aqas

[aqas @Aqas__]

@StarPlatinum_ This is what has been told about the security of the private keys.

However، there is many cases were the wallet generates a weak private key results the lost of all the users crypto.

[aqas @Aqas__]

@log4j Cut the NIC then connect a mini pc to HDMI and buy a mini keyboard. That's all the control you want.

I don't trust TV companies when I turn a setting off, with the next update or privacy policy they can change it anyways.

[aqas @Aqas__]

@MSNightmare2000 @amoshkov Insomni'hack is good, the CFP is closed but send you paper I guess they will take it seriously from a guy like you

[aqas @Aqas__]

@VincentBounce @gmail Google don't use cloudflare (capthca image, check "Ray-Id")

Also google don't use these url endpoints (Login image, check URL)

I think someone poison your DNS responses somehow (there is many ways to do so)

This is serious but limited to google related products.

[aqas @Aqas__]

@internetofshit @FrameworkPuter I did that before the ads things and honesty since I used the mini PC as the main media source I never looked back, you can also take it with you when you travel and that saved me many times

[aqas @Aqas__]

@internetofshit Yeah I agree, I actually unscrew the back of my TV and physically unplug the network card. I really wish if there is something like @FrameworkPuter for TVs.

Note to self: If the company makes the repair harder DONT BUY IT

[aqas @Aqas__]

@internetofshit And get a Mimi keyboard with a touch pad and torrent whatever movie you want

[aqas @Aqas__]

@internetofshit Get a mini PC and cut that crap of the Internet and don't buy a LG TV again

[aqas @Aqas__]

@0day_ninja I think you can also bypass ETWTI by calling MmCopyVirtualMemory.

[aqas @Aqas__]

@originhq I was thinking about this, nothing can stop someone from train some model and adding some features then train the model on some malicious stuff (like backdoor X) This is serious problem because there is no simple way to catch it and it can be anything. Let alone web poisoning

[aqas @Aqas__]

@Idov31 Very interesting, I'm using a some proprietary product. It's always useful to inspect ETW for weird stuff on windows

[aqas @Aqas__]

@GodfatherOrwa @0xatharv Also, use way back machine URLs to find similar file naming conventions the organization is using and try to create a custom wordlist for that. Always start by testing ffuf using the burp proxy to make sure the fuzzing is what you actually want. Mistakes happens sometimes.

[aqas @Aqas__]

@jamieantisocial People before using qemu/kvm:

[aqas @Aqas__]

@DevJehad @XQ55 Tailscale is a wiregurad tunnel manager*

استأجر لك vps و أربطه بالشركة الداخلية و جهازك الشخصي، لكن حط في بالك أن بيسبب لك مشكلة أمنية لو واحد غيرك دخل (بديهي)

لو تحتاج تدخل على service معينة بشكل مؤقت عندك ngrok خيار ممتاز

[aqas @Aqas__]

@brankopetric00 That was not clear, you can create a file that has a name for a tar argument, when you use wildcard in bash it will treat your filename as an argument for tar which can lean to remote code execution

[aqas @Aqas__]

@brankopetric00 You can create a file that is a tar argument and tar can execute arbitrary commands.

[aqas @Aqas__]

@xabdul نجح في الدخول في ٢٥ يوم

وليس ٢٥ initial access

[aqas @Aqas__]

@Officialwhyte22 The main concern is that their web exploit is working, so you should triage your servers.

They don't do anything with the downloadstring so they are trying to see the following:

- their exploit is working (prob. Web)
- they are trying to see the machine is connected (post exp.)

[aqas @Aqas__]

@ShitSecure Kudos, continue and you will find a 0 day, sometimes it's to frustrating when you get a primitive or a bug but can't be chained to be exploited.

Remember, it's a part of the vr roller coaster 🎢