oh wow, twexit's back, i sure hope adrianus has done literally anything to improve his website's security

Pro tip: you can send messages from banned accounts, and people will still receive it (although the message is only visible in the preview)

SkyBucksというスパムDMが一部で横行しているようです。コードのコメントを見る限りイタズラっぽいんですが、リンク先には飛ばないようにしましょう（キーストロークなどもトラッキングされているようなのでアカパスとか入力しちゃダメ）。ちなみにClaim Giftすると「Blueskyに広告を出稿したりポストに色を付けられる」らしいです。すごいね

Here's a screenshot of BitView's admin panel.

Skyname is back online. Please read below for a detailed postmortem of the incident: darn.blog/2024-01-14-s...

Skyname experienced a brief incident today where a malicious third party was able to overwrite DNS records pointing to registered usernames. All usernames have been successfully restored, and you should expect to see yours update in 24-48 hours if you're still seeing Invalid Handle.

I now control every skyname handle :) (Well, every skyname handle that has appeared in plc.directory/export )

@twexit.nl @adrianus.twexit.nl Check your twitter DMs

By the way, this isn't just twexit and mastochist. Every single website that Adrianus has ever made is vulnerable to SQLi.

Merry christmas. mastodon.nl/@adrianus/11... archive.is/kwqQB

There it is. Seems like twexit is actually dead now-- no page is working anymore. twexit.nl archive.is/LJnFd (For clarity's sake-- I am not the one that put the image on the website. That seems to have been the action of the actual admin of the site.)

Bingo.

Finally, here's XSS in twexit post-shutdown 6v.pages.dev/final :)

Alright, looking into it more it seems the sql injection bug I found isn't actually exploitable in terms of getting database contents, just calling some functions. Could be wrong, though. If anyone else wants to give it a try: POST twexit.nl/js_output_te... w/ data first=0(sql here)

database() like 'admin_twexit' (this bug is very annoying to exploit)

that was fast (:

Just pushed an update to the payload that will hopefully sign everyone out from twexit that views an affected user/clicks the link. I have no confidence that twexit will actually invalidate the PHPSESSID but hopefully the redirect will get people to revoke their app passwords.