Daniel Thatcher

Researcher, and security person at @intruder_io. Hack dumber. He/him

[Daniel Thatcher @_danielthatcher]

And here’s part 2, presenting new techniques for reliable, split-second DNS rebinding in Chrome and Safari https://t.co/RCcamPWi3x

[Daniel Thatcher @_danielthatcher]

Here's part 1, detailing how I hacked my company's own product using DNS rebinding:

https://t.co/cPAxwGU10O

[Daniel Thatcher @_danielthatcher]

@sudhanshur705 @strellic This can work at times, and I mention something similar in the next part (coming soon), though in most of the real-world webapps I've seen driving headless browsers there is a timeout enforced by the app which you can't lengthen this way.

[Daniel Thatcher @_danielthatcher]

Here's part 1, detailing how I hacked my company's own product using DNS rebinding:

https://t.co/cPAxwGU10O

[Daniel Thatcher @_danielthatcher]

Excited to be talking about new DNS rebinding techniques at @BlackHatEvents #BHEU next week. The research for this talk will be released in 2 parts on the @intruder_io research blog - keep an eye out for part 1 on Thursday https://t.co/70iR4T49Ar

[Daniel Thatcher @_danielthatcher]

Part 2 will be release on Wednesday, when I'm presenting the research at BHEU

[Daniel Thatcher @_danielthatcher]

@BlackHatEvents @intruder_io I've been asked to hold off on the release of the first part until tomorrow, so sorry for the false alarm!

[Daniel Thatcher @_danielthatcher]

Excited to be talking about new DNS rebinding techniques at @BlackHatEvents #BHEU next week. The research for this talk will be released in 2 parts on the @intruder_io research blog - keep an eye out for part 1 on Thursday https://t.co/70iR4T49Ar

[Daniel Thatcher @_danielthatcher]

@BlackHatEvents Whenever I try to submit my proposal, I get a 403 Forbidden. Is there anything I can do?

[Daniel Thatcher @_danielthatcher]

A while ago I decided to try take on a big challenge and work out how to detect prototype pollution black-box. One thing I’m very happy with from this research is the simplicity of the solution I found

[Intruder @intruder_io]

Prototype pollution can be a dangerous bug, but it's hard to detect in real-world scenarios without the source code. In the latest blog, our researcher, @_danielthatcher, discusses a new technique for detecting prototype pollution in black-box situations:https://t.co/sN8OIRxavn

[mopman @mopman]

Why do I know so many Dan's in infosec? Is there something about the name Dan?

I strongly advise being cautious of your data around anyone named Dan, until we work this out.

[Daniel Thatcher @_danielthatcher]

@PortSwiggerRes Thanks for sharing

[Daniel Thatcher @_danielthatcher]

The technique isn’t new, but the vast majority of pentesters I’ve spoken to don’t know about it, so I thought it worth sharing with an example from a pentest. I’ve also created a tool to help you exploit this issue https://t.co/yb1KeowbUA

[Daniel Thatcher @_danielthatcher]

As a newbie pentester I read the RFC for GUIDs out of a fear that I wasn’t testing them correctly. A few years later, it paid off.

[Intruder @intruder_io]

GUIDs are everywhere - but there are hidden dangers when using them as they're designed for their uniqueness, not their security. Find out more in the latest blog from our research team: https://t.co/tgDP4X3Ntx

#guid #vulnerabilityscanning #CyberSecMonth

[Daniel Thatcher @_danielthatcher]

I was lucky enough to catch this talk at BH, and it was one of the highlights of the conference for me. Great research, and really well presented

[Aaditya Purani @aaditya_purani]

Just finished ElectroVolt talk at #DEFCON30. Was super glad to see the entire room full. Thanks a lot for coming AND supporting! ⚡️

Hope you enjoyed the talk and can use the knowledge in your day to day work.

Feel free to check out https://t.co/LN3zuQj06s for POCs.

#DC

[Daniel Thatcher @_danielthatcher]

@notdurson Dan is also a wonderful person. It was a lot of fun. Hopefully we see each other again next year

[Daniel Thatcher @_danielthatcher]

Heading off to Vegas for the first time. If you see me about, say hi. I’m the lanky blond British guy with round black glasses.

[Daniel Thatcher @_danielthatcher]

@notdurson @BlackHatEvents Sounds good. I’ll message you

[Daniel Thatcher @_danielthatcher]

If you only need to read info rather than modify it, then the trick of loading the application in two separate iFrames works well.

@iamnoooob writes about it here: https://t.co/JNUHKSTxWb

@avlidienbrunn has a great talk on this and other tricks: https://t.co/p9GWxtZAbV

[Daniel Thatcher @_danielthatcher]

If you have stored self-XSS and login CSRF you can probably do something interesting, but you have to do slightly more than this tip says. Here's an example I put together against Moodle a few years ago: https://t.co/5j9PGAWm8d

[Intigriti @intigriti]

Found a self-XSS? 🤨 Don't worry!

Let's magically turn that into a valid XSS by sprinkling some CSRF on top of it! 🧙‍♂️

#bugbounty #bugbountytips 👇

[Daniel Thatcher @_danielthatcher]

This example works by using the self-XSS to set a session cookie with a limited path so that the self-XSS will still load when the victim logs back into their account. The self-XSS can then access the rest of the application as the victim, so is effectively regular XSS.