cvebase

[Zellic @zellic_io]

New blog post! An overview of the important changes Proof-of-Stake will bring to Ethereum post-merge, and what developers should be aware of to secure their smart contracts. Read it here:
https://t.co/6irc96OKkP

[Joona @joohoi]

ffuf v1.4.0 has been released!

This is a release with a ton of bugfixes and few major new features from community contributors.

And a new mascot! It's now official.

A short description of the fixes and changes follows in a 🧵 below.

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

So here's the first CVE of my #BugBounty collection: It's an unauth XSS affecting SAP Knowledge Warehouse aka CVE-2021-42063.

The bug itself isn't super thrilling, but the advisory tells you why I'll no longer disclose #security vulns to SAP.

https://t.co/SIzHDnRzFF

(1/2)

[Somdev Sangwan @s0md3v]

smap - Shodan meets Nmap😎🤙

Right now this setup:
- scans 5 hosts/second
- gives vulnerability + service data (cpe+protocol+name)
- can mimic nmap as shown in the video

[Ostorlab @OstorlabSec]

If you have ever wished you could run your Nmap, nuclei, OpenVAS and Tsunami from a single command and access all the results in a single place. You should check this new open-source tool.
https://t.co/04gNanFzRO
#OpenSource #CyberSecurity

[Min Jang @skensita]

Now, you can see the Hall of Fame of the Samsung Mobile Security Rewards Program.

https://t.co/WHfshNJGFm

[Trickest @trick3st]

Releasing our latest project, CVEs! A constantly updated collection of 𝘢𝘭𝘮𝘰𝘴𝘵 every publicly available CVE PoC.

👉 Browse, find a PoC, and test away!
👉 Search for a specific product.
👉 Watch the repo to be notified when new PoCs go public!

https://t.co/O4NQeQvDcM

[Ming Chow @0xmchow]

If anyone wants practice with packet analysis, here’s a lab I give to my Security class each semester. Includes a real PCAP from @defcon #PcapsOrItDidntHappen https://t.co/5WhI9XUVWK

[Emil Lerner @emil_lerner]

I just posted a write-up on how I leaked uninitialized memory (e.g., other users' HTTP requests/responses) from Fastly using a bug in the H2O webserver. Also, there you can learn a fraction of how HTTP/3 + QUIC works)

https://t.co/6TO4pqARaP

[Nicolas Krassas @Dinosn]

Infosec chap: I found a way to hijack your web accounts, turn on your webcam from Safari – and Apple gave me $100k https://t.co/PP2xQIhd0s

[Fabio Viggiani @fabio_viggiani]

You're a better hacker if you know how to build the thing you're trying to hack. Create labs, install stuff, configure it, breake it from the inside. Then apply that knowledge when attacking from the outside. You'll see clear flaws once you really know how it works.

[cvebase @cvebase]

Bought this course and it’s a steal at $50… This is a full-transparency walkthrough of how @HusseiN98D approaches his bug bounty targets and packed with practical tips. Get it while the sale is still live!

[Hussein Daher @HusseiN98D]

It's finally live - I'm sorry for the time this took!
The workshop I gave at @THREAT_CON is now live on Udemy for a discounted price. The price will go back to $149 at the end of the week . More details to follow.
https://t.co/7LoaJOwhzH

[shubs @infosec_au]

Our team took apart Solarwinds Web Help Desk to discover some serious issues (hardcoded credentials, arbitrary HQL evaluation) - CVE-2021-35232 - we explain the discovery and exploitation process in our blog post:
https://t.co/AIiTIohBzh

[Insomni'hack @1ns0mn1h4ck]

Registration for Insomni'hack 2022 online TEASER is now OPEN: https://t.co/rp8yDApvdo

Teaser will run for 24 hours, starting Jan. 29th @ 12:00 UTC. #INS22 #CTF

[cvebase @cvebase]

Just received this handy CTF cheatsheet/book by @bishopfox @AndyDoering "Pocket Guide for Friendly Remote Admins". Thanks!

[thaddeus e. grugq @thegrugq]

I made another video. This time a run down on cyber, cyberwar, and cyber war. Is cyberwar war? And what is “war” anyway? All these are addressed in the video. Enjoy!

https://t.co/NDPWS7JzGt

[Rene Freingruber @ReneFreingruber]

Today I'm releasing my JavaScript/v8 Fuzzer JS Raider. I developed the fuzzer for my master thesis and later improved the code for the "Fuzzilli Research Grant Program". You can find the source code, results and my key learnings in my blog post at: https://t.co/6JW74HpaU0

[shubs @infosec_au]

A few months ago, we discovered a post-auth SSRF in VMWare Workspace One Access - CVE-2021-22056 - which allowed you to steal an admin JWT via CSRF or request arbitrary URLs. Check out our blog post! https://t.co/q0UdqFsgMJ

[erbbysam ㋬ @erbbysam]

New blog post: Why I broke your subdomain recon pipeline last night
(or why https://t.co/a5QkJsCM2r is moving from free to free*)

https://t.co/HEo92iOvSr

[cvebase @cvebase]

CVE-2021-27205: Telegram fails in handling self-destructing messages by @RandomDhiraj https://t.co/lg150Ofgki