Ibram

Security @meta

[Doyensec @Doyensec]

Last Saturday we celebrated Doyensec's 4th anniversary. For this occasion, we prepared a short infographic of what has changed and who we are today:

https://t.co/6CevrfmyU0

Also, Happy Holidays everyone!
#doyensecanniversay #security #happyholidays

[Doyensec @Doyensec]

Our new blog post is out! @73696e65 talks about his journey fuzzing Javascript engines with state of the art tools. We explore Dharma before setting up @5aelo's Fuzzilli, modifying it, and collecting CVEs in JerryScript https://t.co/8Tp7GFmLZM 🐛#fuzzing #fuzzilli #dharma

[Jake Miller @theBumbleSec]

I am excited to release my new tool GadgetProbe: Inspect endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote classpaths. No more sitting in the dark if ysoserial doesn't fire. https://t.co/lJfeIMMzeU #bugbounty #bugbountytip

[Ibram @0xibram]

@gwendallecoguic @Random_Robbie @coffeetocode @zseano @nnwakelam @opengql @graphqlparis Click on change schema -> introspection-> copy introspection query

[Doyensec @Doyensec]

Our very own @lorenzostella just got accepted to the Black Hat USA Arsenal in 2019 where he'll be showing off the new Electronegativity hacking tool! #blackhat

[Ibram @0xibram]

@akita_zen @Cache_Bounty @Bugcrowd You should never try to access PII or anything sensitive to prove your point. That’s how you get yourself in trouble. Try reaching out to support@bugcrowd and they should be able to help.

[d0nut 🦀 @d0nutptr]

Here it is! My blog post on Sequential Import Chaining
https://t.co/ZKHrRDy99u
(and tool: https://t.co/azezNkrFHq)

#bugbountytip #security

[Mahmoud Gamal @Zombiehelp54]

I found a zero-day within a nodejs library and used it to get RCE on a Shopify application, here is the full write-up: https://t.co/hsLqyhAt3Z …

Thanks @cript0nauta and @the_st0rm for your help on this one

[Luca Carettoni @lucacarettoni]

After many hours of preparation, coding, disclosures - the WireApp (secure messaging) and Discord (gaming chat) XSS to RCE bugs are out! For more vulnerabilities and examples, check the @BlackHatEvents slides https://t.co/TTiJ6HDBqP

[Ibram @0xibram]

@soaj1664ashar @Hacker0x01 @jobertabma @martenmickos I’m not sure if you read the report or no but if you did, you should have noticed that the vulnerable query is in the “users” field. So naturally it’s going to return a list of users. You don’t have control over the User objects that are returned.

[Ibram @0xibram]

@ITSecurityguard @Hacker0x01 @mongobug check out https://t.co/JF3VRfIV8g if you dont wanna deal with huge PNGs like this. It's pretty fast and interactive.

[Doyensec @Doyensec]

We’re excited to announce the public release of Electronegativity https://t.co/VtorIKXjmk, our opensource tool for Electron security. Learn more on our blog https://t.co/RXcaijHVEi

[Ibram @0xibram]

@0xKonqi Dude that looks sick. What do you have under the hood?

[WithSecure Labs @FSecureLabs]

Buckle up, even on your local system, HTTP isn't safe. Kubernetes' #Minikube #DNSRebinding leads to RCE on your host - @alxk_mwr https://t.co/uXqDUDHfjg

[Ibram @0xibram]

@Yassineaboukir This is a really good resource to use once you have the source code: https://t.co/LAuR5AcaAl

[Doyensec @Doyensec]

Watch @Void_Sec present his drones security research at @SEC_T_org. Live at 13.50 (GMT+2) https://t.co/GPrSuZmnir Go Paolo!

[Ibram @0xibram]

Verifying myself: I am ibram on https://t.co/Zga56JH9C3. oCT1cjPyI7fIXGhSDIcu7wsm8uGhZ9U1hqEJ / https://t.co/iWxCwOlALP

[Samuel Groß @5aelo]

Here are the slides from my #BlackHatUSA talk about just-in-time compilers for JavaScript and the @webkit bug I used as part of my Pwn2Own chain this year =) https://t.co/RpASPLSfr1