Ashton

OffSec + AppSec. ARG enthusiast. Team 23 CTFs. OSCP, etc

[Ashton @5ht0n]

Deserialization bugs are easy to recognize in theory but were weirdly frustrating to exploit. I wrote a short practical piece on understanding the bug class a little better. Hopefully this helps turn more sinks into payloads!

https://t.co/azL2jyimXk

[Ashton @5ht0n]

@GrahamHelton3 @Snowflake Can you say how much AI-focused red teaming you’re doing? (assessing ai, not using it)

[Ashton @5ht0n]

stop telling devs how to fix vulnerabilities.

https://t.co/tPDcky3r7V

i have a new take about appsec:

ai-first eng workflows dictate that agents deal with findings, not developers.

at that point, why are we telling devs how to fix it at all?

we need to close the loop.

[Ashton @5ht0n]

@pumfleet @FloNocode @peer_rich @Adiiizi @calcom Done, appreciate the ack

[Ashton @5ht0n]

@FloNocode @peer_rich @Adiiizi @pumfleet @calcom I followed their disclosure process by sending an email.

[Ashton @5ht0n]

@peer_rich @Adiiizi Hey Peer, I disclosed a security vulnerability in January and have not seen this acknowledged. It still affects the current version of Cal

I use the product myself and want to ensure the safety of the tool for all - I’ve tried email 3x, not sure if there’s bad filtering

[Ashton @5ht0n]

@calcom @Support Hey there, I have followed your disclosure guidelines and have not heard ack from the team since Jan 17. This post will not age well given the info I’ve provided. I want the best for Cal and team - I will stop reaching out as I feel I’ve done my best to get ahold of the team.

[Ashton @5ht0n]

@peer_rich hey peer, is security @ https://t.co/Zm0d9Bkak8 still the best point of contact for disclosures?

[Ashton @5ht0n]

bro it’s in yaml. it’s literally mirrored to toml. it’s in hcl locals for ci. it’s literally in helm. it’s probably checked by opa. dude it’s in rego. it’s written in go. you can find it in backstage. you can go to backstage and find it. log into backstage right now.

[Ashton @5ht0n]

@Laughing_Mantis Did you see any evidence of these actors installing these devices for purpose of residential proxying of traffic for other malicious actors? Been rabbitholing some of these proxy providers and what I’m still lost on is how they get the network space in the first place.

[Ashton @5ht0n]

as good as ai is getting, the nature of it being nondeterministic (even w low temp) prevents it from achieving mass applicability in a lot of areas. esp. in security, where you must validate the correct action is taken. without full autonomy (determinism) how will it flourish?

[Ashton @5ht0n]

the 16b creds are going insane on linkedin rn

people getting one-shotted by chatgpt posts about it

[Ashton @5ht0n]

Bug Bounty tip:

Sites may be doing live A/B testing in prod. This means you may receive different responses depending on the code path you’re getting served.
It’s important that even if a header/cookie/metadata isn’t injectable, you observe if you can land on ‘B’ path for vulns

[Ashton @5ht0n]

we are in the 1970s zork era of ai

[Jasmin Landry @JR0ch17]

@5ht0n created a lab to reproduce the bug I mentioned on @gregxsunday’s podcast 👏. The same bug I also mentioned on @ctbbpodcast 😃

[Ashton @5ht0n]

@gregxsunday @JR0ch17 Was able to replicate this and created a lab that mimics this behavior :)

https://t.co/NeRa30wUNg

[Ashton @5ht0n]

@LiveOverflow I tried making this argument with regards to demonstrating impact with reporting to clients and got told I was wrong because alert(1) is sufficient for client understanding lol.

[Ashton @5ht0n]

@0xTib3rius @IceSolst I think your perspective is too focused on the testing side. I appreciate the discussion though and agree with many points - ultimately I will continue to provide unambiguous PoCs paired with explanation of what can and cannot be done in client context.

[Ashton @5ht0n]

@0xTib3rius @IceSolst Where I’m trying to go with this is that it’s misrepresentative (esp for new ppl) to say if you pop an alert, you’re good! Post in the report and explain later.
Instead we should be respecting client time/$ and do just a little work to show ~something~, not even full chain

[Ashton @5ht0n]

@0xTib3rius @IceSolst The problem I have with this though is I’ve seen too many reports with a standard template “attacker can do W X Y Z as a result” but the reality is they never went further to see that W,Z is actually not possible given controls. This wastes time for everyone later. One example.