Skip to content
View Bo0oM's full-sized avatar
3, 2, 1...
3, 2, 1...
Block or Report

Block or report Bo0oM

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Please don't include any personal information such as legal names or email addresses. Maximum 100 characters, markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse


Anton Lopanitsyn

Web application security researcher. Current Location: Moscow, Russia


Twitter: @i_bo0om

Telegram channel: @webpwn

Penetration testing for business

Exploit & hacktool search engine

Antifraud for everyone

Leak finder


  • Web application security research;
  • Browser security and client-side exploits;
  • Web Application Firewall development and evasion;
  • Vulnerability scanning automation.


  • Experienced public speaker (more than 20 presentation);
  • CVEs in browsers;
  • Active researcher, lots of publications and whitepapers;
  • Received bug bounties from Microsoft, Google, Twitter, LinkedIn, Yandex, Cloudflare,, QIWI,, etc;
  • Nominated for the Top 10 web hacking technologies in 2017 and 2018;


Urban.Tech Moscow

First place in the category "searching for vulnerabilities"

Wallarm Research Team:


Xakep magazine:


Whitepapers & Publications

Hosting dashboard web application logic vulnerabilities

There's Nothing so Permanent as Temporary

De-anonymization and total espionage

"You're so funny", about funny vulnerabilities in web applications. Security Meetup

Not by Nmap Alone

Geek Picnic 2015 - Big Brother is watching you

Security of payment systems and banks

VolgaCTF 2016 - DNS and attacks

Defcon KZ 2016 - Website reconnaissance tools

A blow under the belt. How to avoid WAF/IPS/DLP

KazHackStan 2017 | Tracking

Armsec 2017 | 2 bugs 1 safari

User-friendly, though. (Messaging bots expose sensitive data)

Safety for paranoids. Everything is bad.

ZeroNights Web Village Organizer

Web Application Cache Poisoning Security Meetup

Defcon Russia 2017 - Google Glass with AI

VolgaCTF 2018 - Neatly bypassing CSP

KazHackStan - "><script>alert()</script>

Defcon DC7499 Meetup - Param-pam-pam

Offzone | Another waf bypass

Speaker on SK Cyberday

ZeroNights 2018 | Race Condition Tool

ZeroNights 2018 | I <"3 XSS

PartyHack 2019 | How I hack the telegram

2000-day in Safari

Zeronights 2019 | Phoenix hunting

ZeroNights Web Village Organizer

OWASP Moscow Meetup #9

Wallarm Meetup 08.2020

Server-side request forgery via ftp account

Funny vulnerabilities especially for Fool's Day

ZeroNights 2021 | 31337

KHS | Defending against automatization

HighLoad++ | Protection against malicious automation


  1. Safiler Safiler Public

    Safari local file reader

    Python 123 21

  2. fuzz.txt fuzz.txt Public

    Potentially dangerous files

    2.8k 476

  3. CVE-2017-7089 CVE-2017-7089 Public

    Webkit uxss exploit (CVE-2017-7089)

    HTML 65 18

  4. CVE-2017-5124 CVE-2017-5124 Public

    Chrome < 62 uxss exploit (CVE-2017-5124)

    PHP 163 36