Aman Sachdev

I make code, I break code, I make code that breaks code and I break code that makes code. #hacker #coder #infosecTrainer #redTeamer

[Aman Sachdev @admin_login]

Had a great talk on #redteam yesterday. A new experience talking to our own selves but as per the discord reviews, people loved it :)
Its still live on youtube (not for long) if you want to have a look at.
Thanks @hackinthebox for the platform as always.
https://t.co/dUvWuooy3W

[hextree.io @hextreeio]

Last year, @Raspberry_Pi hired us to test the security of the RP2350 - and using electro-magnetic fault-injection we were able to successfully bypass the OTP security measures!

This allowed us to read and modify the OTP locks, essentially bypassing the RP2350 secure-boot.

[Aman Sachdev @admin_login]

Great work Harry🔥

[Harpreet Singh @TheCyb3rAlpha]

🚀 Launching #BobTheSmuggler! Transforming payload delivery with HTML Smuggling. 🌐💥

✨ Features:
Embeds 7z/zip in PNG/GIF
Compresses & XOR encrypts binaries
Ideal for payload delivery

🔗 [GitHub Link: https://t.co/FYXQmcynYF]
#RedTeam #CyberSecurity

[Aman Sachdev @admin_login]

Woot woot🔥🔥

[ISRO @isro]

Chandrayaan-3 Mission:
'India🇮🇳,
I reached my destination
and you too!'
: Chandrayaan-3

Chandrayaan-3 has successfully
soft-landed on the moon 🌖!.

Congratulations, India🇮🇳!

#Chandrayaan_3
#Ch3

[an0n @an0n_r0]

Just recreated this awesome @SpecterOps (@zyn3rgy, @0xthirteen) technique for initial access by #backdooring a random #ClickOnce application with a Cobalt Strike stager. While I became a ClickOnce addict🙃, compiled a short writeup about my journey: https://t.co/nOerSwV8r1

[arxenix @ankursundara]

finally wrote a new blog post, hopefully there's some interesting info https://t.co/y5dr0Nn2Kj

[Patrick Wardle @patrickwardle]

RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️

One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"

...let's dive in! 1/n 🧵

[an0n @an0n_r0]

Played with Outlook CVE-2023-23397. Made a simple PoC email builder & sender featuring malicious reminder (just a Msg, no need to use a Task or Cal. Ev.).

Critical 0-click account takeover on internal networks even after MS patch, no need to open the message on the victim side.

[samczsun @samczsun]

Five hours ago, an attacker stole 2 million BNB (~$566M USD) from the Binance Bridge. During that time, I've been working closely with multiple parties to triage and resolve this issue. Here's how it all went down.

[Aman Sachdev @admin_login]

Thanks @THREAT_CON for inviting us. We had a wonderful time :)

#securityconference #threatcon #nepal #kathmandu #cybersecurity

[Kuba Gretzky @mrgretzky]

Huge kudos to Dylan Evans! This is absoluetely amazing to see that someone took time and effort to pull this off! 🔥 https://t.co/50HQOOlOql

[Aman Sachdev @admin_login]

Who is this exceptional dev @Airbnb who doest swear in test inputs😂

Or someone about to get a bounty🙃

[Electrovolt Security @ElectrovoltSec]

Remote Code Execution in Discord Desktop app

https://t.co/AsDp0IUykv

Bounty: $5,000

#BHUSA #DC30 #DEFCON

[Aman Sachdev @admin_login]

The greatest there was, the greatest threre is, the greatest there ever will be. HALA MADRIIIIIIIIID!!!!!!

[an0n @an0n_r0]

CVE-2022-26923 ("Certifried") combined with KrbRelayUp: domain user to domain admin without the requirement for adding/owning previously a computer account. Step-by-step write-up of the attack in a pure Windows environment: https://t.co/0Vnp4NpTEo

[Aman Sachdev @admin_login]

@r4j47 @airtelindia Wait till you see other "similar" apps uploading your sms dump that too over http all in the name of auto KYC

[Aman Sachdev @admin_login]

@Parth_Malhotra @Hacker0x01 🔥🔥

[Objective-See Foundation @objective_see]

⚠️ In macOS 12 (beta 6), Apple patched an intriguing flaw. Discovered by Gordon Long (@ethicalhax), CVE-2021-30853 allowed attackers to bypass:

▫️Gatekeeper
▫️Notarization
▫️File Quarantine

Interested in exactly how?

Read: "Where's the Interpreter!?"
https://t.co/N3aZhkSW0L

[Aman Sachdev @admin_login]

@zapstiko @0xmahmoudJo0 @shodanhq That sqli payload is incorrect. It will throw an erro. (given that one still finds this in reality on a paid target) Should be:
admin' or 1=1--
Or
admin' or '1'='1

[Aman Sachdev @admin_login]

@offsectraining Try harder... bitch...

[Aman Sachdev @admin_login]

@code_w_coffee @offsectraining @0xTib3rius 🔥🔥