Dan Amodio

mostly I just hack stuff. 💻🔨

[Matt Austin @mattaustin]

This was a really fun exploit in Burp that @DanAmodio and I found!

[Tanner @itscachemoney]

New blog post outlining a fun phishing technique to look out for!

https://t.co/HosbhKB7WF

[Tanner @itscachemoney]

Want to be part of a great security team and do security research full-time? We've got just the role! Tinder is looking for an experienced researcher to go deep and find new bugs. Learn more about it here! https://t.co/uOD8CYMCtS

[HackerOne @Hacker0x01]

Calling all hackers! You can now find the bug of your dreams with @Tinder's #bugbounty program, which has just gone public! Check out their program page for more details: https://t.co/W8Nqqe2rCJ #happyhacking

[Dan Amodio @DanAmodio]

Forgot I pushed my AWS asset collection script a while ago. I know there are others.. no attempt to overshadow those. It can attempt to enumerate and assume role into all organization accounts to grab external facing stuff. https://t.co/Xc8yrjnCBe

[SYNTAXERROR @SYNTAXERRORBA]

"Social engineering attacks" are out of scope.

[Dan Amodio @DanAmodio]

@find_evil Without incidents, we have nothing.

[LiveOverflow 🔴 @LiveOverflow]

🤔

[ThugCrowd @thugcrowd]

Damn someone either has a jackpot Twitter vuln or played the long game with some creds.

[Dan Amodio @DanAmodio]

Change screen to 1024x768.. RPi4 no longer connects to 2G WiFi.... 5G is fine... WHAT!?

[Lares @Lares_]

We are growing again. Looking for a Sr Pentester/Red Teamer to join the team! Challenging projects and a killer team. [email protected] or DM us.

[David Lindner @golfhackerdave]

Ever wondered what it takes to build your own CTF? @clevernyyyy @DanAmodio @SaraKathrynG chatted about this in Labs Weekly #5 - https://t.co/mG3ItllliG #ctf #gamification #appsec #training #security

[Dan Amodio @DanAmodio]

Run every repo from a GitHub user through truffleHog to find leaked keys:

curl https://t.co/e8rlaMNdHE<username>/repos?per_page=1000 | jq '.[].html_url' | xargs -I{} sh -c 'echo {} && truffleHog --entropy false {}' | tee output.txt

[David Lindner @golfhackerdave]

Contrast Labs Weekly #2 talking about a few CVEs the team uncovered recently - https://t.co/E2i9gudWYR #zulip #sonatype #CVE #appsec #Security

[Dan Amodio @DanAmodio]

I think @ericsyuan response to @zoom_us security concerns is great so far. Let's not forget security is tough and evolves over time. https://t.co/mZCFU2ojZz

[Dan Amodio @DanAmodio]

Reposting my reply bc I think it was misleading. zoomAutenticationTool will run whatever script you give it, and ask you to authenticate as System. It's like they wrote their own sudo tool.. Don't think you can weaponize but weird practice.

[Felix @c1truz_]

Ever wondered how the @zoom_us macOS installer does it’s job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed).

[Dan Amodio @DanAmodio]

This is what pops up when you run the bin.

[Dan Amodio @DanAmodio]

And it does still pop up and ask you to authenticate. It’s like they wrote their own sudo tool. I don’t want people to get confused and think this is worse than it is. Just a really weird observation and questionable dev choice lol.

[Dan Amodio @DanAmodio]

Just to be clear everyone I didn’t prove this as an actual gatekeeper bypass but it’s just a really weird bad sketchy practice. Actually delivering this as malware payload would be kinda tricky. Still. It weirds me out.

[Dan Amodio @DanAmodio]

@dchest Yes I agree. it just still seems really weird their own sudo tool basically. I didn’t prove this as actual gatekeeper bypass delivery for malware would be tricky. But some OSX malware uses similar patterns.