{ "@type": "Dataset", "name": "@avlidienbrunn on X", "description": "Followers, posts and engagement for @avlidienbrunn.", "url": "https://tweetindex.com/account/avlidienbrunn", "isAccessibleForFree": true, "creator": { "@id": "https://tweetindex.com/#organization" }, "variableMeasured": [ { "@type": "PropertyValue", "name": "Followers", "value": 16801 }, { "@type": "PropertyValue", "name": "Following", "value": 611 }, { "@type": "PropertyValue", "name": "Posts", "value": 1394 }, { "@type": "PropertyValue", "name": "Collected posts", "value": 7 }, { "@type": "PropertyValue", "name": "Views on collected posts", "value": 74369 }, { "@type": "PropertyValue", "name": "Likes on collected posts", "value": 485 } ], "distribution": [ { "@type": "DataDownload", "contentUrl": "https://tweetindex.com/api/accounts/avlidienbrunn", "encodingFormat": "application/json" } ], "@id": "https://tweetindex.com/account/avlidienbrunn#dataset" }

Mathias Karlsson

@avlidienbrunn · joined 19 Dec 2011

Web security fiddler. Bug bounty bastard. Sometimes I cut shapes.

16 801Followers

611Following

1 394Posts total

74.4KViews on collected posts

Posts recentes

Mathias Karlsson@avlidienbrunn16 Jul

do we still care about xss in void/hidden elements? ff only (visit URL#p): <meta name="description" content="hello" id="p" hidden="until-found" onbeforematch="alert(document.domain)"> <input type="hidden" id="p" hidden="until-found" onbeforematch="alert(document.domain)"> 3.6K views · 64 likes · 3 reposts · 1 replies Open on X →

Mathias Karlsson@avlidienbrunn1 Jul

Some additional context: S3 bucket doesnt have to be public, cdns can have builtin signing (ie bucket/object is private, but cdn has keys to sign). This works if the cdn/middleware forwards query (or if query can be smuggled). 6.1K views · 44 likes · 5 reposts · 1 replies Open on X →

Mathias Karlsson@avlidienbrunn8 May 2025

I made a tool to help test archive (zip/tar) extraction bugs (synk working directory into archive, add path traversals, links, permissions, etc): https://t.co/uEwNUhlTkk 20.2K views · 180 likes · 31 reposts · 2 replies Open on X →

Mathias Karlsson@avlidienbrunn29 Sep 2023

@avlidienbrunn One day I’ll find a use to that payload: </1 hello=“—><img src=“__PARSER__” onerror=console.log(1)>”> Works on some of the parsers 😁 1.8K views · 5 likes · 0 reposts · 1 replies Open on X →

Mathias Karlsson@avlidienbrunn28 Sep 2023

PS. I dont know what that would be useful for, needed this for something else. But finding cases where server-side parse->serialize "made things worse" was fun :D 2.3K views · 4 likes · 0 reposts · 1 replies Open on X →

Mathias Karlsson@avlidienbrunn28 Sep 2023

I made a tool to compare/test server-side HTML parsers: https://t.co/w0DB4LOzM7 . How many "server-side mXSS" can you find? :) 24.7K views · 133 likes · 22 reposts · 4 replies Open on X →

Mathias Karlsson@avlidienbrunn21 Sep 2023

Did you know that JS supports shebang as a comment, and that multiline comments change behaviour depending on what they contain? Is there more?https://t.co/1km558YeSL 15.7K views · 55 likes · 13 reposts · 5 replies Open on X →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.