what all the people came up with. This year I suddenly saw my own article nominated, not 1 but 2! 🤩 1. "Nonce CSP bypass using Disk Cache" on my blog 2 "Stopping Redirects" with @ctbbpodcast.bsky.social Go vote! portswigger.net/polls/top-10...

I made a shorter writeup for the CatGPT challenge during hxp CTF at 39C3! It featured a cool combination of JavaScript injections to escape our context and fix the remaining syntax. Check it out: jorianwoltjer.com/blog/p/ctf/h...

Just arrived at #39c3, shoot me a DM if you wanna meet! 😄

Here is my writeup of Intigriti's December XSS challenge. It consisted of 6 smaller challenges combining into a big 1-click exploit. One of the most fun ones I've ever played. Loved the unique format by @renwax23.bsky.social! jorianwoltjer.com/blog/p/ctf/i...

There's a new post on the Critical Research Lab! I've seen a lot of questions and fun tricks related to this subject recently so I hope this helps answer some of them. Enjoy! lab.ctbb.show/research/sto...

my new blogpost is out!! this one talks about a new web vulnerability class i discovered that allows for complex interactive cross-origin attacks and data exfiltration and i've already used it to get a google docs bounty ^^ have fun <3 lyra.horse/blog/2025/12...

Follow your rabbit holes is the takeaway from my latest CTF writeup. I found several interesting techniques that can help tricky situations, such as using the Connection Pool to make Client-Side Race Conditions easier! Read the whole thing on my blog: jorianwoltjer.com/blog/p/ctf/o...

I posted 2 more small articles to the Critical Thinking Research Lab: * Nonce CSS leak in MathML: lab.ctbb.show/research/lea... * HTML fun facts: lab.ctbb.show/research/htm...

My first post for the @ctbbpodcast.bsky.social Research Lab is live. Super excited to be part of this team, can't wait to see what crazy research is gonna come from this! lab.ctbb.show/research/Exp...

AMAZING technique by @salvatoreabello, I've been inspired by the connection pool exploits he comes up with. Check out this crazy impact labeled as "working as intended": blog.babelo.xyz/posts/cross-...