Jeti

Spare Time Hacker. Former Yahoo Elite 8-)

[Jeti @0xJeti]

Here's a write-up on a Browser-Powered Desync bug that I discovered in the Azure CDN service known as Front Door. The entire concept is built upon the excellent research by @albinowax. Initially identified within the @intigriti program.
https://t.co/sgpXEFVxzm
#bugbounty

[Jeti @0xJeti]

@deadvolvo I should definitely dig deeper into this... https://t.co/sgpXEFUZJO

[Swissky @pentest_swissky]

Knocking on the Front Door (client side desync attack on Azure CDN) - @0xJeti
https://t.co/XB8g3CpOHD

[Adam Langley @BuildHackSecure]

I created a tool called "Creatures Of Habit" which accepts a GitHub username/organisation finds all public repos and extracts endpoints from popular web frameworks https://t.co/L0TyTxYlJW

[Adam Langley @BuildHackSecure]

I plan to expand this by listing all the org repo, finding all the contributors and then scanning their public repos

[shubs @infosec_au]

When researching Palo Alto PAN-OS, @assetnote's Security Research team discovered an authentication bypass due to flaws in its architecture. Our team digs a lot deeper than surface-level CVEs; this research is an example. https://t.co/sJKwoovhFk

[Jeti @0xJeti]

@_zwink Yes, like every good hacker, she has some tricks up her sleeve. In this case it's called autostereograms

[Bug Bounty Reports Explained @gregxsunday]

With 12h more of hacking (and A LOT of reports to be processed, so it's all subject to change), we're 3rd as a team 🇵🇱 of the H1 Ambassador World Cup qualis

Plus individually, we occupy 2 out of top 3 spots for bounties with DrBrix absolutely killing it in the 1st

I'm so happy!

[Hacker Hideout @HackerHideout]

🔥🔥🔥

#HackerHideout0524 #hh0524

[Alex Chapman @ajxchapman]

I recently found a decade old Server-Side Browser on a #BugBounty program. Exploiting it was a bit of a ride. I wrote up the experience so others may learn from my (many) mistakes!

https://t.co/nunFj4HLQW

[Michael Skelton @codingo_]

Today @bugcrowd, we're expanding our product line to offer VDP's for free https://t.co/OiD82DnXuP, marking the next evolution of our VDP product, following our removal of incentives some time back.

This marks a change in the industry, providing a no cost entry point for customers to build up reporting portals, to support hackers in bringing vulnerabilities to them, in a fast, and effective manner. It also allows customers to build exposure to the value of the hacking community, and then pursue other offerings in the managed bug bounty space, or pen testing space, in a paid model, that incentivises findings and discovery, whilst VDP is intended to capture existing known findings.

Also, hackers, we hear you, we love you and we know there's more to change around VDP's. This isn't our only change. We're aware of the need to change terms for them, and it's currently an active discussion, as well as better separating VDP from MBB which we've done by removing incentives, and having this offering not list in our program portals. If you've other feedback, we would love to hear it, and welcome it - my slack is always open and you can reach me on HIVE, Bug Bounty Forum, or here over DM

[HackerOne @Hacker0x01]

Hey, Polish hackers! 🗣️

The first meeting of the Poland HackerOne Club is tomorrow, April 23! Join @gregxsunday and @_pkusik for an exciting agenda of lectures and networking.

RSVP here to reserve your spot: https://t.co/nx3v3xvgE7

[Bug Bounty Reports Explained @gregxsunday]

Browser-powered desync #bugbounty #bugbountytips #bugbountyhunter

[Jeti @0xJeti]

@gregxsunday Wow, my blog post featured in BBRE, thx @gregxsunday

[Jeti @0xJeti]

@vict0ni That sucks. Maybe fitting those 3 requests into a single packet in Burp would help with jitter?

[Bug Bounty Reports Explained @gregxsunday]

I'm proud to be the H1 ambassador for Poland🇵🇱 All the polish hackers interested, DM me to join to hack and have fun together😏

[Jeti @0xJeti]

Poland has now a H1 Brand Ambassador!
Congrats @gregxsunday

[HackerOne @Hacker0x01]

The 2024 Brand Ambassadors are ready to kick off the year right! 🙌 Thank you to everyone who submitted their applications to the program this year.

Check out the thread below to see our newest ambassadors, and sign up on https://t.co/PQVu5jSIFE to join your local chapter! 🌎

[Bug Bounty Reports Explained @gregxsunday]

I'm really close to 50k subscribers on YouTube and it's my birthday🥳 Can we make it to 50% of the silver button today?😏

Subscribe if you haven't already, RT if you have!
https://t.co/IP5uJiK378

[Jeti @0xJeti]

@SecGus https://t.co/AbnjJIHx7h ?

[Jeti @0xJeti]

@Jhaddix @InsiderPhD https://t.co/xvlE1m9kmV!