Kirill89

Follow

Kirill Kirill89

Follow

111 followers · 41 following

Achievements

Achievements

Organizations

Kirill89/README.md

Hi, I'm Kirill 👋

Information Security Researcher · Software Engineer · Open Source Software Contributor

Blogs

2024-10-24 Reliable automatic code fixes with AI
2022-05-24 Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks
2022-04-04 Exploring 3 types of directory traversal vulnerabilities in C/C++
2022-01-10 Exploiting URL parser confusion
2021-06-02 Mitigating and remediating intent-based Android security vulnerabilities
2021-05-27 Hunting intent-based Android security vulnerabilities with Snyk Code
2021-05-18 Exploring intent-based Android security vulnerabilities on Google Play
2021-05-06 Deep dive into Visual Studio Code extension security vulnerabilities
2020-10-15 SourMint Malicious SDK Research write up
2020-03-26 Exploring the minimist prototype pollution security vulnerability
2016-12-07 Remote (dev)tools своими руками – интервью с Романом Дворновым (Авито)
2016-10-21 Дробим монолит: Рефакторинг архитектуры Web-приложений
2016-08-16 Запускаем Node.js на JVM
2012-02-06 MSP430, учимся программировать и отлаживать железо (часть 3)
2012-02-01 MSP430, учимся программировать и отлаживать железо (часть 2)
2012-01-09 MSP430, учимся программировать и отлаживать железо
2011-06-20 Amazon Route 53 и бесперебойная работа сайта

Talks

2025-05-30 OWASP 2025 Global AppSec EU: LLMs vs. SAST: How AI Delivers Accurate Vulnerability Detection and Reduces False Positives
2024-09-14 BSides Kraków: Don’t Make This Mistake: Painful Learnings of Applying AI in Security
2024-08-06 BSides Las Vegas: Don’t Make This Mistake: Painful Learnings of Applying AI in Security
2021-12-15 Log4Shell: What You Need to Know About the Log4j Vulnerability
2021-11-23 WeAreDevelopers JavaScript Congress 2021: Vulnerable VS Code extensions are now at your front door
2021-11-16 INTENT Summit: 1-click to infiltrate your org via vulnerable VS Code extensions
2021-11-03 Ekoparty 2021: 1-click to infiltrate your organization via vulnerable VS Code extensions
2021-06-02 I can use VS Code to hack into your development environment
2020-10-15 Security BSides Dublin: The Case Of Malicious Advertisement SDK Affecting Thousands Of Mobile Apps
2015-10-10 Учим linux вместе: Настройка окружения для написания модулей
2015-10-10 Учим linux вместе: Взаимодействие с proc fs
2015-09-19 Учим linux вместе: Как происходит загрузка ОС

Vulnerabilities

Open Redirect in Gophish
Path Traversal in Pistache CVE-2022-26068, C/C++
Path Traversal in Webcc CVE-2022-25298, C/C++
Arbitrary File Write in Drogon CVE-2022-25297, C/C++
Arbitrary File Write in Mongoose CVE-2022-25299, C/C++
Content Injection in Crow CVE-2021-23824, C/C++
Path Traversal in Crow CVE-2021-23514, C/C++
Arbitrary File Write in Iris Web Framework CVE-2021-23772, Go
Open Redirect in Clearance CVE-2021-23435, Ruby
DOM-based XSS in Video.js CVE-2021-23414, JavaScript
Open Redirect in Gitpod Go
Prototype Pollution in nedb CVE-2021-23395, JavaScript
Prototype Pollution in yargs-parser CVE-2020-7608, JavaScript
Prototype Pollution in minimist CVE-2020-7598, JavaScript
Denial of Service in ecstatic CVE-2019-10775, JavaScript
Command Injection in php-shellcommand CVE-2019-10774, PHP
SQL Injection in Medoo CVE-2019-10762, PHP
SQL Injection in Pixie Query Builder CVE-2019-10766, PHP
Prototype Pollution in AngularJS CVE-2019-10768, JavaScript
SQL Injection in knex.js CVE-2019-10757, JavaScript
SQL Injection in sequelize CVE-2019-10748, JavaScript
Prototype Pollution in lodash and lodash.merge CVE-2019-10744, JavaScript

Pinned Loading

prototype-pollution-explained prototype-pollution-explained Public

Prototype Pollution in JavaScript

JavaScript 75 18
prototype-pollution-exploits prototype-pollution-exploits Public

Prototype Pollution exploits collection

JavaScript 34 7
visual-studio-code-extension-security-vulnerabilities visual-studio-code-extension-security-vulnerabilities Public

HTML 4 1
cpp-bencode cpp-bencode Public

C++ Bencode Parsing Library

C++ 1 1
learn-unity learn-unity Public

ShaderLab 1
trax-retail/url-protector-nginx-module trax-retail/url-protector-nginx-module Public

This module allow nginx to decrypt strings encrypted with xxtea algorithm. This is useful to hide actual URLs from client.

C 10 5