Adam Willard

Penetration Testing and Web Application Security

[Adam Willard @asw_sec]

Getting ready for day four of @CCMFLive F stage 4 cancer, I beat you for now. @PostMalone I am ready! Going to be a great day.

[Adam Willard @asw_sec]

@LOCASHmusic snagged this the other night at CCMF. Been a hell of a year and a half battling stage 4 cancer, but I beat it so far and living my best life. I made sure I could make CCMF this year after missing out on everything last year. Hell of a show!

[Adam Willard @asw_sec]

@CarMax even though I didn’t have the best experience, i care deeply about people experiencing hard times. Unfortunately the managers wife has triple negative breast cancer. I the mail today was this. So much love.

[Adam Willard @asw_sec]

Huge shoutout to @MedUnivSC. Thanks to a cancellation, they got me scheduled for my ileostomy reversal in under 48 hours. Faced some complications, but their care and skill went above and beyond. Home and recovering!

[Adam Willard @asw_sec]

@ColleenD11 @MedUnivSC Happy Thanksgiving to you all also. So very grateful! What a perfect time to celebrate Thanksgiving!

[Adam Willard @asw_sec]

So thankful for @MedUnivSC for my temporary ileostomy and tumor removal. I have some amazing people on my care team. Just 4 days ago I was in surgery. Today I was able to be back to work. Happy that I will be able to enjoy Thanksgiving. Still a long road ahead.

[Adam Willard @asw_sec]

Been having a little fun with AI lately for how to improve password cracking.
#hashcat #passwordcracking

https://t.co/7Xe0TeU3Xd

https://t.co/y9ECMgpGx6

[Adam Willard @asw_sec]

Been a hell of a year battling cancer. Wife surprised me with the ⁦@steelers⁩ crucial catch hoodie. So far this year…4 colonoscopies, port surgery, radiation with chemo pills, 8 chemo infusions (4 more in my future) and waiting to schedule surgery. Enjoying a short break.

[Adam Willard @asw_sec]

@netflix I would love to see the petter putter used in the movie.

[Adam Willard @asw_sec]

@SAS_Cares Thank you. Message sent to psirt. Much appreciated.

[Adam Willard @asw_sec]

@SAS_Cares Can you provide a security contact for vulnerabilities?

[Adam Willard @asw_sec]

Earlier this year I was credited with CVE-2024-25693 for arcgis with base CVSS of 9.9. This vulnerability was a lot of fun as it chained several vulnerabilities together resulting in unauthenticated access to a web shell.

[Adam Willard @asw_sec]

Slowly getting the office together. Would have loved all black chairs but maybe next time. #Secretlab Penetration Testing setup.

[Adam Willard @asw_sec]

@HackingDave Smoked hotdogs is where is it at.

[Adam Willard @asw_sec]

Finally caught the mouse in my trash can that had been eating my string cheese. It is now dead.

[Adam Willard @asw_sec]

I was asked to show more than an alert for XSS in Sharepoint. I was able to access the user’s private/public files, delete and upload files to their drive. The XSS I reported was patched. The scripts used with the XSS is in the code of the repo. https://t.co/eaiq10QDgL

[Adam Willard @asw_sec]

We ended up snagging a pick at @CCMFLive with Duddy and @SublimeWithRome. Was not expecting to sing happy birthday to Rome or the vibe they brought to the venue.

[Adam Willard @asw_sec]

6 days until Carolina Country Music Fest! #ccmfwristband

[Adam Willard @asw_sec]

@NahamSec Definitely. Have you had a dupe of a vulnerability you submitted, never released to the public of a specific payload, where the platform leaked your payload to everyone and when you submit the next vuln you are the dupe even though it is your exact payload just on a dif endpoint?

[Adam Willard @asw_sec]

I apologize, the example 14 isn’t real world since it relies on fetch and a string. The concept is worth learning. Using what is in the JavaScript to exploit XSS without actually typing a normal payload. It is an interesting exercise. Encountered a few times but not this easy.

[Adam Willard @asw_sec]

Have a way to go. Some allow payloads that aren’t the intended solution (need to code checks for things burp discovers). Trying to create XSS that happens in the real world. The intended payloads are based on alert and document.domain unless specified. https://t.co/v4tyDZABAM