deathflash ⚡️

Building boxes, hunting bugs & earning bounties
Pentester @cobalt_io | Maintainer @ExploitDB | Meetup Host @hackthebox_eu
Ex: @offsectraining & @ThinkstCanary

[deathflash ⚡️ @deathflash1411]

Life is like a video game; sometimes all you need is a reset to conquer the next level!

[Sam Curry @samwcyo]

New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate.

Full disclosure:
https://t.co/e2EwvUMgqw

[xyzeva @xyz3va]

gaining access to anyones browser without them even visiting a website (CVE-2024-45489)

https://t.co/Junay0CCNv

[MG @_MG_]

The exploding Hezbollah pagers situation is an incredibly impressive supply chain attack by Israel (most likely). I am sure more details will come, but there are already some educated guesses to be made that narrow it down.

🧵1/n

[zhero; @zhero___]

t i m e

[Clint Gibler @clintgibler]

D'oh, so you leaked your AWS credentials 🤦‍♂️ Does it matter 𝐰𝐡𝐞𝐫𝐞?

It turns out there's a HUGE difference in how fast attackers will find them.

Idan Ben Ari deployed canary tokens (fake AWS credentials) using @ThinkstCanary to a number of different locations and analyzed:

- How quickly they were accessed.
- Where were they accessed from (IP).
- User agent, etc.

📊 Results

NPM: <1 min.

PyPI and GitHub: ~2 minutes

Pastebin ~1 hour

Web server ~2 days

DockerHub ~7 days

BitBucket and GitLab: …never.

https://t.co/SmVHf1LcBA

[Sam Curry @samwcyo]

Just some personal thoughts on why you shouldn't force yourself to become a bug bounty hunter -

https://t.co/VzHkm0aJ1u

[deathflash ⚡️ @deathflash1411]

Big thanks to @offsectraining's UGC program for kickstarting my journey! 🚀

- How it started: Built vulnerable machines, earned OSCP, and joined OffSec as a VM Engineer
- How it’s going: Still building &amp; breaking boxes! 🔥

Grateful for the ride and excited for the future! 🙌

[OffSec @offsectraining]

We are thrilled to celebrate the tremendous success of our UGC program and share some exciting milestones we have achieved along the way: https://t.co/2sgsSoH9my

[Ryan Els @RyanEls4]

Honest 😂

[Matt Johansen @mattjay]

Best cosplay of 2024?

[Matt Brown @nmatt0]

Decided to start an IoT hacking blog!

The blog will be featuring the best projects from my YouTube vids. First post details the reverse engineering of the VStarcam CB73 security camera.

https://t.co/NROZuhH7sF

[Thinkst Canary @ThinkstCanary]

We slipped one of these in the bags at @BSidesJoburg this weekend because we are looking for amazing support engineers (to join our amazing support engineers).

"If you’re driven by a commitment to excellence with impeccable attention to detail, you need to join us"

Join us!

[Thinkst Canary @ThinkstCanary]

On the nVidia blog:

“Defending AI Model Files from Unauthorized Access with Canaries”

💪💚✊️

https://t.co/ZaWzqcaYJe

[deathflash ⚡️ @deathflash1411]

I'm excited to be selected as a Subject Matter Expert by @hackthebox_eu, sharing insights to help over 2 million professionals learn and grow.

Thank you, HTB, for this incredible opportunity!

#Cybersecurity #HackTheBox

[Masonhck357 @Masonhck3571]

Nobody cares, work harder

[Sai Krishna Kothapalli @kmskrishna]

After that excellent first Hacker Mixer, I am organising one more on 10th July (Wednesday) in Hyderabad.

Hackers in Hyd, go ahead and register.

https://t.co/onTA1Xcgjl

[deathflash ⚡️ @deathflash1411]

@VALORANT WTF?

[deathflash ⚡️ @deathflash1411]

@intigriti DieHard 4.0

[deathflash ⚡️ @deathflash1411]

SecretSniffer: workflow designed to detect Secrets and API Key leaks in HTTP responses, leveraging regex patterns.

https://t.co/YG8k0uZynr

[deathflash ⚡️ @deathflash1411]

Been using @CaidoIO for a while now, and it's pretty cool! Wrote some workflows recently, it was super quick and easy. 👇🧵

https://t.co/bk0m9jwz7d

[deathflash ⚡️ @deathflash1411]

RequestTinter: workflow that applies color tints to in-scope HTTP requests, making it easier to identify them based on their respective methods.

https://t.co/C43wqfdQBA