Effrite - CyberDjinn

Internet Security addict

[Effrite - CyberDjinn @_effrite]

@_barbhack_ @touloncongres @_Ionniz_ @yop_solo Well done, see you there !

[Alex Xu @alexxubyte]

Popular interview question: how to diagnose a mysterious process that’s taking too much CPU, memory, IO, etc?

The diagram below illustrates helpful tools in a Linux system.

🔹‘vmstat’ - reports information about processes, memory, paging, block IO, traps, and CPU activity.

[Yanir Tsarimi @Yanir_]

I found a vulnerability in #Azure allowing me to access Azure accounts of companies worth billions

We all know vulnerabilities exist. This isn't an injection, XSS, or RCE.

But the crazy thing about it?
It took 2 hours to discover. 🤯

Here's the story of #AutoWarp👇 (1/10)

[YesWeHack ⠵ @yeswehack]

Are you available for #BlackHatEurope in London next week and eager to attend @BitK_ Arsenal session?

We have 2 tickets to give away. To win one: follow us, retweet this before 05/11, 4pm CET, and cross your fingers 🤞

#YesWeRHackers #SharingIsCaring

https://t.co/uVEh5igiiP

[Nuclei by ProjectDiscovery @pdnuclei]

Apache <= 2.4.48 - Mod_Proxy SSRF (CVE-2021-40438)

Nuclei Template - https://t.co/vbQANmrdI0

Reference - https://t.co/rliMLU9DDg

#apache #cve #ssrf #bugbounty #pentest #appsec

[CySuite @CySuite_]

Yet another Account Takeover technique.

Seperator:
[email protected],[email protected]
[email protected]%[email protected]
[email protected]|[email protected]

Array:
{"email":["[email protected]","[email protected]"]}

Follow for more #infosec updates and #bugbountytips

[Ahmed Sultan 🇪🇬🇵🇸 @0x4148]

Just created a working POC for CVE-2021-40444 with folks @EG_CERT

[Nicolas Grégoire @Agarri_FR]

Fiche anti #FUD par @nono2357 👍 https://t.co/wol9OlcXCG

[Sogeti France @sogeti_fr]

Nos experts #cyber @podalirius_ et @_nwodtuhs vous proposent aujourd’hui un nouvel outil #pentest qui a pour objectif d’extraire les mots de passes stockés dans les préférences de stratégie de groupe (#GPP) sous #Windows.
+ d’informations ⬇️ https://t.co/BNf4FRNbWp

[shubs @infosec_au]

My colleague @seanyeoh wrote up his security research on H2C smuggling and the various cloud providers he successfully exploited (Cloudflare, Azure). He also released a tool called h2csmuggler! Check it out at https://t.co/C4QTDcI7JH

[Intigriti @intigriti]

First one to misspell 'Intigriti' in the comments will get blocked 👇

[publiclyDisclosed @disclosedh1]

Grammarly disclosed a bug submitted by fransrosen: https://t.co/Rl4xeSJEK5 - Bounty: $3,000 #hackerone #bugbounty

[Sam Curry @samwcyo]

New writeup:

"We Hacked Apple for 3 Months: Here’s What We Found"

Featuring...
@bbuerhaus, @NahamSec, @erbbysam, and @_StaticFlow_

https://t.co/XE757tadE9

[David Stotijn @dstotijn]

I released v0.1 of Hetty tonight! 🐣 Building an open source alternative to Burp Suite Pro. I’d love to know what features infosec peeps use the most. @InsiderPhD @AlMadjus @ngalongc @_tomsteele @TomNomNom can you recommend some maybe? https://t.co/sHmQC1aAfx

[Orange Tsai 🍊 @orange_8361]

An RCE blog is scheduled and will be published soon :P

[Binni Shah @binitamshah]

Ciphey : Automatically decode encryptions without a key, decode encodings, and crack hashes : https://t.co/xKiugeUE3X credits @brandon_skerrit

[chivato @SecGus]

Calling eval without "eval" or "import" amongst others:

__builtins__.__dict__['\x65\x76\x61\x6C']("\x5F\x5F\x69\x6D\x70\x6F\x72\x74\x5F\x5F\x28\x22\x6F\x73\x22\x29\x2E\x73\x79\x73\x74\x65\x6D\x28\x22" + "COMMAND" + "\x22\x29")

[@[email protected] @SecurityMB]

This release also fixes a bypass if somebody does DOMPurify.sanitize(html).toLowerCase(). Check this example: https://t.co/xLJA8SGvne

Hint: in blocKquote - K = U+212A (KELVIN SIGN) which is lowercased to ASCII "k".