🕵️ MLT 🧙‍♂️

Cybersec researcher & exploit developer w/ emphasis on webapp security. Former #TeaMp0isoN + former Founder of Project Insecurity LTD + founder of Bug0xF4.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

I'm rarely able to access twitter these days, so if anyone needs me for any reason then then I can be contacted via matrix, telegram, or Keybase.

Matrix: [email protected]
Telegram: Libuuid2
Keybase: https://t.co/3yPoNke6DZ

[🕵️ MLT 🧙‍♂️ @0dayWizard]

Been writing a script to make post-exploitation on *nix easier for beginners, here's what I've added so far. If anyone can think of more functionality to add then please let me know. I've made a primitive UI to make it easier for beginners to use (rather than cmdline args)

[🕵️ MLT 🧙‍♂️ @0dayWizard]

Does anyone know how I contact @ChainLands ? The Project Insecurity LTD member who was from NL?

Need to contact him ASAP.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@_godiego__ @serverinspector Open redirect alone won't work, but a redirect in conjunction with something else I've got will work (an XSS isn't the only thing I've found)

[🕵️ MLT 🧙‍♂️ @0dayWizard]

I asked this like a year ago but didn't get a response.. everything else for my chain is still working so I'll ask again..

Does anyone currently have JSNOP callback or open redirection in *.paypalobjects.net?

I'll split the bounty with you if you've got one.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@coffinxp7 Yeah I did see that the payload list covered some different contexts, but it would be cool to see a post breaking down each of those contexts and explaining the situations in which different context-specific payloads should be used.

Either way, nice post.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

Is there anything specific about this vuln that makes it more noteworthy than the thousands of other vulns that get reported to NASA?

[🕵️ MLT 🧙‍♂️ @0dayWizard]

Why is this even news? Someone reported a vuln to the VDP of probably the least secure .gov site in existence and somehow this is newsworthy?

Does anyone even know what type of attack vector it was? Is there a writeup? I fail to see what makes this "breaking news"

[News Arena India @NewsArenaIndia]

BREAKING NEWS 🚨 📢

14 year old Yuvraj Gupta, who lives in Kanpur, Uttar Pradesh, has done a great feat. Hesaved the website of American space agency NASA from hackers.

NASA has included him in the 'Hall of Fame' and also given him a letter of recognition.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@Earinenes @danielmakelley The closest thing to "social media" that many of them use is IRC

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@Earinenes @danielmakelley Definitely not true. I know hundreds of skilled hackers who avoid all forms of social media like the plague.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@vxdb I get that this is the results of an investigation from 2023, but by now it's pretty much old news given that all of these markets are dead and the customers getting arrested are most likely dealers themselves. I can't see how this would disrupt any currently existing DNM's.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@vxdb I'm assuming the buyers who got caught weren't just your typical buyers, but rather dealers themselves

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@coffinxp7 I see tons of people starting their payload with ' or %27 and just assuming it isn't vuln when that doesn't work, but I never see articles covering how payloads need to be tweaked for different context and in situations where starting with ' doesn't work, something like ") might

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@coffinxp7 Nice article, however one thing I NEVER see in articles regarding SQLi is context-specific payloads, i.e. how you need to change the start of your payload based upon where in the SQL statement your inputs are being reflected into.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@serverinspector I've got an XSS in PayPal but their CSP is preventing me from triggering it, however if I can find JSONP callback or open redirection in https://t.co/y9SPDJQOlx then I'll be able to bypass the CSP and get my JS to trigger.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@serverinspector Yeah I meant .com sorry

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@DexerTDP Lol I think I freaked them out cos I shared something in https://t.co/ziXCL3OHmx so they kicked me from their private Keybase server thinking I was trying to bait them into getting v& and extradited to the Philippines I guess 🙃

I met some chill people in there though.

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@xitsec So it was literally just a case of reading that file from the extracted tarball and then connecting to their MySQLd using those creds.
Second time I hacked them was using a CVE that had been public for several years.

Even to this date they're vuln to tons of dumb BS like that..

[🕵️ MLT 🧙‍♂️ @0dayWizard]

@xitsec The first time I hacked NASA I found a wordpress installation there with open directory listings and a "backup.tar.gz" file -- the tarball was a backup of their WP site with wp-config.php included in there. Working plaintext MySQL creds in that file + open port 3306