I managed to RCE Fortune 500 companies and made over $50,000 with this technique.
A new npm supply chain technique we just disclosed. The trick is dumb-simple.
We call it npx Confusion.
🧵
Missed the latest #TalkiePwnii? Now’s your chance 👀
@pwnwithlove breaks down a wildcard argument injection exploit on a @zerodaygym Dojo challenge - from initial discovery to full exploitation 👇
https://t.co/n1fXGPsv6a
SSRF turns a server’s own outbound requests into your weapon against its internal network 🌐
From a single callback to full cloud account takeover, the escalation path is wild when you know the tricks 🔥
Full guide on hunting SSRF 👇
https://t.co/YHoZatQ6bs
last month I reported a critical SSRF that led to JS execution in a headless Chrome ദ്ദി・ᴗ・)✧
if you're curious, I wrote a full article on @yeswehack! :p
Les inscriptions UDG#2 se terminent très prochainement, nous vous partageons le teasing des confs.
Cette fois-ci, rendez-vous dans le centre de Rennes, à 7 minutes à pied de Sainte-Anne (adresse précise communiquée lors de la réception de votre place).
> https://t.co/tEwrYvXdUg
If you haven't seen it yet, the latest #TalkiePwnii is out and @pwnwithlove shows how to abuse wildcards for argument injection on a @zerodaygym Dojo challenge 👀
Check it out 👇
https://t.co/n1fXGPsv6a
For this year’s FCSC, I’m proud to have had the opportunity to develop four web challenges:
- Shellfish Say
- FCSC Aquarium
- Secure Mood Notes (Part 1 & 2)
There are many more challenges available (created by @kevin_mizu and @BitK_), so don’t hesitate to give them a try! :)
I'm happy to release the first version of my DOMLogger++ plugin for @CaidoIO! 🔎
It improves the browser extension in several ways:
• Persistent, per-project storage
• Temporary session recording
• AI support
• Stack trace reconstitution
• ...
👉 https://t.co/tj72KXjAN9
For this year’s FCSC, I’m proud to have had the opportunity to develop four web challenges:
- Shellfish Say
- FCSC Aquarium
- Secure Mood Notes (Part 1 & 2)
There are many more challenges available (created by @kevin_mizu and @BitK_), so don’t hesitate to give them a try! :)
This year again, with @BitK_ and @_Worty, we've made the Web challenges 🚩
The CTF is solo and lasts 10 days, if you have some time, please give it a look 😁
Even if you're not doing Web challenges, there are challenges in various categories, you should find something you like!
Her first week at Lupin & Holmes ? Garance compromised an npm package with 40M weekly downloads 🔥
Depi flagged a dangerous workflow in @ img/colour. She turned Dependabot into the trigger, got the workflow to run, and reached package write access.
40M weekly downloads. Week one. Garance rocks 🤟
https://t.co/qkEiGnbPBG
Today was my last day at @Synacktiv as a pentester, I want to thank all the people I've worked with in this company, such amazing and skilled people, I will cherish those memories
I’m joining @0xLupin at Lupin&Holmes to break more stuff with some others talented people😎