r3s1n

ethical hacker, student, coder. working on many projects i’ll never finish. my kung fu is stronger than yours

[r3s1n @ResinSec]

Do you remember when you joined X? I do! #MyXAnniversary

[r3s1n @ResinSec]

Working on researching AD/windows exploitation. Lots of things to learn!

[Flipper Devices @flipper_net]

Amazing story🥲:
A guy from our Discord found a poor cat in the garden. The cat had an animal RFID tag implant (FDX-B 134kHz), so he scanned it with Flipper, found the cat's owner via the local animal ID database, and they were reunited Turned out that 🐈 was missing for 2 years!

[r3s1n @ResinSec]

Do you remember when you joined Twitter? I do! #MyTwitterAnniversary

[Nihad @navilla_eth]

How bypass HTML to Reflected XSS

I using KNOXSS payload to bypass it

KNOXSS Payload👇👇

"--!><Svg/Onload=confirm`cookie`>"

[Ilios Labs @IliosLabs]

After 6 months of hard work... Monad is finally going to be launched in its open beta phase!!!
It will be available at **https://t.co/xIih9yl4f0**.

Twitter: https://t.co/qa1t4Ui4vc
ProductHunt: https://t.co/Sgd3ftPgrf
Discord: https://t.co/HP8APzRcQv
#Monad #launchday

[Brandon Rossi @0xConda]

Here's a mind map I made to help you with Linux privilege escalation

[David Colombo @cyber_colombo]

So, I now have full remote control of over 20 Tesla’s in 10 countries and there seems to be no way to find the owners and report it to them…

[Ilios Labs @IliosLabs]

Monad is on ProductHunt! Check it out at https://t.co/bpjvD3OoPI and make sure to upvote + share the link so we can get a great launch on the 23rd!

[r3s1n @ResinSec]

Just wanted to let you all know, @IliosLabs is working on a new project called Monad, which lets you share your own code snippets with a really intuitive tagging system. I'd definitely suggest checking them out when it releases! #infosec #bugbountytips

[Ilios Labs @IliosLabs]

Shoutout to @ResinSec for hacking Monad and alerting us to many vulnerabilities!

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

Nginx Path Traversal @403Timeout
httpx -l url.txt -path "///////../../../../../../etc/passwd" -status-code -mc 200 -ms 'root:'
#bugbountytips #infosec

[The Tor Project @torproject]

Privacy is a human right.

[Roberto Nunes @0x_Akoko]

If the main endpoint is forbidden we can also check for the backup file.

/blog/wp-config.php => 403 Forbidden
/blog/wp-config.php.bkp => 200 OK

#bugbountytips #bugbounty #infosec

[mr.d0x @mrd0x]

Bypass Defender AV static detection:

If you name a malicious file DumpStack.log Defender doesn't scan it.

[Youstin @iustinBB]

Cache Poisoning at Scale:
Identifying and Exploiting over 70 Cache Poisoning Vulnerabilities

https://t.co/cjkx8zsqb2

[r3s1n @ResinSec]

@rootxyash Biggest security risk to most WordPress sites is plugins/themes. Fingerprint the versions being used and try to see if a CVE exists. If so, how easy would it be to make a PoC? Is there an existing exploit on github/exploit-db?

[r3s1n @ResinSec]

@rootxyash Most of the time SSRF via xmlrpc.php will be closed as N/A or informational. Usually cited on the basis that HTTP and DNS requests aren't valid vulnerabilities unless you could exfiltrate information, which you can't do here

[Prof. Feynman @ProfFeynman]

You are under no obligation to remain the same person you were a year ago, a month ago, or even a day ago. You are here to create yourself, continuously.