Paedy

Hacking stuff at @redguard_ch, opinions are my own

[Paedy @compr00t]

@PortSwigger Are positive lookaheads supported in your regex implementation for BCheck? At least in Java-styled regex this is a thing.

[Paedy @compr00t]

Take the red pill! @a41con #area41

[Area41 Security Con @a41con]

as some were surprised by the AREA41 CFP closing, we decised to extend it till May 1.
But get your abstracts in quickly as review selections have started

https://t.co/6yFuZvlTXQ

[Kuba Gretzky @mrgretzky]

Evilginx 💗 Gophish

The long-awaited official integration of Evilginx with Gophish has finally arrived with the Evilginx 3.3 update. 🪝🐟

The update includes lots of quality-of-life improvements as well.

Enjoy and happy phishing! 🤗
https://t.co/Cqma4vpRFm

[Area41 Security Con @a41con]

the CallForPaper for AREA41 conference is open!
Submit your A game of technical research to be a part of this conference🤓
⏳You got till end of April⌛️

https://t.co/6yFuZvlTXQ

[Paedy @compr00t]

@ant0inet @InfoGuardAG @OneconsultAG @redguard_ch @compasssecurity or a table-top exercise 🤔

[Grzegorz Tworek @0gtweet]

By-design AV bypass with "dev drive" 😅
I really like this feature!
Update your detection rules if you want to spot this...

[Marshall';--🐼🍌 @MJHallenbeck]

If people don't know, we've forked CrackMapExec to a community fork and renamed (per request). v1.0.0 coming soon: https://t.co/KsKxZjrA8V

[BSides Zurich @BSidesZurich]

📢📢📢 Accepted Talks and Speakers' Bios published 📢📢📢
Thanks to all who applied to our #CfP and to our reviewers, the list of accepted talks is now on our website. Detailed agenda will follow
https://t.co/X9lvNUOu1c

REMEMBER: Tickets sale starts tomorrow 3pm Zurich time 🥳

[watchTowr @watchtowrcyber]

we've released our analysis of #xortigate or CVE-2023-27997!

https://t.co/uefQ7wr1vG

(sorry for reusing the meme, we just love it)

#fortinet #cve #vulnresearch #attacksurfacemanagement

[mpgn @mpgn_x64]

Done, CrackMapExec is now able to decrypt LAPS password thanks to the awesome work of @_zblurx and @BoreanJordan 🎉

If you have a credential that can read laps password, just run a /24 with the option of your choice (lsassy, lsa, dpapi...) and quickly become DA (probably) 👑

🪂

[vx-underground @vxunderground]

Today VirusTotal announced that each sample uploaded will be accompanied by "Code Insight". Code Insight uses Sec-PaLM, one of the generative AI models by Google, to explain what the malicious binary is doing.

Code Insight is available to all users.

tl;dr "they took my job"

[Paedy @compr00t]

@malmoeb do you actually encounter cases where an attacket was able to crack an Net-NTLMv2 hash? In opposition to LM and NThash, Net-NTLMv1/v2 are challenge/response-based and therefore usually way harder to crack. That is why you normally relay such hashes to another host internally.

[Paedy @compr00t]

@ant0inet Basierend auf dem Proof und unter der Annahme das es im Kontext von einem normalen Browser direkt gerendert wird, ist dieses XSS so gar kein XSS sondern ein korrekt encodierter String.

[blasty @bl4sty]

Decided to publish the Lexmark printer exploit + writeup + tools instead of sell it for peanuts. 0day at the time of writing: https://t.co/YptEXw3CjJ -- enjoy!

[Paedy @compr00t]

Just booked mine!

[offensivecon @offensive_con]

It's time everybody!!! the OffensiveCon23 ticket shop is now open! Get your tickets quickly, as they tend to run out pretty soon. https://t.co/DySRWNwSG9

[Paedy @compr00t]

Careful if you test for request smuggling vulns with @Burp_Suite and have „Add Custom Header“ adding a header for you because it seems to lead Repeater into updating the CL even if you have it disabled. Maybe a good time to migrate to Burp's internal function to add a header?

[Paedy @compr00t]

@albinowax Yeah that's what I would have expected. However, I see a zero CL in my case. I will email some more details to your support, maybe it helps.

[Paedy @compr00t]

@PortSwiggerRes To test for a client-side desync vuln, active scanner sends a request twice (first with keep-alive) and then reports it as vulnerable if the connection was not closed in between. Shouldn't it alter the content-length as well to test if it's actually ignored?

[Paedy @compr00t]

@albinowax I did, that's how I ruled it out as a FP manually. My point is that the scanner states "the server ignored the Content-Length header and did not close the connection" but only tests for the connection-part and does not modify the CL or sends a non-valid CL or similar.