Rambo

OSCP, CRTE, Hacker, Researcher, Speaker

[Rambo @R44MB00]

Real interesting stuff.
"When everything you can want to know about a program’s behaviour can be found by RE, then source code for software becomes more like blueprints for a building: a record at best of what was intended or specified, but not necessarily of what got built."

[Tom Hegel @TomHegel]

The Notepad++ CN APT incident - Quick reference to help keep up:

1. Incident overview: (https://t.co/tprANRsJHR)

2. @rapid7 MDR Analysis with IOCs: (https://t.co/vviivevHl2)

3. @ValidinLLC Infrastructure Analysis w/ new IOCs/pivot methods: (https://t.co/7nwFq0xIAY)

...

[MalDev Academy @MalDevAcademy]

As promised, today we released DumpBrowserSecrets a tool which extracts passwords, tokens, cookies and other data from several browsers.

https://t.co/EaswGdihdU

[Rambo @R44MB00]

Had such a great time speaking at BSides Toronto! @BSidesTO thank you for having me and everyone for attending.
Slides and video to be available soon.
#hacktheplanet #malware #opensource

[Rambo @R44MB00]

One of our latest finds while combing through open source packages.
#npm #malware #hacktheplanet

[Ax Sharma @Ax_Sharma]

Security researcher Juan Aguirre aka @R44MB00 analyses #npm package 'distube-config' caught dropping Windows info-stealing malware under the guise of 'UnityLibraryManager.exe' 🎭
https://t.co/SY0q37Y5OB #opensource

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Dumbest AMSI bypass I know so far, but it works: sideloading a fake amsi.dll to a copied version of powershell which simply return S_OK / AMSI_RESULT_CLEAN for every command. I would have thought that there was some kind of signature check upon loading amsi.dll but apparently not

[Rambo @R44MB00]

The burnout is real! 🥴🔥🔥🥴
Friendly reminder to do something for yourself today.

[Sonatype @sonatype]

.@Sonatype's Juan Aguirre (@R44MB00) gets back to the basics on how to research and identify threats. ⏪

Juan dives into the waters 🌊 of malware analysis and provides best practices for analyzing Python malware 🐍 https://t.co/aeuF441Ckg

[vx-underground @vxunderground]

Surprise! Another ChatGPT tweet! Except this time it is people making ChatGPT punch itself in the face

*Images via @Kevin2600

[MalwareHunterTeam @malwrhunterteam]

Very legit IP address, right?
😂

[Orange Tsai 🍊 @orange_8361]

🔥 https://t.co/Vr6fnRUJ35

[PT SWARM @ptswarm]

🔥 A tip for getting RCE in Jetty apps with just one XML file!

[Rambo @R44MB00]

I would love to see more of this and also personally work more on it.

[Haifei Li @HaifeiLi]

Personally, I'd prefer to see the community pay more attentions on novel attack surface/vector research rather than particular bugs. Attack surface/vector research is the real work, bugs are just expected results. :)

[Ax Sharma @Ax_Sharma]

LockBit ransomware has published a new page on its data leak website today, saying that the 356,841 files they allegedly stole from Mandiant will be leaked online. - @serghei
https://t.co/lHCfuQqwrs

[Rambo @R44MB00]

I wonder what the password is? #airport #opsec #hacktheplanet #vivaair

[shubs @infosec_au]

A few months ago, I collaborated with @HusseiN98D to find critical vulnerabilities in a bank. It involved finding a 0day in dotCMS. You can read about the discovery and exploitation process here: https://t.co/prFg60QieF

[Corben Leo @hacker_]

Authorization.

Easy to understand. Critical if implemented incorrectly.

Want to see an example? (dumb question Corben, yes, why not)

Last month, I found an auth bypass that lead to a full account takeover.

Here's how I found it:

[The Bug Bounty Hunter @tbbhunter]

Exploiting remote code execution within VirusTotal platform in order to gain access to its various scans capabilities.

https://t.co/t906Z0d9CY

[Ax Sharma @Ax_Sharma]

For anyone puzzled by strange stuff on NPM lately 🤔

Random #opensource packages, each with HUNDREDS OF 'security placeholder' versions but no malicious code are being published daily.

cc @R44MB00

[Rambo @R44MB00]

@mcipekci @SynackRedTeam 393 bugs ~ 300k
82 bugs ~ 200k
Now that's growth and improvement!
Looks like a lot of effort and time put in to the example sqli , but a clear reward can be seen in the numbers. Awesome stuff!

[Maddie Stone @maddiestone]

Today we're sharing our Year in Review of 0-days exploited in-the-wild in 2021. Here's our takeaways from this record breaking year.
https://t.co/2gDQxDwVkm