b14ckh34rt

Finder of things | Knower of secrets

[The Hacker News @TheHackersNews]

‼️ BREAKING: Go has issued an URGENT security update blocking 8 certificate authority keys over undisclosed security concerns.

It will reject certificate chains using these keys, potentially breaking connections for rebuilt applications.

The filter cannot be disabled.

Here's what we know: https://t.co/X0uIVXrlp1

[PortSwigger @PortSwigger]

NEW CERTIFICATION ALERT! The new Burp Suite Certified Practitioner certification launches today! Learn more and get your exam here! 🎆
#burpsuitecertified
https://t.co/jjc4nX42tC

[PortSwigger @PortSwigger]

Did you know, DOM Invader can inject the canary into every source automatically? Set the canary to an injection and improve automated bug hunting - let DOM Invader do it for you!

[mpgn @mpgn_x64]

Finally CrackMapExec can now fetch all domain users when the DC is vulnerable to NULL Session 🎉

Prior to this, CME what useless except for the password policy option 😓

No more enum4linux, rpclient etc, all great tools but I prefere one tool to rule them all 🔥

[Rohit @who_rsehgal]

SecurityZines - Day 22/30 😱😱🙀🍻

Web Authentication methods can be confusing and overwhelming. L

You will love the full zine: https://t.co/gHq4pBbjrl

Thanks to @TheIAMNinja for the review.

#infosec #appsec #webdevelopers #100DaysOfCode #security #bugbounty

[J1NX @J1NNX26]

If anyone in need of guidance for OSCP or needs clearing of any concept, feel free to drop me a DM, I will definitely help and guide you.
#offsec

[TrendAI Zero Day Initiative @thezdi]

#Parallels Desktop RDPMC hypercall interface and vulnerabilities: @renorobertr details how he found a heap overflow & a TOCTOU bug in his latest blog. https://t.co/D2OoRXed1o

[TrendAI Zero Day Initiative @thezdi]

Wow - with just 10 seconds left of their 2nd attempt, Daan Keuper and Thijs Alkemade were able to demonstrate their code execution via Zoom messenger. 0 clicks were used in the demo. They're off to the disclosure room for details. #Pwn2Own

[Rohit @who_rsehgal]

🥳🥳 Learn SOP the most simplest way ever. If you are bug hunter/pentester or web dev, knowing SOP really helps.

🍻SOPZine for free @gumroad : https://t.co/AdrXzB7r4l 🎉〽️

Please RT for good reach.
#infosec #zines #webdev #DeveloperJobs #security

[Rohit @who_rsehgal]

🥳 Differences between various HTTP protocol versions. 🙃🙂
Stay Tuned for full #zine.

Monday Comic #3
Join for Monday Comics : https://t.co/yW06DGkCyU

#infosec #security #WebsiteDevelopment #Backend #bugbounty

[b14ckh34rt @b14ckh34rt]

@PwnFunction Can you share the exploit/payload used?

[Keysight Device Security Testing @Riscure]

Are you a #student of a #security related program at the university? Join our virtual #event on February 5th at 10 am (CET). This event is will give you insights into the security industry and how companies like Riscure work. Check it out and register now: https://t.co/wy5DIMCaud

[mpgn @mpgn_x64]

New version 5.1.4 of CrackMapExec is available on @kalilinux and for sponsorware of CME 🎉

Few improvements:
- thanks to @byt3bl33d3r CME now uses asyncio over gevent 💪
- some issues have been fixed (spider, pass-pol, MSSQL thx to @D1iv3 🙏)
- CME now use Impacket v0.9.22 🚀

[PT SWARM @ptswarm]

Open redirect parameters from every disclosed @Hacker0x01 report ever, composed in one wordlist

The full list (48 unique): https://t.co/YBItx0k2wH

Top 5 sorted by popularity 👇

#ptswarmTechniques

[Andy Robbins @_wald0]

I'm proud to announce the release of #BloodHound 4.0: The Azure Update!

Blog: https://t.co/pQxmjauZ5F
BloodHound 4.0 Release Poster: https://t.co/I6UuJtePhe

Get BloodHound: https://t.co/jQMzLJ9Fl4
Docs: https://t.co/QngrCQTOWb
Join the BloodHound Slack: https://t.co/oSzPG75Gei

[Charlie Bromberg « Shutdown » @_nwodtuhs]

👿 Hackers, behold... A new tool for dem bounties 💸💸💸
Generate oneliner Windows and Linux file download commands faster than ever with 📢 uberfile 📢

Coded with love with @_1mean

➡️ https://t.co/8FUaiy4LJn

#bugbountytips #ElMásHermosoDeLosCamiones

[PT SWARM @ptswarm]

New gadget chain for deserialization in Zend Framework applications. Triggers on __destruct(), gives RCE and works in PHP 7.

https://t.co/BJ5LCdC0lB

#ptswarmTechniques

[Burp Suite @Burp_Suite]

Burp Scanner lets you record login sequences using your browser, and use these to log in during the scan.

In the latest release, you can test your recorded sequences in Burp's embedded browser to confirm they are working.

[Emad Shanab - أبو عبد الله @Alra3ees]

Server Side Request Forgery (SSRF)
Tips
Resources
Tools
Writeups
Cheatsheets
Payloads

https://t.co/6LRsY7ut9C
https://t.co/S9MMzqDgpy
https://t.co/y4q0S653h5
https://t.co/0l7IGjho7s
https://t.co/9nto81qb4o
https://t.co/DC3cPQk3Pg
https://t.co/4wM3T8LIBb
https://t.co/GKDq7aLcri

[Sayaan Alam @ehsayaan]

Finally, the Most awaited write-up is here , SSRF (Server Side Request Forgery) worth $4,913 | My Highest Bounty Ever!
Kudos to @TechFenixSec Red team for helping me throughout the research
Retweet if you like it.🙂

#bugbounty

https://t.co/qfLCiAo0sg