Khaled Mohamed xElkomy

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

Windsurf Custom Instructions

Role and Expertise

You are Windsurf, a world-class full-stack developer and UI/UX designer. Your expertise covers:

Rapid, efficient application development
The full spectrum from MVP creation to complex system architecture
Intuitive and beautiful design

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

Environment

Arch Linux
KDE Plasma 6.1.5 (Wayland)

Solution

For native Wayland applications

open the KDE system settings
select "Workspace" -> "General Behavior"

Listmonk setup and usage guide

When I first set up Listmonk it was to use with Amazon SES. At the time Amazon would give you free 62,000 emails/mo if you sent them from an EC2 instance. So EC2 was the best server to use. In mid 2023 Amazon ended that, so now you can use whatever server you like, which makes things much easier. It shouldn't be too hard to convert these directions to another server host of your choice.

I used Hetzner with another build, and once my free EC2 year ended the AWS t2.micro cost me $14/mo. Hetzner has better specs and costs me $5/mo, so I added an nginx vhost and moved listmonk to the same server. Here's a $20 credit for Hetzner.

There is also the possibility to use the 1-click installers for their featured hosts: https://listmonk.app/ - listed under "Hosting providers". I'm not familiar with any of them but there are lots of new guides

	import warnings
	from urllib3.exceptions import NotOpenSSLWarning
	warnings.filterwarnings("ignore", category=NotOpenSSLWarning)

	import subprocess
	import requests
	import urllib.parse
	import json
	import os
	from datetime import datetime

	// clean-reporter.js
	class CleanReporter {
	constructor(globalConfig, options) {
	this._globalConfig = globalConfig;
	this._options = options;
	this._failedTests = [];
	this._totalTests = 0;
	this._passedTests = 0;
	this._failedTestsCount = 0;
	}

	#!/usr/bin/env sh
	#
	# Two-way clipboard syncronization between Wayland and X11, with cliphy support!
	# !! Recommended use: Drop this file off @ /usr/local/bin/clipsync && make it executable
	# Requires: wl-clipboard, xclip, clipnotify.
	# Modified from: https://github.com/hyprwm/Hyprland/issues/6132#issuecomment-2127153823
	#
	# Usage:
	# clipsync watch [with-notifications\|without-notifications] - run in background.
	# clipsync stop - kill all background processes.

	{
	"description": "Bypass WAFs with 8KB Padding.",
	"edition": 2,
	"graph": {
	"edges": [
	{
	"source": {
	"exec_alias": "exec",
	"node_id": 2
	},

	// by @irsdl
	boolean manualColorHighlightEnabled = true; // e.g. BurpRed anywhere in the request
	boolean pwnFoxColorHighlightEnabled = true; // to support PwnFox Firefox extension containers

	// BEGIN HIGHLIGHT LOGIC {

	boolean hasAlreadyBeenColoured = false;
	/* Manual highlight logic to see something like BurpRed */
	if(manualColorHighlightEnabled){
	Pattern manualHighlightPattern = Pattern.compile("burp([a-z]{3,7}+)", Pattern.CASE_INSENSITIVE); // like burpRed or burpYellow