Ramazan Sancar ramazansancar

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

	# Bu araç @keyiflerolsun tarafından \| @KekikAkademi için yazılmıştır.

	from Kekik.cli import konsol
	import os, subprocess, requests

	class Hub2Berg:
	def __init__(self, github_kullanici_adi, github_token, codeberg_kullanici_adi, codeberg_token):
	self.github_kullanici_adi = github_kullanici_adi
	self.github_token = github_token
	self.codeberg_kullanici_adi = codeberg_kullanici_adi

	# Bu araç @keyiflerolsun tarafından \| @KekikAkademi için yazılmıştır.

	from Kekik.cli import konsol
	import os, subprocess, requests

	class Hub2Tea:
	def __init__(self, github_kullanici_adi, github_token, gitea_kullanici_adi, gitea_sifre, gitea_url):
	self.github_kullanici_adi = github_kullanici_adi
	self.github_token = github_token
	self.gitea_kullanici_adi = gitea_kullanici_adi

	#EXTM3U
	#EXTINF:60,TRT 1 HD
	https://tv-trt1.medya.trt.com.tr/master_720.m3u8
	#EXTINF:0,TRT 1 FHD
	https://ddc75c8a6akqr.cloudfront.net/v1/master/80dbfc318ab6b980679b32095ba497236de6d2f9/TRT-1/master.m3u8
	#EXTINF:0,TRT 1 HD YEDEK
	https://trt1dvr.blutv.com/blutv_trt1_dvr2/live.m3u8
	#EXTINF:0,TRT 1 FHD YEDEK
	https://tv-trt1-dai.medya.trt.com.tr/master_4.m3u8
	#EXTINF:0,KANAL D HD

	#!/bin/bash
	# Modify your app.py to run on port 80 if you don't want to open up ports in Azure networking. You'll need sudo (as below) to run the flask server on port 80. Consider setting up an NGINX reverse proxy instead. Remove sudo in the crontab and install entries below if not using port 80.
	# You'll also have to change the reset command to work with sudo too if using port 80: echo whateverpassword \| sudo -S -u whateverusername screen -S screen_to_test -X quit

	sudo apt update
	sudo apt install -y python3-pip git-lfs ffmpeg python3-venv
	pip install flask
	sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 10
	mkdir sgtranscribe
	mkdir livetranscribe

	#!/bin/bash

	GITHUB_USERNAME=
	GITHUB_TOKEN=

	GITEA_USERNAME=
	GITEA_TOKEN=
	GITEA_DOMAIN=
	GITEA_REPO_OWNER=

	#!/bin/bash

	# Create the openssl.cnf file
	cat > openssl.cnf << EOF
	[req]
	distinguished_name = req_distinguished_name
	req_extensions = v3_req

	[req_distinguished_name]
	commonName = Common Name (e.g. server FQDN or YOUR name)

	#!/usr/bin/env python3
	import requests
	import json
	import time

	API_KEY = "asdf"

	def miles_to_meters( miles ):
	return ( miles * 1609.34 )

	<!DOCTYPE html>
	<html>
	<!-- Example: http://minopia.de/gh/compare/?base=https://github.com/IKennyAgain/iw4x_waypoints/tree/master&compare=https://github.com/xlabs-mirror/iw4x-bot-waypoints/tree/master -->
	<head>
	<meta charset="UTF-8">
	<title>GitHub Compare URL Generator</title>
	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css">
	<style>
	.dark-mode {
	background-color: rgb(71, 71, 71);

Ramazan Sancar ramazansancar

Cloudflare

FAQ on the xz-utils backdoor (CVE-2024-3094)

Background