Roman H.

IT-Security Consultant, #Science & #InfoSec. Ethusiast, #HTB player - Blindhero, #OSCP, #OSWE

[Roman H. @_romanh_]

(Short) Introduction to Linux Binary Execution, Assembler, Buffer Overflows and ret2libc.

German Slides: https://t.co/0H6VTLOahz

[Roman H. @_romanh_]

just realized it won't run on linux anyway, since Valorant is relying on the windows kernel for anti-cheat..

[Roman H. @_romanh_]

I love it, when websites only offer downloads according to the browser's user-agent. Accessing #Valorant's download page not from Windows? No problem!

[Roman H. @_romanh_]

@intigriti Unpack the javascript code and look for potentially hidden API endpoints

[Roman H. @_romanh_]

Is there a good reason not to restrict Host-Headers inside the webapp itself? #Nextcloud for example has a configurable whitelist called "trusted_domains". Or should the config be done by nginx/apache? Is it even a serious security risk if the header is not validated at all?

[Roman H. @_romanh_]

Do you have any recommendations when it comes to finding a name for a public project? I feel like this is always the hardest task.

[Thomas Roccia 🤘 @fr0gger_]

🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)!

I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz

[Roman H. @_romanh_]

EXP-301 course started. Planning for my OSED exam in late may.

[Roman H. @_romanh_]

@ghidraninja Internet of Shit

[Roman H. @_romanh_]

Rebooting doesn't resolve the issue. In linux I'd just check journalctl/dmesg, no idea what to do in windows - would be fun to find a 0day if I had a clue what to do

[Roman H. @_romanh_]

I got a file which is crashing explorer.exe when triggering the context menu "Open With" or opening the file properties. How would you analyze the issue further?

[Roman H. @_romanh_]

@lucky_doraco lol

[Roman H. @_romanh_]

@lucky_doraco so no penetration tweets anymore? :/

[Roman H. @_romanh_]

@sahuang97 @strellic @ppy @lucky_doraco 👀

[Roman H. @_romanh_]

@ghidraninja Interesting! What hardware and software are you using for this?

[Roman H. @_romanh_]

OOPArtDB from #HackTheBox was recently retired, an insane #WEB challenge by @strellic - learned some amazing attack techniques.

Going to present the exploitation path soon. My slides for the upcoming presentation can now be found online: https://t.co/4kmlDTg0lw

[assume_breach @assume_breach]

I wrote this to try to bring some reality to people trying to break into cyber. People will disagree with some (all) of it but hopefully somebody benefits from what I saw when I worked as a pentester.
https://t.co/LJaa7aA1Ty

[Roman H. @_romanh_]

@lucky_doraco Is that a meme I don't understand?

[Roman H. @_romanh_]

Received my SWAG-Pack from @hackthebox_eu today as a reward for the 5th place in the last season. I cannot have enough hacker hoodies!

[Roman H. @_romanh_]

@lucky_doraco since it's over now anyway, you can share it with us all