Jani Kirmanen

beyond the error catastrophe treshold / the tail bytes the snake / self-dereferencing the void

[Jani Kirmanen @BrainSec]

@insultsrare Meth Leppard

[Ivan at Wallarm / API security solution @d0znpp]

That was fun. I bypassed a @OpenAI ChatGPT /mnt/data restriction via a symlink, downloaded envs, Jupyter kernels' keys, and some source code from there. Reported via @Bugcrowd and got not applicable! Now this issue is fixed (in like an hours after my report).. Is it how it should be? Asking for the community here. Screenshots attached.

[Jani Kirmanen @BrainSec]

@RistoNevanlinna täysin omassa luokassaan painivat lätyt

[Jani Kirmanen @BrainSec]

@sulkahattu ja sitten se joka päivänen stressi siitä missä niistä kymmenestä lounasravintolassa tänään kävis!

[Jani Kirmanen @BrainSec]

@insultsrare I was just reading Pollen and this came up @jeffnoon

[TurkuSec ry @turkusec]

TurkuSec September Meetup!

Date: 14.9.2023
Time: 17:45 – Onwards
Venue: SparkUp Turku (Tykistökatu 4B)

“Securing 5G networks with Federated learning and GANs” by Rayyan Hassan

“What is CTI?” by Lauri Vakkala

Join us! More info: https://t.co/O6oSi6goXx

[Jani Kirmanen @BrainSec]

@JanRuusuvuori @Espoonteatteri @HSL_HRT @HSLdevcom is this hacking?

[Andreas Zeller @AndreasZeller]

How do you fuzz code that cannot be instrumented, e.g. on an embedded system? It turns out you can use GDB for that!

👉 Check out our upcoming “GDBFuzz” @issta_conf paper at https://t.co/UhYHZOjDx3
👉 GDBFuzz is available as open source at https://t.co/qDjxVIzH3H

[Jani Kirmanen @BrainSec]

Also applies after replacing "trivial things" with "security backlog"

[Programmer Humor @PR0GRAMMERHUM0R]

Anyone can associate? https://t.co/ZfdwU9z24G

[Jani Kirmanen @BrainSec]

@intigriti missing secure flag from ssl cookie

[Paul Seekamp @nullenc0de]

Need to bypass the JWT signature? Kid param injection + directory traversal = signature bypass

Vulnerable apps using 'kid' for key retrieval might allow attackers to force a predictable key file (e.g. static file or /dev/null)🔓 Crafted malicious tokens signed w/ known key

[Jani Kirmanen @BrainSec]

@MaOberlehner always upvote AAAAAAAAAAAAA

[Jani Kirmanen @BrainSec]

@huima Let's play! https://t.co/arSJDcUmry

[Jani Kirmanen @BrainSec]

It's only penetration testing if it's from the Pénaux region of France. Otherwise, it's just sparkling security testing.

[Jani Kirmanen @BrainSec]

@mboehme_ @amoellercsaudk

[Jani Kirmanen @BrainSec]

@huima aina voi yhden maistaa

[Jani Kirmanen @BrainSec]

@OsmoSoininvaara Varsinkin lyhyitä matkoja tekevänä mieluummin ostaisin esim. 10 minuutin lipun kuin aina sen 80 minuutin.

[Jani Kirmanen @BrainSec]

@OsmoSoininvaara Mitään teknistä estettä en näe sille, että loppukäyttäjä ei voisi applikaatiolla ostaa mielivaltaisen monta minuuttia kerrallaan voimassaolevaa lippua.