PinkDraconian ✓
@PinkDraconian · joined 02 Jul 2019
▶️ YouTube: https://t.co/j2KvfZx6Un 💼 LinkedIn: https://t.co/1Ky1Jft7mj
12 027Followers
296Following
3 586Posts total
84.8KViews on collected posts
Neueste Beiträge
Wir suchen neue Beiträge…
I found a vulnerability in a mobile app that allowed me to overwrite the app's logo 😅
Of course I changed it to "GREAT SUCCESS!" (On staging!!!)
S3 buckets keep on being good scope to attack. This API had an endpoint /upload-to-s3?filename=file
You could give it any filename h
4.6K views · 98 likes
· 1 reposts · 6 replies
Open on X →
Found an unauthenticated SQL injection
🤞 Fingers crossed that it's not a dupe!
And with that I don't mean a dupe with a bug bounty hunter, I mean a dupe with a bad actor!
2.6K views · 55 likes
· 0 reposts · 3 replies
Open on X →
@PinkDraconian This is very cool! But please don’t call it RCE. A user has to download the map, which makes it LCE. Still a major problem, and it’s a very fun bug. Congrats!
727 views · 2 likes
· 0 reposts · 1 replies
Open on X →
This was such fun research to do! 🔥 https://t.co/TGw8R2dcWY
8K views · 98 likes
· 5 reposts · 5 replies
Open on X →
Our researcher @PinkDraconian found a new RCE in MECCHA CHAMELEON, the hide-and-seek game with 15M copies sold in its first month. The map you're prompted to download when you join a match could write files anywhere on your PC, and he turned that into code execution on reboot.
13K views · 68 likes
· 9 reposts · 6 replies
Open on X →
So how do we get around that?
Well, I've written a blog post going into a lot more detail on this, so definitely check it out 👇
https://t.co/uhwqO93i6d
2.3K views · 28 likes
· 4 reposts · 0 replies
Open on X →
But in the end, we're still saving a real audio file to this file. It may have the `exe` extension but it's not a real executable https://t.co/UURbnsoUaw
2.2K views · 5 likes
· 0 reposts · 1 replies
Open on X →
That's when I remembered a neat Windows trick: If you have a NULL (\u0000) byte in a filename, everything past the NULL gets dropped.
So we could save our file as POC.exe\u0000. Unreal Engine will append .wav, making it POC.exe\u0000.wav
But Windows removes all that! https://t.
2.1K views · 13 likes
· 0 reposts · 1 replies
Open on X →
Well, it's not quite as easy. The saved file get the `.wav` extension, so it's not really useful. We're just saving a real WAV file in a folder. https://t.co/Idsh2Tff5K
2.2K views · 7 likes
· 0 reposts · 1 replies
Open on X →
A MECCHA CHAMELEON map is more than just assets. It can also contain Blueprints. These are Unreal Engine's visual programming system where you can connect nodes to program.
I starting digging through all the functions that a MECCHA CHAMELEON map can call and ... https://t.co/BmV
2.9K views · 15 likes
· 0 reposts · 1 replies
Open on X →
One stood out to me: Finish Recording Output
It takes in some audio and saved that to a path. This means that we can easily just set the path to the Windows startup location and write files there right?
%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/ https://t.co/qt1ZZ
2.6K views · 11 likes
· 0 reposts · 1 replies
Open on X →
I found a Remote Code Execution in MECCHA CHAMELEON!
If you play a map, that map can abuse a few cool neat bugs to write arbitrary files with (semi-)arbitrary content anywhere on your system, eventually leading to RCE 🧮
🧵 Want to know how? Read this thread 👇 https://t.co/ntOSbB
40.7K views · 413 likes
· 50 reposts · 16 replies
Open on X →
Im Vergleich zu Konten gleicher Größe
13 Beiträge aus den letzten 90 Tagen, verglichen mit der Größenklasse 10K–100K Follower. wird weit gezeigt, aber nur wenige dieser Zuschauer reagieren.
Medianaufrufe2 602dieses Konto995Median für 10K–100K
Reichweite, %21.63%dieses Konto3.92%Median für 10K–100K
Interaktion, %0.66%dieses Konto1.54%Median für 10K–100K
| Kennzahl | Dieses Konto | Median für 10K–100K | Verhältnis |
|---|---|---|---|
| Medianaufrufe pro Beitrag | 2 602 | 995 | 2.62× |
| Reichweite (Aufrufe ÷ Follower) | 21.63% | 3.92% | 5.52× |
| Interaktionsrate | 0.66% | 1.54% | 0.43× |
Weitere Konten dieser Größe → Mit einem anderen Konto vergleichen → Wie diese Vergleichswerte entstehen →
Growth & engagement
How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.
Views per post
40.7K3 Sep
2.6K
2.9K
2.2K
2.1K
2.2K
2.3K
13K
8K
727
2.6K4 Sep
4.6K
6516 Sep
Last 13 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.
Engagement rate per post
1.19%3 Sep
0.46%
0.55%
0.36%
0.66%
0.27%
1.41%
0.67%
1.34%
0.41%
2.20%4 Sep
2.29%
0.46%6 Sep
Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.54%.
What the audience does
Likes70.0%815 in total
Reposts5.9%69 in total
Replies3.7%43 in total
Quotes0.8%9 in total
Bookmarks19.6%228 in total
Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.
The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.
Ähnliche Konten
Kathy Ultra MAGA 🇺🇸🇺🇸
@KLUltraMaga
24.1K followers
· 370.6K posts
Clingendael Institute ✓
@Clingendaelorg
24.1K followers
· 12.7K posts
SHIVANI GOKHALE 🚩 ✓
@shivanigokhale
24.1K followers
· 45.7K posts
محمد الضيف
@maldhaif1
24.1K followers
· 44.7K posts
Toff ✓
@TheToff_
24.1K followers
· 20.8K posts
Edgard Marteletti
@edgardVE
24.1K followers
· 42.4K posts
Oma James ✓
@ChelfcAbby
24.1K followers
· 104.6K posts
KNOL
@flowrmosh
24.1K followers
· 57.8K posts