lucid

Freelance pentester and bug bounty organic farmer.

[lucid @djIsLucid]

Well written and clear read on finding a TCC bypass in Claude Desktop

[lucid @djIsLucid]

@Jhaddix “Gangs taking over Aurora, CO. Chicago next?” Actual title of an article sent to me by a family member recently. Makes me so sad.

[lucid @djIsLucid]

@Jhaddix Thank you for sharing this. It’s absolutely shameful the degree of fear mongering the media peddles on us nowadays. I swear it’s getting worse and worse. I live in Chicago and because of the “reporting” on this I have family members convinced that the gangs are on their way here

[lucid @djIsLucid]

@albinowax Uh… yes? Yes.

[lucid @djIsLucid]

For anyone on mastodon who cares about hacking and good write ups Im curious which of the two summaries was more useful between my last #dailyread and this https://t.co/AaxPSOB1nY

[lucid @djIsLucid]

into a persistent XSS or many of the other known uses of a HRS bug. It's fun to see how this could be useful in both red team engagements and #BugBounty as well. When going the extra mile, don't be afraid to read the RFCs! https://t.co/0ULTsDdaVS

[lucid @djIsLucid]

#dailyread was https://t.co/7nQB8zk0vK an awesome write-up documenting abusing a HTTP Request Smuggling vulnerability in order to MiTM a domain user's Exchange mail sync. As the Exchange server was using Basic Auth they were able to steal credentials, however being a red team
1/

[lucid @djIsLucid]

engagement they took it a few steps further and hosted a rogue service which would update the user's Exchange server in the account settings. This got me excited about request smuggling all over again. The impact of this goes way beyond stealing cookies or turning a self-XSS
2/

[lucid @djIsLucid]

As a follow up to my last #dailyread tweet here's an article which describes a real attack scenario and some high-level post exploitation methodology being used by APTs https://t.co/KZSregK9HM

[lucid @djIsLucid]

successful in building a working PoC, though some further assembly (pun intended) required in order to get it to work in an environment other then the one they were working on. Plenty of additional resources are linked in the article. I really enjoyed this one.

[lucid @djIsLucid]

#dailyread was https://t.co/iaCGIJ1JT8 and right off the bat I notice that the author makes a point to mention various small failures they experienced throughout the process. In this case the process was attempting to create a working PoC for an exploit being used by
1/

[lucid @djIsLucid]

with understanding of some more advanced concepts. The author's clear and even candid writing style makes it feel like we are there for the entire process making it much easier to understand even if exploit dev and reverse engineering isn't your thing. In the end they were
3/

[Trickest @trick3st]

Add this shell function to your dotfiles to download any bug bounty program's subdomains, web servers, cloud assets, or URLs from the Inventory dataset 🪄

https://t.co/VW0wSoSPek

[lucid @djIsLucid]

as this is a common thing attackers look to harvest in the event malware is successfully installed on your computer. These logs are often easily found on public cracking forums. Big thanks to https://t.co/o8mgsMpcTI for this writeup.

[lucid @djIsLucid]

#dailyread - https://t.co/sHXv6LRjUb. To summarize, the researcher was able to find stealer logs working on something unrelated to a red team engagement. They searched the logs and found references to Citrix logins which they used in a credential stuffing attempt against their
/1

[lucid @djIsLucid]

target. This did not work, but some of the information (there was 10TB) was related to a username which was valid for their client. This probably isn't news to a lot of people, but the takeaway is that you should think twice before saving sensitive information in your browser
2/

[lucid @djIsLucid]

Keep in mind, that's roughly 13 million total hosts. I'm not sure what I would have guessed the number of servers vulnerable to header-based SSRF would be out of 13m, but I probably would have been surprised no matter what.

[lucid @djIsLucid]

#dailyread was https://t.co/Ft1DuhT2Qw from the Trickest team. They identified over 550 AWS servers vulnerable to Host header-based SSRF across the entire range. One thing I enjoy about this article is that they broke down the whole workflow of how they tooled the process
1/

[lucid @djIsLucid]

@pry0cc Chaco Z1s... but only if they were made on or before 2016.