chebuya

c2 enjoyer

[chebuya @_chebuya]

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers.

Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors

Writeup and PoC in replies

[chebuya @_chebuya]

Found a medium severity path traversal in Velociraptor (CVE-2025-14728). Will have funny/embarrassing story about it soon.

Shoutout to Mike Cohen of Rapid7/Velocidex for building such an awesome tool and swiftly triaging the vuln/severity upon report

[CVE @CVEnew]

CVE-2025-14728 Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside t… https://t.co/7LRY9OFSU3

[chebuya @_chebuya]

Also, big thanks to @ACEResponder for their work on RogueSliver - it was massively helpful while writing the PoC. Do check it out:

https://t.co/U52p8Exi40

[chebuya @_chebuya]

Found an SSRF in Sliver C2 (CVE-2025-27090), allowing an attacker to read and write TCP traffic through affected teamservers.

Demo shows leaking the IP of a Sliver teamserver hidden behind redirectors

Writeup and PoC in replies

[chebuya @_chebuya]

PoC: https://t.co/HYgMuUvJpp

[chebuya @_chebuya]

@vxunderground smelly let me talk about phishing minecraft players and c2 agent authentication

[chebuya @_chebuya]

@Print3M_ all roads lead to .dll

[chebuya @_chebuya]

@sammwy @vxunderground to be declared gigachad

[chebuya @_chebuya]

@vxunderground enjoy :3

[vx-underground @vxunderground]

vx-underground Black Mass Research Group presents: Minegrief.

tl;dr a computer worm that targets minecraft

https://t.co/2tQBlNWBFL

[chebuya @_chebuya]

@cyberspacerr @vxunderground Scraped from shodan/censys

[chebuya @_chebuya]

I have hereby been declared GIGACHAD for the Minecraft malware I wrote for the @vxunderground JVM malware competition 🥰🥰

Do check out the Black Mass Research Group telegram as well!
https://t.co/Kasfvj5kBo

[b0t 👽🏴‍☠️ @bot59751939]

This is the contest winner :)
Ships with a 0day for Crafty controller. Huge thanks to @_chebuya.
Today I'm announcing Black Mass Research Group. Our goal is to make interesting malware for public study. Please enjoy our first project!
https://t.co/gCptZ2Zhy1

[b0t 👽🏴‍☠️ @bot59751939]

This is the contest winner :)
Ships with a 0day for Crafty controller. Huge thanks to @_chebuya.
Today I'm announcing Black Mass Research Group. Our goal is to make interesting malware for public study. Please enjoy our first project!
https://t.co/gCptZ2Zhy1

[Jake Williams @MalwareJake]

Yo, Microsoft, we need to talk. This is Notepad. Literally nobody asked for this...

[chebuya @_chebuya]

@vxunderground @ESET

[Clint Gibler @clintgibler]

🛠️ Sastsweep

A tool designed for identifying vulnerabilities in open source codebases at scale

It can gather and filter on key repo metrics such as popularity and project size, enabling targeted vulnerability research

It automatically detects potential vulnerabilities using @Semgrep

By @_chebuya

https://t.co/DJeE8SxpUC

[Clint Gibler @clintgibler]

📚 tl;dr sec 255

🤖 @ProjectZeroBugs AI finds bug in SQLite
☁️ New OSS: CloudTail, SkyScalpel @permisosecurity
🛣️ Auto-generate Terraform Secure Guardrails
📺 @SANSInstitute CloudSecNext Summit 2024 videos
🇨🇳 The TTPs Used to Neutralize China-Based Threats @SophosXOps
📊 Safer SCPs: Real-Time SCP Error Monitor @matthewdfuller
🛠️ sastsweep @_chebuya

and more!

https://t.co/MEArjwTjAQ

[chebuya @_chebuya]

@lastweekinfosec @MDSecLabs woah I know that person! 😹

[Last Week in Security (LWiS) @lastweekinfosec]

WAF bypasses (@MDSecLabs), sastsweep (@_chebuya), and more! https://t.co/TLUXdjKxzo

[chebuya @_chebuya]

Here is running SASTsweep against HackerOne open source targets

It lets you open the semgrep finding in an HTML report, and from there you can open the affected section of code within GitHub/Github1s for further analysis

Tool: https://t.co/nIGYDImQJv

[chebuya @_chebuya]

SASTsweep is now open source. Happy hunting!

https://t.co/nIGYDImQJv