vavkamil

(() => {
  // 40C3 public sale: November 11, 2026, 18:00 CET
  // https://events.ccc.de/congress/2026/infos/tickets/
  const TARGET = new Date("2026-11-11T18:00:00.250+01:00").getTime();

  clearTimeout(window.cccTimer);

  console.log("🎟️ 40C3 Ticket Refresh");
  console.log("Target:", new Date(TARGET).toLocaleString());

vavkamil

<html>
<head>
    <title>Bookmarklet hijacking PoC</title>
</head>
<body>
    <h1>Bookmarklet hijacking</h1>
    <h2>Chromium Proof of Concept</h2>

    <h3>Steps to reproduce</h3>
    <p>1. <strong>Double-check that the link executes</strong> <code>alert(1)</code></p>

vavkamil

<?php

/**
 * Plugin Name:       covid19-plugin-wp
 * Plugin URI:        https://wordpress.org/plugins/covid19-plugin-wp
 * Description:       This plugin adds a custom widget to display Covid19 statistics for a selected country.
 * Version:           1.0.1
 * Author:            @vavkamil
 * Author URI:        https://vavkamil.cz
 * License:           GPL v2 or later

vavkamil

import requests

from urllib3.exceptions import InsecureRequestWarning

import random

import string

import sys

vavkamil

<html>
<head>
<title></title>
</head>
<body>
<h1>Strong TV DoS exploit</h1>
<h2>Proof of Concept</h2>
<label for="internal_ip">Any internal IP:</label>
<input type="text" name="internal_ip" id="internal_ip" autocomplete="off" onchange="get_tv_ip()">
<br><br>

vavkamil

<html>
<head>
<title>Hue Bridge CORS PoC</title>
<script>
            var xhr = new XMLHttpRequest();

            xhr.open("GET", "https://discovery.meethue.com/")
            xhr.send();
            xhr.onreadystatechange = function(e) {
                var hue_ip;

vavkamil

#!/usr/bin/env python

import argparse
import urllib.request
import concurrent.futures
from datetime import datetime, timedelta
import sys

domains = ["vavkamil.cz"]

vavkamil

<?php
ob_start();
ini_set('display_errors',0);
$ipa = $_SERVER['HTTP_CLIENT_IP']? $_SERVER['HTTP_CLIENT_IP'] : ($_SERVER['HTTP_X_FORWARDE‌​D_FOR'] ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'] );
$useragent = $_SERVER['HTTP_USER_AGENT'];

if(isset($_POST['gotcha'])){
     blockBot($ipa);
}

vavkamil

$ apt-get update && apt-get upgrade --assume-yes
$
$ pip3 install frida-tools
$ pip3 install objection
$
$ sudo apt-get install android-tools-adb android-tools-fastboot
$
$ wget wget https://github.com/frida/frida/releases/download/12.7.0/frida-server-12.7.0-android-arm64.xz
$ unxz frida-server-12.7.0-android-arm64.xz

vavkamil

Keybase proof

I hereby claim:

• I am vavkamil on github.
• I am kamil_kiwi (https://keybase.io/kamil_kiwi) on keybase.
• I have a public key ASDQMrxWDIIThXhqFK9NJhP6hZTdrO5MjI7M_T4bBsTbsAo

To claim this, I am signing this object: