Andrea Santese

Red Team Operator | OSCE | OSCP | OSWP

[Andrea Santese @Medu554]

@pfiatde Not so different from what already published 6 months ago!
https://t.co/mfviyjTOZP

[Andrea Santese @Medu554]

@ihackbanme I don't think it's a new account takeover. This is exactly what we did 5 years ago.
https://t.co/b5THcKfIlv

[Andrea Santese @Medu554]

After a bit of research it came out that it's possible to leverage Teams functionalities for a better phishing scenario. The idea is using it as an alternative way of initial access. Hope it can help some red team guys out there!
https://t.co/PrUQwDNHsW

[Andrea Santese @Medu554]

@ivane7227 @mrd0x Well done Ivan, to you and to the other guys you work with at Universita del Salento. I've always said that "Nui simu li meju" 💪

[Pedro Ribeiro @pedrib1337]

If anyone ever tells you XSS is lame and not a serious vulnerability, show them this video!

https://t.co/wUvP1cOLGD

[straightblast @straight_blast]

Here is my RCE exploit code and writeup for (CVE-2021-21974) VMware ESXi OpenSLP heap-overflow discovered by @_wmliang_. Thank you again for your write-up.
[PoC] https://t.co/MCf3TV6IjH
[writeup] https://t.co/LoKlsYVyAJ

[Axel Souchet @0vercl0k]

I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥

[publiclyDisclosed @disclosedh1]

GitLab disclosed a bug submitted by @wcbowling: https://t.co/AT5tpl2rqG - Bounty: $20,000 #hackerone #bugbounty

[Alejandro G. @lockedbyte]

I developed a Remote Code Execution PoC exploit for the Exim Use-After-Free that was recently disclosed (as part of @qualys 21Nails advisory). Tested just on Exim 4.92. PoC available: https://t.co/Su55rIZpgj

[John Doe @mitohormesis]

Just published a remote shellcode loader I've been working on to show why we shouldn't rely solely on real-time injection alerting. Writeup in a few days :)
My C sucks so it's a "PoC".
https://t.co/JVr4aRNhtz

[Clément Labro @itm4n]

After several weeks of work, it's finally there!🔥

Introducing PPLdump, a tool for dumping PPL processes with a Userland exploit!😈

👉Post 1: https://t.co/r51JDfwtAw
👉Post 2: https://t.co/FUCjMVnPW6
👉Tool: https://t.co/5TJsxKxMMT

Credit goes to @tiraniddo for the technique.

[Mikko Kenttälä @Turmio_]

I found a zero click vulnerability in Apple Mail. Here are the details and story behind it: https://t.co/GVuRhUC3wh #infosec #vulnerability #apple

[d3fp4r4m @defparam]

Hey all! first blog post. Are the popular fuzzers just for binary exploitation? In this blog post I outline how you can find logic issues in web-related regular expressions using differential fuzzing. (spoiler: 29 lines of python using Google Atheris)
https://t.co/f4QBztaro0

[raptor @0xdea]

High-level approaches for finding vulnerabilities < a very well written vulnerability research primer written by @jackson_t in 2017 (but still 100% relevant today)

https://t.co/dVH9bP3IRq

[chompie @chompie1337]

My first ever blog post: Anatomy of an Exploit: RCE CVE-2020-1350 #SIGRed. RCE PoC included, for research purposes. This was my first userland Windows heap exploit and I hope a deep dive into the process will help others. Patch or apply the workaround. https://t.co/CFRTs7Wdvs

[Orange Tsai 🍊 @orange_8361]

A short post to address an exploit chain I did in last year. Both slides and YouTube video are online now - A Journey Combining Web Hacking and Binary Exploitation in Real World! https://t.co/zuM3y93wQC

[ghost @shoebpatel_]

Just Published a write-up.

"The Secret Parameter, LFR, and Potential RCE in NodeJS Apps"

https://t.co/Hoh6tmw1It

#bugbountytip #BugBounty #NodeJS #ctf

[PortSwigger Research @PortSwiggerRes]

Portable Data exFiltration: XSS for PDFs by @garethheyes #BHEU

https://t.co/PxxP9yFdX5

[Jun Kokatsu @shhnjk]

If anyone needs a referrer spoof in a GET request :)
https://t.co/oqd9CTP9z7