Luke Young – Medium

Luke Young

Pinned

Published in

Building GitHub Canarytokens: A rant about Audit Log gaps

Insights from my (mostly) successful attempt to create API tokens and SSH keys for github.com that trigger an alert (including source…

3d ago

Screenshot of a Slack message posted by “GitHub Canarytokens” containing a “GitHub Audit Log Alert”. Message contains the timestamp, token used, URL, action (“api.request”), source IP and User Agent (“GitHub CLI 2.90.0”). The raw event is attached as well as comment indicating the location where the token was stored (“Stored in ~/.netrc on self-hosted ubuntu GitHub Actions runners”)

3d ago

Pinned

Published in

Building a WebAuthn Click Farm — Are CAPTCHAs Obsolete?

How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.

Jun 10, 2021

6 lite HyperFIDO keys connected to a USB hub and attached to a Raspberry Pi

Jun 10, 2021

Published in

XSS on account.leagueoflegends.com via easyXDM [2016]

This post contains a chain of vulnerabilities I responsibly disclosed to Riot Games in November of 2016. I’m publicly disclosing it now as…

Dec 1, 2022

A browser alert box from ‘account.leagueoflegends.com’ indicating successful exploitation of the XSS issue

Dec 1, 2022

Published in

DEF CON 25: Slides and Source Code

Aug 2, 2017

Aug 2, 2017

Published in

DEF CON 24: Slides and Exploit

Here’s the slides and exploits from the DEF CON 24 talk in Las Vegas, NV. Video to follow in a few weeks.

Aug 6, 2016

Aug 6, 2016

Published in

git init && git commit -a -m “Initial Commit”

I decided to relaunch my blog with my recent domain name change. It’s unlikely I will migrate the old content, but look forward to my…

Jul 22, 2016

Jul 22, 2016

Luke Young

Luke Young

I find bugs and exploit them. Sometimes for money, mainly for T-Shirts - https://www.linkedin.com/in/bored-engineer/ - All opinions are my own.

Help

Status

About

Careers

Press

Blog

Privacy

Rules

Terms

Text to speech