Anthony Rhodes

Researcher, Red Teamer, Developer. Opinions are my own

[Anthony Rhodes @fork_while_fork]

@HusseiN98D Thinkpad X1 Extreme - 6 core i7 and 64GB RAM 👍

[Anthony Rhodes @fork_while_fork]

@Burp_Suite Another vote for logger++. Very useful for tracking the behavior of an application when using scanner and other non-logged burp features (scanner mostly)

[OWASP Amass @owaspamass]

Version v3.3.0 of #OWASP Amass has been released!

The first version of the new data model has been implemented. Future releases will support saving findings into Gremlin (@apachetinkerpop) and @neo4j #GraphDatabase systems

#osint #recon #opensource #assetdiscovery #bugbounty

[OWASP Amass @owaspamass]

Version v3.2.0 of #OWASP Amass has been released!

The tool has been refactored quite a bit and the default settings run the enumerations much faster.

Use the '-max-dns-queries' flag if you wish to slow things down

#osint #recon #infosec #opensource #assetdiscovery #bugbounty

[No Starch Press @nostarch]

Please share this as widely as possible. Why should we have to police Amazon? This problem is ongoing since 2017. These counterfeits are shipped and sold by AMAZON, NOT A THIRD PARTY. This is not Marketplace.

[Anthony Rhodes @fork_while_fork]

@nullenc0de @__rockyr__ It's very handy for DNS exfil/C2 once you have one up and running

[Anthony Rhodes @fork_while_fork]

@mugundhanbalaji @TheColonial Some free online resources: https://t.co/nRGoOoipOz https://t.co/ta1sBgrcJS

[Go @golang]

🎉 Go 1.13 RC1 is released!

🏃‍♀️ Run it in dev. Run it in prod. File bugs.

🗒️ Release notes: https://t.co/JQdyovtWuH

⬇️ Download: https://t.co/nkFVZcK732

#golang

[Kody @KodyKinzie]

One time some tech bros called security on me at a coworking space for having too many network adapters.

[Anthony Rhodes @fork_while_fork]

@KAS_stoner @pentestscraps @jeff_foley @owaspamass Good question; we haven't received any specifics from the village organizers. We will spread the word when it does get posted

[Anthony Rhodes @fork_while_fork]

@Edu4rdSHL @owaspamass @TomNomNom @aboul3la Passive mode doesn't make any attempt to resolve the names to IPs and the majority of our users want only resolveable names

[Anthony Rhodes @fork_while_fork]

@Edu4rdSHL @owaspamass @TomNomNom @aboul3la amass enum -passive would be a more accurate comparison. 31k subdomains in 7 minutes :)

[Anthony Rhodes @fork_while_fork]

@pentestscraps @jeff_foley @owaspamass Demo labs weren't recorded, but we did a talk at recon village that will be available

[Karl (RIP ) @supersat]

Next year's floorplan

[scriptjunkie (Matt) @scriptjunkie1]

Pre-auth RCE on Fortinet and Pulse Secure (prior: Juniper) SSL VPN's by @orange_8361 and @mehqq_ - over 500k such VPN's on the internet. Heap overflow, arbitrary file read, plaintext passwords, magic backdoor, command injection...
Defcon slides:
https://t.co/jtBAPmC1Gh

[Nmap Project @nmap]

Nmap Defcon release! Enjoy version 7.80: https://t.co/tlaiSMzlCX

[Petros @pkb1s]

As promised during our talk, we have released the user exploitation features for SharpGPOAbuse! @den_n1s @VillageRedTeam #DEFCON27
https://t.co/7tUtJibEBj

[Dirk-jan @_dirkjan]

Thanks all for attending my #DEFCON talk! Humbling to see such a full room even on Sunday. Slides and demo videos are online at the media server.

Slides: https://t.co/TZVR6ndMIv
Demo vids: https://t.co/AqZ9Uw02hH

[Nicolas Grégoire @Agarri_FR]

I’m suprised that CVE-2018-13382 (a trivial « backdoor » in Fortigate SSL VPN) didn’t get much attention, even after @orange_8361´s talks in Vegas... https://t.co/zlYZd5t3Wj