Brian Sciretti

💻 Computer Science
🌐 Wikimedian (Regional Coordinator for Lombardy in Wikimedia Italia)
📚 A passion for culture
🎥 Lingue d'Italia on YouTube

[InfoSecMap @InfoSecMap]

🚨 #GIVEAWAY ALERT 🚨

Win FREE tickets to @NoHatCon by @BITM_HACKLAB in #Bergamo – a €40 value! 🎟️

To enter:
✅ Follow us
✅ ❤️ + RT this post
✅ Optional: tag 2 friends = 1 extra entry

Ends in 7 days – winners announced next week!

#CyberSecurity #NoHatCon2025 #BITM #InfoSec

[Science&Wiki @wiki_science]

Wiki Science Competition 2023 Italian national award ceremony on March, 22nd in Bologna.

Thank you for joining us!
👉https://t.co/GFCWA9MjTx
👉https://t.co/iN0WG3svdM

Foto: CC BY-SA 4.0 Mascha2013, Elena Tartaglione 2024 Wikimedia Commons

[Mr. Rc @rcx86]

If your plan is to learn reverse engineering this year check out the resources I collected while learning RE:

https://github[dot]com/HACKE-RC/awesome-reversing

[LiveOverflow 🔴 @LiveOverflow]

Wtf that bug :D

[Brian Sciretti @BSciretti]

Today in #Berghem...

#nohat2023

[🇸🇦 Murtada Bin Abdullah (Rood) @0x_rood]

some ways to bypass 403

1- using space symbols
exmaple:
/admin -> 403
/admin%09 -> 200
/admin%20 -> 200

2- use traversal
Example:
/admin -> 403
/..;/admin -> 200

you can fuzz with traversal sometimes that's end with results

Example: /..;/FUZZ

#bugbountytips #BugBounty

[0xor0ne @0xor0ne]

Here are a few resources for getting started with Satellite hacking and CTFs

Satellite Hacking Demystified: https://t.co/Uy6d4CfGZM
Hack-a-sat writeups: https://t.co/PIkGXuAKSN
Hack-a-sat players corner: https://t.co/aQwVw117nU

#satellite #infosec

[Justin Gardner @Rhynorater]

* Check all schemes (http, https, file, ftp, gopher, etc)
Sometimes there are restrictions in-place on http that are not there in https or vice versa. See link below.
Or, if you can hit schemes like file or FTP -> local filesystem access.
https://t.co/hkuFBXHdjK

[Justin Gardner @Rhynorater]

I've made over 100k on SSRF vulnerabilities.

They aren't always as simple as pointing it at localhost or AWS Metadata service.

Here are some tricks I've picked up over the past 5 years of web app testing:

[🇸🇦 Murtada Bin Abdullah (Rood) @0x_rood]

1- Fuzz tagert

2- login/cpanel redirect me to endpoint that's display all login attempets with users IP and usernames

#bugbountytips #BugBounty

[Brian Sciretti @BSciretti]

https://t.co/uTZlAXRDsW

[LiveOverflow 🔴 @LiveOverflow]

Bug Report @TwitterSupport:
I try to close Twitter by clicking on the X button, but nothing happens. Please fix.

[ThioJoe @thiojoe]

Bruh. I literally almost just got hacked and the only thing that saved me was my paranoid-ass AppLocker settings 😳

I was in Visual Studio and installed what claimed was an "Official" OpenAI NugetPackage. Which then tried to run a Powershell script but thankfully was blocked by AppLocker because it wasn't whitelisted.

What tipped me off was after I installed the package, Visual Studio said something about an invalid character in the package name. I checked and it had weird Cyrillic characters in there.

I looked at the other packages by that account and there were a few others, all also impersonating popular apps like Xbox and Discord.

I googled "Malicious Nuget Packages" and an article came up which mentioned an "init.ps1" powershell script they download. Sure enough, I found that. But thankfully I saw that AppLocker had blocked it from running.

It would have downloaded a batch file called "Anthrax.bat" and done god knows what.

[LiveOverflow 🔴 @LiveOverflow]

I stumbled over this tweet and thought "isn't this a generic HTML sanitizer bypass?"

In todays video I share my investigation: https://t.co/W6Y5HnTz4Q

[Brian Sciretti @BSciretti]

Ho comprato una chiavetta #USB su #TEMUApp ed ecco cosa ho trovato!

https://t.co/ZnCDpAHBH6

[Brian Sciretti @BSciretti]

@phish_report è un comodo strumento che permette di segnalare siti web di phishing. Vediamo come funziona...
https://t.co/1GFAidw5Dz

[Brian Sciretti @BSciretti]

Oggi si parla di #LiceoDelMadeInItaly: ha senso e, soprattutto, si può fare nel monte ore proposto?

https://t.co/3PE6bVS0Nl

[Brian Sciretti @BSciretti]

Twitter e gli SMS: è un metodo di 2FA sicuro?
https://t.co/6tABNicZtt

[Brian Sciretti @BSciretti]

Ecco com'è stat hackerato il più antico server #Minecraft
https://t.co/lERRvfNPp8