Bug Bounty | Internal SSRF | $2,000
Found an Internal SSRF vulnerability
The ticketing integration feature (Jira, Zendesk, ServiceNow) accepted a user-supplied URL and passed it directly into a server-side request with zero validation. By replacing the URL with http://127.0.0.1:[PORT], I was able to enumerate internal hosts and ports unreachable from the public internet, one of which exposed a sensitive internal service (https://t.co/OEizQVPbxL)
Lesson learned: always test third-party integration fields. They are often overlooked but can make direct backend calls, making them a prime target for server side vulnerabilities.
#bugbounty #bugbountytips #ssrf
New Video Out 🙌
In this one i explained how hackers use the Dev tools to find client side bugs, and bypass restrictions.
And to not only focus on theory, i have used the dev tools live to find 2 vulnerabilities.
Hope you guys will enjoy it 🫡
https://t.co/8FDYZXlmC8
I have been hacked somehow when having 2FA on my account. There is a bug / exploit going around where anyone can login and change your password. @instagram
I lost my user @darkrai from this bug and cannot do anything about it, please fix this shit
Thrilled to announce that I will be joining @Princeton in Jan 2024 as an Assistant Professor with appointments at @PrincetonCS, @PrincetonSPIA & @PrincetonCITP. I’ll be continuing my work in AI, Law, & Policy, so if you’d like to work together, reach out!
The most powerful open source instructions dataset:
Flan.
378 Million samples. (~300GB) [1]
- Link: https://t.co/Cyn1lSFnhY
Why should you care? 🤔
- Flan is an incredibly powerful dataset [2] and some famous models trained on it (FlanT5, UL2..) hold the top positions on various leaderboards to this day.
- The main reason for it is the quality and diversity of the data.
- It is huge: Ever wondered "What would happen if we just merged all instructions datasets together into a single huge one?", this is basically the motivation behind the Flan dataset.
- It is balanced (!!) which promotes the models trained on it to generalize better to arbitrary tasks down the line.
Flexibility:
- Zero-Shot vs Few-Shot: For many of the tasks you can fetch the same task either for Zero-Shot: No solved for demonstration or Few-Shot.
- Chain of thought built in on some of the tasks.
The "next step"..
A small part of Flan had been augmented with additional explanations in the past.
The result of this was the first model ever to rival ChatGPT on vicuna's benchmark.
And again..
This was just a small part of Flan..
----
[1] https://t.co/KfM3x1wSyS
[2] https://t.co/L711ZzFd6P
(* This paper is a must if you are building text datasets)
I’m still on vacation in Colorado this week but I’ve been playing with Code Interpreter in the evenings after the kids are asleep. It’s a HUGE upgrade to ChatGPT. Rounding up all the cool ways people are using it to share in a video when I’m back.
Here are some of the cool uses I’ve seen or played with:
- Upload two images and create an animation that merges between the two.
- Upload a CSV file of YouTube data and analyze it to recommend future videos.
- Upload a JS file from GitHub and have it explain what the code does in plain English.
- Upload multiple CSV datasets and look for correlations between the two (ie YouTube data and Google Trends data on the niche).
- Convert a video file into an animated gif.
- Generate a QR code from a URL.
- Create a visual word cloud from a dataset to visualize how often a term shows up.
- Create colorful and 3D data visualizations from CSV files.
- Analyze html, css, or js code to find improvements or vulnerabilities.
Feel free to share some cool ways you’ve used it. I want to focus on practical use cases for the average person. I might shout you out in an upcoming vid. :)
My mentor at J.P. Morgan ripped me apart for giving him 100% certainty answers when I was only 80% sure.
I worked w/ him for 2 years and this lesson still sticks with me:
If you know something 100%, say it w/ 100% confidence.
If you don't know something 100%, say you don't know, and then go figure it out.
After Buffett's indifferent Annual Letter which didn't address the pandemic, climate change, and social justice, I really can't wait for @chamath's Annual Letter that will address the current uncertainties, because...
P@SHA is delighted to share the list of mentors for the first-ever batch of CXOs’ Mentorship Program for its member companies, where earlier stage/smaller company CXOs get to learn from the experiences of industry leaders.
Read more: https://t.co/MueZifJ3nQ
Who you spend time with defines your present, and shapes your future. Surround yourself with talented people all the time.
#future#telent#people#TimeForChange