Mohamed Dief 

😁😗😎🥸🤩

[Mohamed Dief  @DemoniaSlash]

|￣￣￣￣￣￣￣￣￣￣￣|
| Stop ignoring security |
| issues because you |
| don't want to edit |
| a single line of code |
| ___ ________________|
(\__/) ||
(•ㅅ•) ||
/ 　 づ

[Mohamed Dief  @DemoniaSlash]

npm is vulnerable to RCE, even --ignore-scripts can't protect you

https://t.co/rXpJp8Ru5e

[Mohamed Dief  @DemoniaSlash]

@v12sec @THORChain Are you really surprised that a network that has been used for money laundering for years didn't pay you? I suggest you take a look at THORchain history

[0xcyborg @user_cyborg]

The golden era of the Hacktivity page on HackerOne

[Mohamed Dief  @DemoniaSlash]

I just published unstrip, A little bit more advanced tool written in rust to recover symbols, types, interfaces, and method signatures from go binaries and also allows you to re-write the entire executable to include those symbols

https://t.co/Oe3govskkQ

[Mohamed Dief  @DemoniaSlash]

@Jhaddix That's why companies are asking researchers to submit the AI prompt + model they used to find this (if they used AI),templates if they where using any automation in exchange for bonus,In this case, Since you didn't use either, your report is going directly to their internal infra

[Mohamed Dief  @DemoniaSlash]

I just hate this job so much

[ben @rap_1st]

thank you terry for the wise words

[Christopher | 🇺🇦  @d4rkshell]

Microsoft has banned Nightmare Eclipse from GitHub: https://t.co/EmeiJnJ0Ps

This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account.

They have now moved on to GitLab: https://t.co/Npj0gplSum

(h/t to: @[email protected])

[Mohamed Dief  @DemoniaSlash]

@sudosu01 @thedawgyg Hey gabriel, Are you retarded?

[Mohamed Dief  @DemoniaSlash]

@mountainaddict0 The only scenario where it's impactful is actually when a sentry API key is exposed, that would give you access to actual traces and internal information which you could never access from a sentry DSN (sentry DSN allows submitting error traces but never allows you to retrieve em)

[Mohamed Dief  @DemoniaSlash]

@mountainaddict0 Don't believe everything you read on medium, most of these guys are just faking blogs, How sentry work is that you import their SDK on the client side so the client-side errors could be reported to the DSN, it only works by the user actually sending those errors in HTTP requests

[Mohamed Dief  @DemoniaSlash]

@pdiscoveryio So we got 2 possible outcomes from this, either traige fails tragically cause AI is no where to be trusted with vulnerabilties, and the chances of it ruining the production while reproducing it is pretty much high, or it's actually a hit on PD gets aquired and goes corporate

[Alex Birsan @alxbrsn]

hey @Bugcrowd can we please make this checkbox do something thanks

[Mohamed Dief  @DemoniaSlash]

Ever since actual triagers such as antina and goldenretriver, even "still" vanished from the traiging team years ago, HackerOne started forcing those idiot traigers on us that doesn't even try to do their job, and it's impossible to communicate with them

[Mohamed Dief  @DemoniaSlash]

That's actually crazy cause that's what i've been saying for years now, HackerOne been doing this for YEARS now where traigers doesn't even bother reading the reports, But somehow you guys are only mentioning this when Loveable and CircleUp got hacked cause of them?

[Veshraj Ghimire🇳🇵 @GhimireVeshraj]

On December 11, We reported a AWS token leaked on a public repository belonging to marriot infrastructure which had SES service with verified domain of @marriot.com on December 12 @Hacker0x01 closed the report as n/a saying https://t.co/0suiUzOdqH is explicitly out of scope:

[Mohamed Dief  @DemoniaSlash]

Let's not forget the incident where a hackerone traiger stole a researsher vulnerablity and started mass reporting it to programs too, If you really think HackerOne is to be trusted for either the researcher or the company you're probably a fool or missing a chromosome

[Mohamed Dief  @DemoniaSlash]

Just released flux, YAML recon workflows with DAG support, Parsers for tools output, Local database per-project, Check it out
https://t.co/t4ULpE9AIR

[Mohamed Dief  @DemoniaSlash]

@asaio87 Also security is a service, Bug bounty is the freelancing version of it, instead of requesting an audit from a firm they publish a bug bounty program and millions of hackers send reports there and they get awarded based on the severity of their finding

[Mohamed Dief  @DemoniaSlash]

@asaio87 Well that's what they call a bug hunter, Security researcher who reports vulnerabilities in "good faith" and usually get paid for it, But this one is blackmail

[Gabriele Berton @gabriberton]

Super interesting take from one of the greatest hackers

He says Mythos is not as good as they claim, because zero-day vulnerabilities are not that hard to find for skilled hackers

I'm far from the hacking world but sounds reasonable

Any thought?