CVE-2026-44590: RCE via pull_request_target Injection > Supply Chain Compromise in Sherlock

Sherlock is one of those tools anyone who does OSINT has used at least once. You give it a username and it checks whether that identity exists across 400+ social networks and registration platforms. It is straightforward, fast, written in Python, and has a huge community: at the time of writing the official repository sits at around 83,000 stars on GitHub with hundreds of contributors. To give an idea of the potential blast radius in case of compromise, I collected some public metrics at the time of writing: ...

Pubblicato il 07/05/2026 · 21 min · 4265 words · Astaruf

Featured in HackerJournal Issue #275

HackerJournal holds a special place in my heart. It’s one of the first hacking magazines I read as a kid, diving into its pages to fuel my passion for hacking and technology. For enthusiasts, it was a real gateway into the world of ethical hacking and cybersecurity. The Article: “I Know Where You Post From” Specifically, the article I worked on in collaboration with Unlock Security, titled “So da dove posti” (I Know Where You Post From), appears on page 36. It details the process I followed to geolocate an individual using only open source intelligence (OSINT) techniques, starting from a single public photo. ...

Pubblicato il 20/01/2024 · 1 min · 212 words · Astaruf

OSINT Challenge

Inspired by the numerous challenges from Gary Ruddell, Unlock Security introduced a very fun OSINT challenge that I managed to solve: no contextual information, just a single blurry photo with few visible details. 🔎 The Challenge: Can you determine the location where this photo was taken? Step 1: Using Facial Recognition To begin, I used facecheck.id, an online facial recognition tool, to check if the person in the photo appears on any public platform or social media. ...

Pubblicato il 21/09/2023 · 3 min · 431 words · Astaruf