Danylo Dudchenko

Offensive Security | OSCP+
BSCP candidate
Vulnerability research, pentesting & threat intel.

[Danylo Dudchenko @dd_pwnd]

This RAT keeps its command server address on the Polygon blockchain, so takedowns don't work.

ChainScript arrives through a ClickFix lure disguised as a Spotify installer. Once it's in, it asks a smart contract where to connect. Operators change the address on-chain, the implant stays the same.

You can't seize a contract. You can only watch it.

#Malware #InfoSec

[Danylo Dudchenko @dd_pwnd]

Google's Gemini hacked three real companies during a security test because someone reused a fake company name that turned out to be real.

The eval was a capture the flag run by Irregular in May. The fictional target domain matched an actual company's domain. Gemini guessed passwords and pulled credentials from public repos, and got in.

Then it noticed the target wasn't the test environment and stopped. Google was told in July, two months later.

Google says the model acted appropriately. The failure was procedural: nobody checked whether the test domain existed.

The AI passed the ethics check. The humans failed the DNS lookup.

#AI #InfoSec

[Danylo Dudchenko @dd_pwnd]

@markproduct Sure, but make it secure or I'll hack it xd. Budget for a pentest before launch, it's cheaper than the breach.

[Danylo Dudchenko @dd_pwnd]

@brandon_shi Filter by one question: can I show real impact end to end from attacker-controlled input? If the PoC needs three unlikely preconditions, it's a note, not a finding. Writing the exploit path first kills most of the noise🫡

[Danylo Dudchenko @dd_pwnd]

@yadavji_codes Nobody. The server timer starts when it gets the request and stops when it hands off the response. DNS, TLS, queueing at the load balancer and a slow client all sit outside it.

[Danylo Dudchenko @dd_pwnd]

@araseb_ Agreed. The best model changes every few months, and an annual plan locks you into last quarter's winner. Stay monthly and switch to whatever is best now.

[Danylo Dudchenko @dd_pwnd]

@vibeonX69 Using it without checking the output. Not using AI just makes you slower. Trusting it blindly ships the bug.

[Danylo Dudchenko @dd_pwnd]

@Badboi_x_ace Pentesting and AppSec. Happy to connect. Red team here, blue team gets the credit when we get caught💀

[Danylo Dudchenko @dd_pwnd]

@ronohcodes I like breaking code more than writing it. Offsec here, happy to connect🫡

[Danylo Dudchenko @dd_pwnd]

@samongaro_ Agreed. A waitlist measures how many people will type an email address for free. Validation is someone entering a card number.

[Danylo Dudchenko @dd_pwnd]

@PinkDraconian Six valid bugs and the reward is a one month timeout. The system measures whether you were first, not whether you can find bugs. Newcomers pay the most for it.

[Danylo Dudchenko @dd_pwnd]

@uday_devops df -h, then du -sh /* to find the culprit. It's almost always logs, so check /var/log. If df and du disagree, a deleted file is still held open, restart the process. And don't rm -rf anything you can't explain.🫡

[Danylo Dudchenko @dd_pwnd]

@jurlycat Same thing in security. People who only run scanners can't tell a false positive from a real finding, because they never learned to read the raw response. Reps are where the instinct comes from.

[Danylo Dudchenko @dd_pwnd]

@Nightmaresrea XSS is the gift that keeps giving. One missed encode and a "harmless" input becomes someone's session cookie💀

[Danylo Dudchenko @dd_pwnd]

A scam crew ranked fake antivirus and streaming pages on GitHub Pages, Notion and Google Sites, and 84 GitHub accounts later got caught by their own analytics. The DFIR Report just published the teardown of BengalSEO.

Running since 2015 out of a tech support call center in Kota, India. Trusted hosting means nobody blocks the domains.

Victims go through a captcha and Matomo fingerprinting. Scanners get a harmless page. Real victims get a ZIP with MayaBot, or a phone number for "support".

146 domains, one Matomo instance. The same tracking server that watched their victims also tied the operators together.

#DFIR #ThreatIntel

[Danylo Dudchenko @dd_pwnd]

@itsmmesoma Mostly PortSwigger academy, it is completely free!

[Danylo Dudchenko @dd_pwnd]

🎯 Day 3: leveling up in cybersecurity

Scope: Python scripting, web enumeration tool
Time on target: 4 hours
Actions taken:
- Built out core scanning logic for the enumeration tool
- Tuned request handling against a live target
💡 Finding: A naive thread pool trips rate limiting before it trips any WAF. Slower and staggered beats fast and loud.

[Danylo Dudchenko @dd_pwnd]

@AKirtesh Zero users. A half-finished product can still get feedback. A finished one with no users just taught you what nobody wanted, at full price.

[Danylo Dudchenko @dd_pwnd]

@RatioRooney Into tech, on the offensive side. Let's connect.

[Danylo Dudchenko @dd_pwnd]

@waelnassaf Congrats on 1,000. Offsec here, happy to connect🫡

[Danylo Dudchenko @dd_pwnd]

@gabbytech01 Let me guess: got locked out of your own account and decided that was a skill issue on their side🤔