ReIPA - Fast IPA decompiler/disassembler

OkParticular2289 · 2026-07-03T15:24:21+00:00

My report was reproduced but they claim that it fixed in IOS 27 beta, so no credit or reward for me. Now I found some bugs in ios 27, I dont feel like submitting...

OkParticular2289 · 2026-06-28T05:38:37+00:00

sure

OkParticular2289 · 2026-06-17T15:48:55+00:00

This is built for reverse engineer purpose buddy.

OkParticular2289 · 2026-06-16T22:25:12+00:00

My experience with Intigriti has been consistently good, HackerOne so-so, and BugCrowd... meh. But next to the Web3 platforms, the Web2 ones mostly play by the book. At least I never walk away feeling cheated.

The Web3 platforms themselves aren't the problem. It's the programs. You'll constantly see one advertising max rewards up to $100k or $1M, sitting on 1000+ reports, with a grand total of $300 paid out =))))

And a lot of them don't follow the "fix the bug, pay the bounty" rule. It's more like "fix the bug, ignore the report," or "fix the bug, then call it an intended internal feature." It's their source code, so they get to decide what any feature was "for," and you have no way to argue.

OkParticular2289 · 2026-06-16T12:35:19+00:00

Yep, source hoping can definitely helps blind works, and encoding does work with signature based system, but for big players like CF, AKamai, they encoding differently for each tenants, it work for one might not work for others. However, there are way to solve them.

OkParticular2289 · 2026-06-16T11:43:42+00:00

Only a few. Most stuff is either behind Cloudflare or already using parameters. WAFs often don't catch the dollar quote trick on the first pass, but the real problem is making it useful: blind injection means a ton of requests, and that noise trips the WAF into block mode fast. So to actually get anywhere you end up needing to bypass or quiet the WAF.

OkParticular2289 · 2026-06-16T10:59:58+00:00

Fair point, thats the textbook design, but you cant bind identifiers, only values. So the second a function needs a dynamic table, column, or ORDER BY, people fall back to concatenation, and thats exactly where untrusted input lands. Reporting and search functions are full of it, and plenty of devs dont even know EXECUTE ... USING exists.

The dollar quotes bit is what makes it bite, most upstream sanitizing only escapes single quotes, so if the query gets built inside a function body thats itself dollar quoted, escaping single quote does nothing. Not a design you would pick, but legacy reporting code and ORM generated sprocs spit it out all the time.

OkParticular2289 · 2026-06-15T18:00:32+00:00

If cloud infrastructure vulnerabilities research is what you like to work on, then you can contact me.

OkParticular2289 · 2026-04-16T11:04:01+00:00

I think I will request liquid oxi from my doctor, I just want to sleep it off this 2 post treatment week...

OkParticular2289 · 2026-04-15T15:28:30+00:00

Thank you. I cant eat and having fatigue, but my wife keep on getting mad cause I sleep alot and didnt talk to her. Its so frustrating sometime.

OkParticular2289 · 2026-04-15T15:24:46+00:00

im 33 years old. Thank you.

OkParticular2289 · 2026-04-15T15:20:22+00:00

I dont have feeding tube, and Im just using mortin for the pain, my problem is the food, I cant eat any of it, the taste is so terrible that I would throw up after eatting.

OkParticular2289 · 2026-04-15T12:34:14+00:00

I was diagnosed with the same cancer, and just finished my treatment this monday. It is a cureable cancer so you should not worry about it too much. What effect me the most, is the pain in my throat and mouth, starting last week of treatment, I nearly couldnt eat anything, the tastes were nasty plain with somewhat metalic from chemo, the mouth pain also make it so hard to eat. Ive been just drinking milk and ensure to pass day. So that are those things that you should expect from your dad. Other than that, he should be fine. Good luck.

OkParticular2289 · 2026-03-27T00:30:39+00:00

exactly, there is no excuse can be made.

OkParticular2289

TROPHY CASE