ir2re

Security Researcher (Binary Analysis, Fuzzing, Vulnerability Research & Exploit Development)

[ir2re @_ir2re]

@hydrabus @bvernoux any idea when hydrabus v1 will be available again in stock (worldwide) at digi-key electronics or other resellers for shipping to India.

#hydrabus

[Ivan Fratric 💙💛 @ifsecure]

Hey, psst! Do you like grammar fuzzing with Domato? Jackalope now supports fuzzing with a similar (somewhat simplified) grammar syntax, except it's mutational, coverage-guided and much faster. And of course it also works with black-box binaries. More at https://t.co/pe1oYxNluf

[James Kettle @albinowax]

I'm thrilled to announce "HTTP/2: The Sequel is Always Worse" will premiere at @BlackHatEvents #BHUSA!
https://t.co/6GP5FbFYDA

[Envoy @EnvoyProxy]

Announcing Envoy v1.18.3, as well as a set of stable releases that carry CVE-2021-29492 fix. Please upgrade, especially if you use path based access control. Thanks so much to our amazing community, maintainers, users, and Yan Avlasov for shepherding.
https://t.co/GDUT1xaHI3

[Abhay Bhargav @abhaybhargav]

My colleague @vishnuprasadk46 is looking for a hospital with a brain CT scan facility and ICU, that accepts COVID patients anywhere in #bengaluru This is for his father Mr. Krishna Prasad aged 57. This is urgent. Please RT for reach

[Po @sec_po_]

I wrote an ppt about kernel vulnerability and exploitation; https://t.co/AZ3SAqiP7D Chinese version

[ohjin @pwn_expoit]

https://t.co/S7l63Axaai
i didn't know that there is a feature on GitHub like this
github + 1s = visual studio code viewer
lol

[we45 @we45]

Our biggest project ever, the AppSecEngineer training platform is officially live! Over 22 courses, 100+ hours video content & 90+ labs.

AppSec training just got real.

#appsec #training #security

[Orchestron @orchestronIO]

So you're looking to implement #appsec at scale. You've nailed the #vulnerabilitymanagement bit of the puzzle. But there's something more. @abhaybhargav lets you in on the secret ingredient in this week's #appsecbyte

[AppSecEngineer @AppSecEngineer]

Launching the #AppSecEngineer Podcast! A series of interviews with the best minds in the industry, exclusively for the #appsec nerds.

We're kicking off with this insightful chat with @DinisCruz CISO/CTO at @GlasswallCDR - https://t.co/9Q8u1u6TEA #cloudsecurity @abhaybhargav

[Qiling Framework @qiling_io]

MAJOR UPGRADE!

Finally Demigod, a kernel module(.sys .ko .kext)emulator merged into Qiling.

Qiling now able to emulate both kernel module and binary with advanced instrumentation

https://t.co/6N3hq0JiGh

Tips: dev branch

Special thanks: @unicorn_engine @tuanit96 @quangnh89

[Abhay Bhargav @abhaybhargav]

Just like with #AWS, RCE against an @Azure function can be devastating. Here, an insecure deserialization by @sharathkramadas pulls env-vars from a func with a plethora of secrets incl azure storage signed url (storage compromise), signing & encryption keys #exploit #bugbounty

[Abhay Bhargav @abhaybhargav]

We @we45 are ready to launch “Live Online Training”, #AppSecEngineer
✅Live trainings from 🏡
✅On-demand labs ⛅️ & ranges from your browser. 🚫clunky VMs
✅Access Video & Labs AFTER training 🤯
✅Certification 📜
Select training and dates of choice & go! https://t.co/ELUugjiC8J

[ir2re @_ir2re]

Special thanks to @_xpn_ , @RpcView and @tiraniddo for sharing their research work on RPC. Learned a lot, even i build my small tool on top of #Frida for RPC vulnerability research.

https://t.co/VfyafOQYzz
https://t.co/eJamF3CUoh
https://t.co/MrCSZXIjM5

[ir2re @_ir2re]

Recently I spend more time on RPC and Chrome IPC research. Learned a lot. From the research, found multiple vulnerability in Avast Antivirus @avast_antivirus
on RPC service. Here is the CVE information published in Github.

#CVE-Info: https://t.co/7uVUnD8d4D

[ir2re @_ir2re]

CVE-2020-10860 (DOS), CVE-2020-10861, CVE-2020-10862 (LPE), CVE-2020-10863, CVE-2020-10864, CVE-2020-10865, CVE-2020-10866, CVE-2020-10867, CVE-2020-10868. All bugs are fixed two month back (https://t.co/EHC5dm1RS8)

Demo: https://t.co/Fpwpj5IRP8

#IDA
#Avast_Antivirus
#DOS
#LPE

[RuhrSec – IT Security Conference @ruhrsec]

Good news in the morning: @ibags from the @ethereum security team will give his talk "Fuzzing the Solidity Compiler" at #RuhrSec 2020.

[Jan Newger @ObfuscaTHOR]

Google internal TCMalloc is now on GitHub
https://t.co/YqwBUxk5Cm

[Andrea Fioraldi @andreafioraldi]

The AFL++ website is up: https://t.co/x0KNYd0mxZ
Very naive ATM, I'm open to suggestions.

[Walied Assar @waleedassar]

Windows Kernel _IMAGE_DOS_HEADER::e_lfanew Denial Of Service/Memory Corruption
https://t.co/niSPoYQd4y