Philippe Delteil pdelteil

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Wahoo Elemnt - Tips, tricks and custom images

	# Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion
	# Date: 25/1/2022
	# Exploit Author: Jonah Tan (@picar0jsu)
	# Vendor Homepage: https://www.oracle.com
	# Software Link: https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
	# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
	# Tested on: Windows Server 2019, WebLogic 12.2.1.3.0, Peoplesoft 8.57.22
	# CVE : CVE-2022-21371

	# Description

	# Check for arguments
	if [ $# -lt 3 ]
	then
	echo "Not enough arguments supplied"
	echo "Usage: ./deauth.sh <bssid> <channel> <interface>"
	else
	BSSID=$1
	CHAN=$2
	INTERF=$3
	TIMEOUT=20

	import urllib.request, json, sys, textwrap
	# Run like
	# python3 pubsploit.py CVE-2017-0143

	def cveSearch(cve):
	with urllib.request.urlopen('http://cve.circl.lu/api/cve/'+cve) as url:
	data = json.loads(url.read().decode())
	try:
	if data['cvss']:
	print("{} \| CVSS {}".format(cve,data['cvss']))

	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="UTF-8" />
	<title>Twitter Archive Browser</title>
	<script src="https://unpkg.com/react@16/umd/react.development.js"></script>
	<script src="https://unpkg.com/react-dom@16/umd/react-dom.development.js"></script>
	<script src="https://unpkg.com/[email protected]/babel.min.js"></script>

	<style>

Philippe Delteil pdelteil

Cloudflare

FAQ on the xz-utils backdoor (CVE-2024-3094)

Background

Wahoo Elemnt - Tips, tricks and custom images

TOC