Profile for joern
- Display name
- joernchen
- Username
- @joern@threatactor.club
- Role
- admin
About joern
Fields
- Website
- https://0day.click
- Threema
- https://threema.id/K8J68WTX
Bio
Your mom's favorite hacker!
My other account is @joernchen
- Joined
- Posts
- 679
- Followed by
- 1127
- Following
- 261
Stats
Recent public posts
I don’t find the bugs - the bugs find me!
Let’s call it „beg4shell“. At least now everyone can be a vulnerability researcher.
Sooo Leute was sind denn eure Boomermeinungen zu https://www.langenscheidt.com/jugendwort-des-jahres bitte?
Forget wordle:
joernchen scored 0.06 which is amazing!
★★★★★
I've played 5 days in a row
https://beatmatch.pro/
Send memes my way please!
Niemand: ...
Deutsche JSON API:
{"status":"BAD_REQUEST","timestamp":"04-07-2026 05:38:22","message":"Missgebildete JSON-Anfrage".....
Re: https://infosec.exchange/@bsidesfra/116821688667636012
Soooo what would you like to hear from me in that talk?
Me: you Claude build me a fuzzing harness for this codebase
Claude: sure thing, here we go
Claude does build something with some back and forth with the compiler and linker and figures how to solve all the errors. 
Claude: Now let me do a clean build….
And so Claude fucks around, does a rm -f harness_* && make all and finds out it deleted the harness_*.c files as well.
¯\_(ツ)_/¯
Putting on my tinfoil hat I would say that it’s in the best interest of Anthropic because well when it has to recreate the code again more tokens are being sold.
So many calcs so little time.
Special thanks to @buherator, best sticker I had in a while. 😍😍😍
https://badhost.org it's really bad. :P
I miss shitposting :(
LLM confessions
I had a major oversight. I wrongly assumed the test program ran and that I saw its output. I now realize I only created the file and never compiled or executed it. This caused me to hallucinate the output and led me down the wrong path.
The test was not executed! I need to re-evaluate based on this new understanding, and re-examine my program output. I will now run and evaluate it.
Bling bling ;D
You use Claude Code to find vulnerabilities, I find vulnerabilities in Claude Code.
https://greptalks.ai/ is fun, also https://greptalks.ai/rate-my-talk/ for letting it rate your own presentations.
Maybe AI is what was needed to make Linus‘s Law ("Given enough eyeballs, all bugs are shallow") become effective since now there are enough(?) AI assisted eyeballs.
Question for the CVSS nerds:
One-click unsandboxed RCE on a Desktop App in CVSS 4.0 --> Subsequent System Impact Metrics are what exactly?
When you instruct your LLM, why is it:
“make no mistakes!”
and not:
“good vibes only!”