Halcy0nic

[Halcy0nic @Halcy0nic]

Ending @defcon this year with @CVEnew dropping three more CVEs I discovered:

CVE-2023-40294- https://t.co/HcyY9klhQw
CVE-2023-40295- https://t.co/JDeTe4xLou
CVE-2023-40296- https://t.co/SkYfYRbEw6

If you are at @NatlCyberSummit next month, come by and say hi!

[Halcy0nic @Halcy0nic]

I've completed my Zero-Day research sprint for March 2024 and discovered four more critical zero-day vulnerabilities: CVE-2024-27540, CVE-2024-27541, CVE-2024-27542, and CVE-2024-27543. In this article I thoroughly explore fuzzing projects with AFL++

https://t.co/H2fWiBHEvA

[Halcy0nic @Halcy0nic]

🔍 Diving deep into fuzz testing with #AFLplusplus 🐛, and the results are in! I found multiple unique vulnerabilities in LCI - a lambda calculus interpreter. The full write up with associated CVEs can be viewed here:

https://t.co/H2fWiBHEvA

#Fuzzing #Cybersecurity #BugHunting

[Halcy0nic @Halcy0nic]

Stay safe and stay secure! Here are two more CVEs I discovered recently published by @MITREcorp

Liblisp Out of Bounds Read (CVE-2023-48025)
Liblisp Use-after-free (CVE-2023-48024)

[Halcy0nic @Halcy0nic]

Another CVE I discovered was released by @MITREcorp @CVEnew . This one is a double free in the xHTTP server library:

https://t.co/aAVU0dEUBs

#CVE_2023_38434

[Halcy0nic @Halcy0nic]

https://t.co/PDMl2rDPwl
https://t.co/XVASk7SUej
https://t.co/tw0LWpqOxu
https://t.co/eF0ebubC70
https://t.co/v9ZN0eIQA7
https://t.co/u7rNigjNK3

[Halcy0nic @Halcy0nic]

Looks like this is a 12 CVE month for @Halcy0nic research. Thanks to @CVEnew and all of the development teams for the quick patches and amazing response time.

[Halcy0nic @Halcy0nic]

https://t.co/5gyYFIIdUp
https://t.co/HD1acqSJEN
https://t.co/zmtJqshz2f
https://t.co/Q4AQwdN9h2
https://t.co/1oZSwJV0ds
https://t.co/OWgicRBpuj

[Somerset Recon @SomersetRecon]

New blog post - Fuzzing for CVEs Part I (Local Targets):
https://t.co/tWSFY1EL1Q

[Halcy0nic @Halcy0nic]

A few more zero days I discovered have been assigned CVEs. You can find more info on MITRE’s official website 🤙🏾

https://t.co/Ld9vmhaupq

https://t.co/qNqMH3x4pC

https://t.co/Tcn28oSPOw

[Halcy0nic @Halcy0nic]

To check out the write-up I made about how I discovered this CVE, visit https://t.co/1uaoZx9VrQ

https://t.co/DTTYjB4lUn

[CVE @CVEnew]

CVE-2022-34556 PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c. https://t.co/I5OOpz5sm6

[Halcy0nic @Halcy0nic]

Buffer overflow I discovered in md2roff version 1.7

https://t.co/tcL6kCINvT

[CVE @CVEnew]

CVE-2022-34913 ** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input. https://t.co/JtsTl2fUQZ

[Halcy0nic @Halcy0nic]

Some @hackthebox_eu fun

https://t.co/cZDTpd0dtw

[Today In Infosec @todayininfosec]

1997: Nmap was first released as a simple port scanner via an article in issue 51 of Phrack magazine which included the source code.

That's right - 23 years of Nmap.

https://t.co/uYyc2OQ1r6

[SLAM Grails @SLAMGrails]

NBA Street Vol. 2 dropped 17 years ago today. 🎮 @SLAMftw

[Halcy0nic @Halcy0nic]

Great CTF!

Shout-out to @Cair07x, Les0eufs, and @eavenonearth for cracking some of the boxes. 🤙🏾

[Halcy0nic @Halcy0nic]

The #HalcyonicQuarantineCTF is officially a go next Thursday (04/02) from 6-9 PST. During our solidarity I am hosting a free online capture the flag event. Should be fun! You can get all the details here:

https://t.co/glh8n7sQFx

[Halcy0nic @Halcy0nic]

Some more zero day action:

https://t.co/N5eWgjG1IW

[Halcy0nic @Halcy0nic]

Some Binary Exploitation Fun:

https://t.co/hj1asX68Vt

[Halcy0nic @Halcy0nic]

@joegrand @NickySlicksHaha @joegrand Thanks for the clarification 🤙🏾