Tushar

Magician, musician and a security geek .

[Tushar @0xdeadpool]

Finally wrote a blog. An old issue in SpringBoot which could allow RCE. Inspired from @secalert blog.
https://t.co/VmObkLz58d

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Sean Kahler @battledashdev]

Just published a new write-up - Hacking 700 Million Electronic Arts Accounts https://t.co/onGdypFxjp

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[PortSwigger Research @PortSwiggerRes]

Converting LFI into RCE by chaining PHP encoding filters - superb research by @_remsio_!

https://t.co/GxCtunK0Au

[celesian @c3l3si4n]

This new trick for turning any PHP LFI to RCE is awesome! I've been wondering why it didn't get more attention since it works better than any other LFI2RCE techniques out there (such as expect://).Props to @loknop for publishing this technique initially👏
https://t.co/lGXHb4IGLR

[Scott Piper @0xdabbad00]

😱😱😱 This is worse than ChaosDB for AWS. @orcasec gained access to all AWS resources in all AWS accounts! They accessed the AWS internal CloudFormation service.
https://t.co/2oCCRvo389
Separately, they did something similar for Glue.
https://t.co/BDFMLQI06B

[ميمز سكيورتي 🛡️ @m3m353c]

مافي وقت..

[Rob Fuller @mubix]

10 #Log4Shell Facts vs Fiction: a 🧵
1. 1.x is NOT vuln to this RCE. While it doesn't have another RCE, it requires access to send serialized data to a listener ON the log server. This is much MUCH harder to exploit and kind of rare for a Log4j server to be running.

[H4x0r.DZ @h4x0r_dz]

CVE-2021-41773 POC

127.0.0.1/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

[s1r1us @S1r1u5_]

Finally, here is the blog for the prototype pollution research we did.

"A tale of making internet pollution free"
- Exploiting Client-Side Prototype Pollution in the wild

https://t.co/jsShZGlgKB

[Ian Carroll @iangcarroll]

I wrote about how I exploited a bunch of outdated Apache Airflow instances in bug bounty programs and earned over $13,000 for it! https://t.co/Z1a6WXwssy

[Rasta Mouse @_RastaMouse]

[BLOG]
My own little Domain Enumeration Tool

https://t.co/noqivcGmoR

Inspired by @christruncer and @FortyNorthSec

[Louis Dion-Marcil @ldionmarcil]

idk why I havent thought of this before, but its very easy to hide those "external sender" warnings that get appended to your emails during phishing campaigns 🤔. Email gateways/FW just add HTML at the start/end of emails, simply add CSS to hide it! #RedTeam

See images:

[shubs @infosec_au]

Check out our blog post on Context Aware Content Discovery https://t.co/ma7hdgPPfI - we drop a tool (Kiterunner - https://t.co/u9mb9DUlkg) and some datasets. Hope you can find more endpoints through our work!

[Kamil Onur Özkaleli @ko2sec]

Writeup: RCE on Starbucks Singapore and more for $5600 https://t.co/S2tAJtDFLI including @infosec_au and @irsdl .

[publiclyDisclosed @disclosedh1]

Grammarly disclosed a bug submitted by fransrosen: https://t.co/Rl4xeSJEK5 - Bounty: $3,000 #hackerone #bugbounty

[shubs @infosec_au]

Recently @Rhynorater sparked a discussion about exploiting blind SSRFs. At @assetnote, we've collected some information together and have created a Glossary of Blind SSRF Chains which can be found here: https://t.co/ziGHgBEXKL - we hope people can use it as a reference!

[Nicolas Grégoire @Agarri_FR]

Deep link on mobile app ➡️ Host-relative SSRF ➡️ Account takeover 🦾 (affecting @Pinterest) https://t.co/YK5BESKC1F

[Scott Sutherland @_nullbind]

[BLOG] Kerberos Bronze Bit Attack
https://t.co/nupsEm8Kjr
This is some great work by Jake Karnes that details how to bypass restrictions related to the “sensitive and cannot be delegated” setting (among other things). Worth the read!

[Bishop Fox @bishopfox]

We just released a list of some of our favorite #pentesting tools, featuring: @pdiscoveryio, @SpyseHQ, @defparam, @TheColonial, @theBumbleSec, @AquaSecTeam, & others! https://t.co/oCciYwNLIK