Lauritz

Lauritz

@lauritz-holtmann.de

IT-Security Researcher, Pentester and Bug Hunter. Passionate about 💻, 🤽‍♂️, ⚜️, 🎸 and ⚽ #meinVfL #Kaeferjaeger + H1 Ambassador 🏠 https://security.lauritz-holtmann.de

344 followers299 following37 posts

Lauritz
@lauritz-holtmann.de

Nullcon x German @hacker0x01.bsky.social Club: Community LHE and Bug Bounty Meetup 🧑‍💻 For the first time, the German HackerOne Club is heading to Nullcon Berlin 2026! 📆 November 5 – 6, 2026 📍Maritim proArte Hotel Berlin #BugBounty #Meetup #LHE #Nullcon #Hackerone #Berlin (1/2)

Lauritz
@lauritz-holtmann.de

Join us for our 8th meetup and a special Community Live Hacking Event to connect with fellow bug bounty hunters, share knowledge, collaborate, and hack together on a partnering bug bounty program. Find more details and RSVP here: h1.community/e/m66bay/ (2/2)

h1.communityGerman HackerOne Club: Community LHE and Meetup @ Nullcon Berlin 2026 | HackerOne CommunityIn-person Event - For the first time, the German HackerOne Club is heading to Nullcon Berlin 2026! Join us for our 8th meetup and a special Community Live Hacking Event to connect with fellow bug boun...
Lauritz
@lauritz-holtmann.de

Hacking Meetup "Friendly Edition" 🇳🇱 vs 🇩🇪 The @hacker0x01.bsky.social Club Netherlands and HackerOne Club Germany are teaming up for a cross-club bug bounty competition - inspired by the HackerOne Ambassador World Cup. #BugBounty #Meetup (1/3)

Lauritz
@lauritz-holtmann.de

Expect a week of focused hacking on a real target, collaboration, and a competitive edge via a shared leaderboard. Timeline: • May 30 → June 7 (remote phase) • June 7 (hybrid finale, near NL–DE border) (2/3)

Lauritz
@lauritz-holtmann.de

Limited slots (≤20 per team), mixed skill levels, and an emphasis on meaningful findings. If you’re as excited as we are regarding the upcoming AWC and are situated in🇳🇱 or 🇩🇪 - sign up before May 27 and join us for this special event! RSVP and Details: h1.community/e/mrd2c9/ (3/3)

h1.communityHacking Meetup "Friendly-Edition": Netherlands vs. Germany 🇳🇱🇩🇪 | HackerOne CommunityHybrid Event - Join this special hacking meetup hosted in collaboration by the HackerOne Clubs of Germany and the Netherlands! We will be hacking on a live target, connecting, collaborating, and compe...
Lauritz
@lauritz-holtmann.de

[Blog Post] Turning the List-Unsubscribe SMTP Header into an SSRF/XSS Gadget security.lauritz-holtmann.de/post/xss-ssr... Once again, ancient RFCs and overlooked security hot spots in specifications turned out to be worthwhile for security research. Read the spec!

security.lauritz-holtmann.deTurning List-Unsubscribe into an SSRF/XSS GadgetThe List-Unsubscribe SMTP header is standardized but often overlooked during security assessments. It allows email clients to provide an easy way for end-users to unsubscribe from mailing lists. This ...

Lauritz reposted

Oli (C..1..P.H.Y)
@munz4u.de

I reported a single, highly critical vulnerability that earned the top payout of the event. 💥🐞 Big thanks to @exness6.bsky.social for putting together such a great virtual meetup, and a special shoutout to @lauritz-holtmann.de! Everything was incredibly well organized! 🙌

Lauritz@lauritz-holtmann.de

Hacking Meetup vol. 3 of the German @hacker0x01.bsky.social Club - supported by @exnessofficial.bsky.social - was a blast! 💥 We x6 the overall bounties of our previous meetup and scored over 94,000$ overall bounties. 🤯 Additionally, H1 swag is on the way to all attendees and will arrive soon. 🤞

Lauritz
@lauritz-holtmann.de

Join our (or your local) club on h1.community to not miss future events in your region: h1.community/germany-hack... The leaderboard of the event can be found here: leaderboards.hackerone.live/germany-meet... Event wrap-up: h1.community/e/mgswsg/

h1.communityH1 | HackerOne CommunityAt HackerOne, we're making the internet a safer place. Thousands of talented people – hackers, employees, and community members – have dedicated ourselves to making the internet safer by helping organ...
Lauritz
@lauritz-holtmann.de

bsky.app/profile/laur...

Lauritz@lauritz-holtmann.de

The new year starts with a bang: #BugBounty Meetup Vol. 2 of the German @hacker0x01.bsky.social Club will take place on February 22nd in #Bochum, Germany! 🧑‍💻 We will organize the event like a Mini-LHE: Like last year, there will be again a collaborating H1 program and a leaderboard. (1/3)

Lauritz
@lauritz-holtmann.de

The new year starts with a bang: #BugBounty Meetup Vol. 2 of the German @hacker0x01.bsky.social Club will take place on February 22nd in #Bochum, Germany! 🧑‍💻 We will organize the event like a Mini-LHE: Like last year, there will be again a collaborating H1 program and a leaderboard. (1/3)

Lauritz
@lauritz-holtmann.de

The event will consist of a remote part and the final in-person day in Bochum. 15.02. - 21.02.25 Remote hacking and knowledge exchange on Discord 22.02.25 In-Person event in Bochum, Germany Please sign up ASAP as we only have limited space available. (2/3)

Lauritz
@lauritz-holtmann.de

👉Signup here: h1.community/events/detai... This is a community event that is organized by volunteers and supported by H1, e.g. by sponsoring the venue. Thanks to @hacker0x01.bsky.social for their support! ❤️ (3/3)

h1.communityGerman HackerOne Club: Hacking Meetup vol. 2 | HackerOne CommunityHybrid Event - Join the second Hacking Meetup of the HackerOne Club Germany! We are going to hack on a live target, connect, collaborate, and learn. This Meetup is open for all skill levels. Sign up...
Lauritz
@lauritz-holtmann.de

Just landed at #38c3 🤩 Ping me here or via ☎️5876 if you want have a chat, talk about things like #BugBounty or just want to have a Tschunk together. :) I also have a handful of #H1 stickers with me to spread. 😏

Lauritz
@lauritz-holtmann.de

Blog: #Android App Links Allowed Hijacking Arbitrary #SSO Flows 👉 security.lauritz-holtmann.de/post/sso-and... Discover how twitter.com/_kun_19 and I uncovered a severe issue allowing hijack of SSO flows on Android… only to find we were years late to the party. #BugBounty #Security #FuckUp

security.lauritz-holtmann.deAndroid App Links autoVerify=false Allowed Hijacking Authentication FlowsResearch is a constant process of failure and iteration. However, in most cases, you only see the one-in-a-thousand (successful) attempt. To normalize f*ck ups, and because I believe the behavior we i...
Lauritz
@lauritz-holtmann.de

The "Dead Domain Discovery" Extension is now available from Chrome Web Store: 👉 chromewebstore.google.com/detail/opfeo... Keep in mind that the extension needs broad permissions to work. I'd recommend to only install it to your "research browser". Github: github.com/lauritzh/dea...

chromewebstore.google.comDead Domain Discovery - Chrome Web StoreScans the page for external iFrames, Scripts, and Styles, logs them to the console, and checks if their domains are resolvable.

You are up to date.