Asish

[Nicolas Krassas @Dinosn]

LSASS dumping in 2021/2022 - from memory - without C2 https://t.co/ghtW4dl3yv

[Riyaz Walikar @riyazwalikar]

Published a short blogpost about how the introduction of #IMDSv2 affects #SSRF attempts on #AWS #EC2 instances, especially when attempting to retrieve #metadata information.

https://t.co/5xrR7MOtgO

#reInvent2019 #cloudsecurity #owasp

cc: @appseccouk

[Francesco Soncina @phraaaaaaa]

CVE-2019-10392 — Yet Another 2k19 Authenticated Remote Command Execution in Jenkins

read the blog post @ https://t.co/2IT8a7AVod

/cc @jenkinsci @TheHackersNews

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

Here we go! Chaining a Stored XSS and a SQL Injection to compromise an Uber Wordpress.

Bonus point: I've used a quiz 🙃 (and both are still 0-days)

https://t.co/ty8bQsNZPj #BugBounty #togetherwehitharder #h14420

[RIVER @wugeej]

The Universal SSL pinning bypass for Android applications

//frida -U -f <your_application_package_name> -l <path_to_fridascript.js_on_your_computer> --no-paus
frida -U -f https://t.co/kShRHxllVq -l D:\frida\fridascript.js --no-paus

https://t.co/thHpGaOU7M

[Ed @EdOverflow]

I want to give another shout-out to @streaak for his amazing work on https://t.co/UPUP51Au5I. This is an excellent reference for anyone that wants to determine the security implications of a publicly-disclosed API key.

[Yassine Aboukir 🐐 @Yassineaboukir]

A handy and well-polished tool to enumerate permissions associated with AWS credentials you may have stumbled upon in the wild. It looks like it's released as part of a research that will be presented at BH this summer.
https://t.co/a7GXAkCD4p

[__SamBeckS__ @__SamBeckS__]

Looking for new way to exploit Tomcat Host-Manager ?
https://t.co/Fy8rYUKaqj

[Yanick Fratantonio (@[email protected]) @reyammer]

I'm releasing all the slides (~800!) of my Mobile Security class: https://t.co/TAAnBMCBqB! They are not perfect, but students learned how to reverse apps, find&exploit real-world bugs, reason about threat modelling / system security, etc. Very proud of them :-) 👶 => 👨‍💻👩‍💻

[Dinesh Shetty @Din3zh]

Want to learn how to use Frida Without Jailbreak on devices running Latest iOS 12.4? Take a look at https://t.co/QT6VSRHZwQ #iOS #MobileSecurity #iOSsecurity #Frida #Jailbreak #JailbreakiOS12

[Orange Tsai 🍊 @orange_8361]

Here is the whole exploit chain of Jenkins Unauthenticated RCE(and PoC video https://t.co/4ZW2AIrWGU)!
Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!

https://t.co/fqk8I7RWuO

[Ronnie Flathers @ropnop]

Love Impacket? Ever land on a box and wanna run it, but either don't have Python2 installed or don't want to install new dependencies? I wrote a pipeline to statically build all the examples to Windows and Linux x64 binaries. Hope it helps! https://t.co/f4svA6uSlO

[Paul Seekamp @nullenc0de]

Most common ways to compromise Domain Admin accounts

https://t.co/UuDiFY8Umt

[Orange Tsai 🍊 @orange_8361]

Hacking Jenkins Part 1 - Play with Dynamic Routing!
The part 2 is an interesting RCE, and will be published in February :P
https://t.co/LA1SrwXZCG

[Mobile Security @mobilesecurity_]

Frida Hooking Android
#MobileSecurity #AndroidSecurity @fridadotre by @11x256
Part 1: https://t.co/rsPTuWjIRU
Part 2: https://t.co/ELdhj8KeKF
Part 3: https://t.co/xyXoOgOCF6
Part 4: https://t.co/XuNcnffvRc
Part 5: https://t.co/oujNguHL9j

[Pedro Ribeiro @pedrib1337]

Unauth RCE as root in Cisco Prime Infrastructure... widely used for data center management. Quick n' easy vuln: https://t.co/qD7CRuoFKp

[n00py @n00py1]

Fun fact: if you ever get into a Splunk web console (as admin), you can shell it too.

https://t.co/MfiDWmGGKe

[Scott Sutherland @_nullbind]

[BLOG] Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
https://t.co/PSpPnZSEX4
Thanks @kfosaaen, super handy!

[hashcat @hashcat]

We've developed a new attack on WPA/WPA2. There's no more complete 4-way handshake recording required. Here's all details and tools you need: https://t.co/3f5eDXJLAe