Andrea Valenza

Security Engineer. CTF player (sometimes).
Co-founder of @ZenHackTeam. PhD!

[Andrea Valenza @AvalZ_]

Attacking the Attackers - A XSS vulnerability that leads to RCE on Metasploit Pro when scanning a malicious server
https://t.co/GIRd7rRGkc

[OWASP Italy @OWASPItaly]

Thank you to our speakers @zangobot , @AvalZ_, @innotommy! Slides are online:
https://t.co/UKlmQUnpQQ

[Luca Demetrio @zangobot]

Tired of wasting life building and deploying complex ModSecurity installations JUST to test your rules?
@AvalZ_
and I have the answer: https://t.co/olijNX8Xok

You're welcome.

#crs #modsecurity #waf #security #owasp #test #rules #web #cli #python

[Luca Demetrio @zangobot]

Imagine you need to test your regex to counter threats on the web, but nobody gives you a tool.
Now the tool exists!
Thank you @AvalZ_ for this great work!🎉

#infosec #regex #threats #test #security #offensive #payloads #new #tool

[Andrea Valenza @AvalZ_]

"The plural of regex is regrets"

Need to generate payloads that match or avoid multiple regex?
Check out regrets! https://t.co/ZiKblK4ZVv

Feedback is very welcome 😁

[Andrea Valenza @AvalZ_]

So glad to see that RevOK is still getting some love after all this time!

https://t.co/4a8WvbUlaz

[Simon Bennetts ⚡🇺🇦 @psiinon]

"Never Trust Your Victim: Weaponizing Vulnerabilities in Security Scanners" - missed that this research included @zaproxy - good to see no vulnerabilities found!
https://t.co/zpyjUX5YPp
Full PDF linked on that page.
Reasearch by @avalz_, Gabriele Costa, Alessandro Armando

[Mister RIP @retireinprogres]

Best comment ever #OpenAI #ChatGPT #laterradeicachi

[Andrea Valenza @AvalZ_]

Lookarounds are a great feature in PCRE regex. But what if you are using Go or Rust?
Here are a few tricks to simulate Negative Lookaheads in non-PCRE engines.
#regex #TIPS

https://t.co/IOR3GEiQJl

[Simone Aonzo @packm4d]

Today we (@antonio_ruggia, @_pox_, @dreamersball80, @_DarioNisi) disclose some vulnerabilities that we exploited to mount a novel phishing attack on @Android by abusing inotify.
Our research will be presented at @IEEEEUROSP 23

https://t.co/QAYowmxNco

Some comments below (1/n)

[testable_eu @Testable_EU]

📢ANNOUNCEMENT📢 The #OWASP Testability Patterns for Webapps is finally out! Shoutouts to @Testable_EU partners @CISPA @EURECOM @uc3m, @tuBraunschweig @ShiftLeftInc @SAPLabsinFrance @mindedsecurity NortonLifeLock @pluribus_one
https://t.co/ADbGbH3pP9
https://t.co/MyWKfqm0Zm

[Andrea Valenza @AvalZ_]

@Dio @NetflixIT Orange is the new black

[Andrea Valenza @AvalZ_]

It's been a few years now, and WAF-A-MoLE is gaining momentum!🚀
Today it reached a great milestone, with a round number of stars!😁
\cc @zangobot
#waf #Bypass #MachineLearning

[Andrea Valenza @AvalZ_]

Got a ML-based WAF? Check its robustness against WAF-A-MoLE! It smuggles SQL injections by applying semantics-preserving mutations to a blocked payload. https://t.co/yYLisedikA

#computer #science #web #security #SQL #injection #evasion #evaluation #MachineLearning

[Andrea Valenza @AvalZ_]

@AndreaDProjects You say "Alexandra isn't immortal", but everyone is immortal until proven otherwise 🤔🤔🤔

[Luca Demetrio @zangobot]

Proud and happy to announce that I'm joining @UniGenova as researcher (RTDa)!
I'll keep breaking and hardening AIs as always, but with a twist of focaccia and pesto!
Incoming more and more science!
#research #machinelearning #security #ai #career #job #achievement

[Edoardo Rosa @_notdodo_]

On nuvola's repository README (https://t.co/GRinhlXgWm) you can find all links for the #RomHackCamp #slides and #demos that you saw during the "You Shall Not PassRole!" talk

[Prima Engineering @Prima_Eng]

Today we're releasing nuvola 🌩️(https://t.co/lNfzIISPDO) during #RomHack camp. nuvola is a new born open-source tool to dump and perform automatic and manual security analysis on AWS environments, especially useful to find privilege escalation paths! #aws #redteam #security

[Alberto Angela @albertoangela]

Buon viaggio papà.

[Prima Engineering @Prima_Eng]

We love the elixir community! That's why we decided to contribute back and release prima_autho_ex: an easy-to-use elixir library to authenticate machine-to-machine communications through Auth0! https://t.co/zd2Jbtjy7V

[Andrea Valenza @AvalZ_]

@tudifrudi https://t.co/VBQAH5MQ07

[Andrea Valenza @AvalZ_]

@_notdodo_ Whooops, my mistake: the talk is on Sep 24th (Saturday!) #WeNeedAnEditButton

[Andrea Valenza @AvalZ_]

Don't miss "You shall not PassRole!", a talk by @_notdodo_ @ RomHack (Sep 25th)!
He will show how privilege escalation issues proliferate in AWS environments, and how to automate the discovery process.

For more details: https://t.co/E0sv9OKKkJ

[Prima Engineering @Prima_Eng]

Interested in security? You should attend https://t.co/SPNYvdPAzc (@cybersaiyanIT) which will take place on September 23-24-25th 2022! Don't miss @_notdodo_ talk about AWS privilege escalations attacks and defenses!