Asif Wani

Security Engineering Manager @ DigitalOcean | Ex-Amazon | Security Researcher | Malware Artist

[Asif Wani @KernelCrypt]

@ProteanEgovTech @NSDL_Depository @MCA21India @ProteanEgovTech It is disappointing that an organization of such national importance is handling such matters in this manner. Since last Friday, I have repeatedly been informed that the case is under priority review, yet there has been no update, progress, or resolution so far.

[Asif Wani @KernelCrypt]

@NSDL_Depository I haven't gotten any response for the tan registation applied almost a month back. No one is picking up the the number of nsdl 02027218080 pls answer what's the reason. I have urgent requirement for TAN. @ProteanEgovTech @MCA21India

[Asif Wani @KernelCrypt]

PR Link: https://t.co/ys1yKNpQTE

[Asif Wani @KernelCrypt]

Exiting news for #DigitalOcean users! My recent PR for #ScoutSuite (security auditing tool) has been merged, enabling misconfiguration scanning for your DigitalOcean cloud! ☁️. This packs support for 27 misconfigurations across 7 major services.
#cloudsecurity #infosec #cspm

[Jonás Andradas @jandradas]

A new release of #ScoutSuite has been published! Among some fixes, its main new feature is support for assessing @digitalocean infrastructure. Thanks and kudos to @KernelCrypt for the PR and @lobuhisec for merging and integrating it!

[Ihab Hassan @IhabHassane]

I swear to God, I’m scared, I swear to God, I’m scared. I just want to leave this place.

We can clearly see the horror in the eyes of this terrified child from what he witnessed last night after the invasion of Shifa Hospital in Gaza, where nearly 20,000 displaced people were there.

[Paul Graham @paulg]

Oxford surgeon Professor Nick Maynard on what he saw in Gaza:

[Matan Berson @MtnBer]

My Chrome bug just got disclosed! It’s a really cool chain of 4 vulns leading to local file read and universal XSS (including extensions). Maybe I’ll make a blog post about it

https://t.co/9CQIPqLmMD

[Asif Wani @KernelCrypt]

Latest FireOS update, PS7669/4007, imposes restrictions on apps, blocking local ADB connections (Android Debug Bridge).
#FireOS #android #adb #amazon #security

[Asif Wani @KernelCrypt]

CVE-2023-3224 Nuxt.js RCE⚠️
https://t.co/hjmP1z9Hx9

#RCE #cybersecurity #nuxt #infosec #BugBounty

[🧗‍♂️ Matt Holt @mholt6]

‼️A Chinese certificate authority ("HiCA", https://t.co/MAVrTIt9YX) is injecting arbitrary commands into the ACME challenge process, which https://t.co/Byl6l73Yet then executes on the client machine. Here's my current analysis: https://t.co/cvbLrRzW8o

[Edu Novella @enovella_]

IDA PRO 8.3 finally has the Goomba plugin built-in! De-obfuscate simple MBAs out-of-the-box! @HexRaysSA https://t.co/vcf0W7ueDf😍

[Asif Wani @KernelCrypt]

You can run use the tool to identify and log IMDSv1 calls from your instance's boot phase. This allows you to pinpoint exactly what you need to update to get your instances ready to use IMDSv2-only(2/2)

IMDS Packet Analyzer
GitHub: https://t.co/xlVRH7Y4Ev

#securityengineering

[Asif Wani @KernelCrypt]

If you're responsible for managing the migration to IMDSv2 within a vast AWS ecosystem, I highly recommend exploring the IMDS Packet Analyzer.

This analyzer helps to identify the processes and details related to how IMDS was called. (1/2)
#security #cloudsecurity #awssecurity

[Matt Johansen @mattjay]

🧵 HUGE Update around the active exploitation of MOVEit 0day!

From @HuntressLabs - CVE-2023-34362 is not just SQLi - they reversed it and found full RCE as well...

[ch @chybeta]

CVE-2022-36804 Bitbucket Server RCE

[j00sean @j00sean]

Full disclosure for CVE-2021-21042 + CVE-2019-7040 is ready right here.

https://t.co/zj6aGsJb2F

[Phith0n @phithon_xg]

How I make a environment variables injection to a RCE. (in Chinese)

https://t.co/k7YFbfPWkT

[Asif Wani @KernelCrypt]

💯

[e. v. m. @evm_sec]

95% of advanced software RE is developing that gut instinct to know when your tools are wrong...