sigint

[sigint @handled_sigint]

@maxzks True scholarly alignment: one column per author name

[sigint @handled_sigint]

@0xtavi Ok, what is the lifetime of CSRF tokens? Do they have a timeout? Do the persist between requests?

[sigint @handled_sigint]

They’re on to me

[NSA/CSS @NSAGov]

sigint

[sigint @handled_sigint]

A vote for KernelJenkins is a vote to see teams who know what services run on what 2x ports

[sigint @handled_sigint]

If you wish to see justice restored to our democratic system, then vote KernelJenkins this year

[Hacker Jeopardy @HackerJeopardy]

WHO SHOULD PLAY @HACKERJEOPARDY?

THE TOP TWO TEAMS PLAY.

THE BOTTOM TWO DO NOT.

#DFIU @defcon #D3FC0N

[sigint @handled_sigint]

Big thank you to @SecBarbie for finding a few extra badges in the couch cushions

[sigint @handled_sigint]

Was the first to the drop, but the @ANDnXOR badge fairy delivered hard this drop. Special @k0grad for a sporting match of Rock Paper Scissors. Now off with them and @_dum8_k1d to start solving

[sigint @handled_sigint]

*Wasn’t

[sigint @handled_sigint]

@d1g1t4l_t3mpl4r out here spreading the good word

[sigint @handled_sigint]

And so it begins #badgelife @_dc408

[sigint @handled_sigint]

Today ⁦@marinanmoore⁩ walked up to me, showed me this and said “it’s bare metal”. Best part of #RSAC yet

[sigint @handled_sigint]

Bumped the versions on everything for https://t.co/F36yxw3x6k, including fixing log4shell. Usually I don't post about the "boring" work like this, but strong recommend that if you're running this on sketchy libraries, it not be vulnerable to something so popular.

[sigint @handled_sigint]

And of course, nothing helps surface a last minute bug like tweeting out something you did xD

[sigint @handled_sigint]

Hey, have you been spending a lot of time testing for potentially blind DNS recently for some reason? Check out this project from @symbolcrash1, just set up some alert domains and start spraying payloads (with legal consent).

[Symbol Crash @symbolcrash1]

If you want a self-hosted solution for DNS canary testing that's easy to deploy, @handled_sigint just added Slack webhook notification support to the madns server (already had email): https://t.co/LcFJlPYOpc

#Log4Shell #log4j

[sigint @handled_sigint]

Seems like @Caltrain hasn’t been paying their domain registry fees https://t.co/VlGT6BedXZ

[sigint @handled_sigint]

This combined with the `go doc` command makes working on Go anywhere so much easier.

[sigint @handled_sigint]

Reading through https://t.co/EPWsCjByLc, one of the unfortunate parts of that is you can't get source-level coverage guided fuzzing. To which my next question was, "how does coverage guided fuzzing actually work?" (thread)

[sigint @handled_sigint]

Aaaaaaand, I'm already distracted. Did you know that you can get https://t.co/Hi675OSKPY entirely in offline mode? Everything is documented in https://t.co/mCkTqAvWJj, and all of the code explanations live as comments on the various files.