LaCaraB

Focused on Identity federation, API and automations.
Working @workato. Ex-onelogin

[Massimo Bonanni @massimobonanni]

Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, we'll shed light on how
https://t.co/oKrbfVQhEn

[LaCaraB @LaCaraB]

@QU35T_TV Now better update to 1.18.0

[LaCaraB @LaCaraB]

@LorettaKrypto F756gAVcEDWkfaFkKhHVZ1Ae8WNMS2WJGQa7cEggS6pW

[LaCaraB @LaCaraB]

Interesting service @loopfans and #web3musicawards I will give a check https://t.co/6NjqunpOOm

[LaCaraB @LaCaraB]

If you use ruby-saml or omniauth-saml, make sure you upgrade to the latest version of ruby-saml.
https://t.co/b3DmllEoTn

[LaCaraB @LaCaraB]

@filip_lynn @iUW_wav @Spotify @SpotifyUSA @SpotifyUK @SoundCloud @filip_lynn let me know what do you think:
https://t.co/kh84iaSnao

share a comment on the track, thanks

[LaCaraB @LaCaraB]

Tomorrow I will describe why is a bad idea to store passwords in plain-text aka Golden PW DB Attack🤣

[LaCaraB @LaCaraB]

It makes me really sad each time I read about the Golder SAML / Silver SAML attack techniques from people/companies working in the "cybersecurity" area.

Let me explain why ⬇️⬇️⬇️

#saml #cybersecurity

[LaCaraB @LaCaraB]

If you manage to deceive the app's administrator and the public key start to be trusted by the app, you will now be able to enter the app by generating SAML messages and signing them with the related private key you possess.

[LaCaraB @LaCaraB]

@Haitianpapiiiii @JamesHYPE I know that feeling..

[LaCaraB @LaCaraB]

@Jaimefdez735 @JamesHYPE Pues ya tuvo que liarla en Amsterdam...pq el sonido de la B3 del Viernes...en Pandora hubiera estado mejor, por no hablar del calor que pasamos.

[LaCaraB @LaCaraB]

@rooyvargasm Claro que los lleva...fijate bien.

[LaCaraB @LaCaraB]

@Dividivan

[LaCaraB @LaCaraB]

@Emi_Rock75 @bernar_sf Los Arcos - McDonalds
Reina Mercedes - Royal Mail
Los Pajaritos - Twitter / Netsle
Tres mil viviendas - Mil anuncios
Vacie / Solvia (con la a de vacie negra)

[LaCaraB @LaCaraB]

@Emi_Rock75 @bernar_sf @bernar_sf
Porvenir - Polo Ralph Lauren
La Palmera - Malibu drinks
Pino Montano - Four Seasons/Timberland
Ciudad Jardin - Herbalife
Rochelambert - Roche

[LaCaraB @LaCaraB]

@bernar_sf @Atlaant O aunque esté en el este, la del "Lejano oeste"

[LaCaraB @LaCaraB]

@bernar_sf @Atlaant A Sevilla Este le pondria alguno de estos:

[LaCaraB @LaCaraB]

@bernar_sf @Atlaant O El de la conferecia Este de la NBA