Johannes

IT security team lead at Condignum GmbH. I am into hacking and security of all kinds.

[Johannes @c4tch4ll]

We're hiring pentesters and developers! Send me a DM if interested! Remote first!

[Johannes @c4tch4ll]

@pilvar222 I'm about to run our benchmarks as well. Is yous running against Code snippets/vuln class cases our more or less full blown Code bases?

[Elastic Security Labs @elasticseclabs]

7 trojanized repos targeting developers. Zero detections across every AV vendor.

Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings.

The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography.

Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start.

What deploys:
- Credential stealer targeting 25 crypto wallet extensions plus browser login data
- File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code
- Socket. IO RAT providing real-time interactive shell access
- Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2

Full analysis from Elastic Security Labs by @danielstepanic : https://t.co/EetHfm7lXu

[Johannes @c4tch4ll]

@halvarflake Thank you for your perspective. You put well into words what I wasn't able to yet. The anthropomorphization which you talk about reveals to me more about people applying it to LLMs: an insufficient understanding of human concisousness and their overall technocractic Menschenbild.

[Halvar Flake @halvarflake]

I wrote a short rant about what irks me when people anthropomorphize LLMs:

https://t.co/AkMbdmpdqL

[Halvar Flake @halvarflake]

A small slide deck for a 15 minute impulse talk at Cycon 2025 in Talinn: https://t.co/P2XBr6cg7r

[Trail of Bits @trailofbits]

We are excited to announce @trailofbits won a $1mil @DARPA award to compete in the AIxCC! Learn about our approach and guiding principles:
https://t.co/lSs44ZrYRo

[Grzegorz Tworek @0gtweet]

I've decided to offer a special promotion for a few days, giving a 40% discount on my Mastering Windows Internals course. It includes six crucial modules, each 90 minutes long, providing a balance of theory and practice. I hope you will like it. :)
Link below ⤵

[Johannes @c4tch4ll]

@ReneFreingruber @vysecurity ProgramData is often overlooked on System Reviews and can be interesting for privesc attempts in cases where high priv processes/Services share a subfolder in ProgramData ;)

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Some EDRs catch indirect syscalls with callstack analysis. Here is a totally new technique which build a clean callstack originating from ntdll to avoid detections. No ROP required and tested and works against every EDR. Enjoy! 🔥

https://t.co/sALgfx6WQ0

[Johannes @c4tch4ll]

@mc_hannes @HonkHase Attributierung ist immer schwer und nie 100% eindeutig. Dass die Grünen aktuell das höchste Bedrohungsszenario durch einen russischen Angriff haben sollte ebenfalls klar sein, weil sie sich in der aktuellen Regierung am klarsten positionieren, gegen Russland, pro-westlich.

[Tzah Pahima @TzahPahima]

I was able to access thousands of companies’ passwords on #Azure and run code on their VMs.
This includes access to Microsoft’s own credentials… 💣

Here’s HOW I did it.
This is the story of #SynLapse. (1/11)

[Johannes @c4tch4ll]

@tuxx42 @fantomnews @FantomFDN @Tweak896 @DoubleyouW3 @aj_alexjacobi @selenaroyf @ftm_ecologist @harryyeh @ChloePingCrypto I think it's a pretty accurate meme and you Sir are just wrong.

[Johannes @c4tch4ll]

@geeknik @hardik05 @TimelessP Is your non asan build exiting at the same point as your asan build?

[Johannes @c4tch4ll]

The deprecation/removal of RMI over HTTP is probably what saved a good number of the coroprate java world #log4j #log4jshell
https://t.co/ckmSoxmnTR
https://t.co/OPgaNF7W4o

[Johannes @c4tch4ll]

@GanbaruTobi Yep, I saw this one...rmi seems to be working easily. What I am not sure about is if proxying RMI over HTTP is working right now. Proxying LDAP seems unrealistic
https://t.co/xzbpWu1z65

[Johannes @c4tch4ll]

Anybody's got any hints on successful exploitation of #Log4Shell using different lookups than ldap/ldaps? Saw a few rmi hints, but no exploit so far...

[Johannes @c4tch4ll]

https://t.co/QzgMPKkXW6 ...