Tim Tomes

Believer † | Husband :-* | Father \o/ | Veteran o7 | PractiSec | "Burp Suite master and king of making HTTP requests tremble."

[Tim Tomes @LaNMaSteR53]

If you've seen me present, you know I introduce myself as a follower of Jesus. Everyone has an opinion of what that means. Can I challenge you to watch this explanation? It's more important than anything I've ever said, and may surprise you. https://t.co/4DbVU43xc1

[Wild West Hackin' Fest @WWHackinFest]

Don't ya go missin' @LaNMaSteR53's talk "Web Application Authorization: Taming the Perfect Storm" at Wild West Hackin' Fest - Deadwood 2025! Grab yer tickets before time runs out! -> https://t.co/FI92HNjnHm
#WWHF #Deadwood2025 #TheFutureIs

[Tim Tomes @LaNMaSteR53]

It's the last week to sign up for Practical Web Application Penetration Testing (#PWAPT) and the Practical Training Bundle. Class starts next Monday! https://t.co/sh1G4JW3VA

[Tim Tomes @LaNMaSteR53]

Just submitted a talk titled "Web Application Authorization: Taming the Perfect Storm" to the @WWHackinFest CFP. I am particularly excited about this one. It's the first time I'll be sharing how I tackle authorization outside the classroom, plus a few extra goodies.

[Tim Tomes @LaNMaSteR53]

Greetings! There are 2 training opportunities currently available on my events page at https://t.co/sh1G4JWBL8:

* PWAPT beginning April 7th
* PBAT beginning June 9th

Bundle them and save $500!

[Tim Tomes @LaNMaSteR53]

Just pulled this gem out of a client code base:

"AESKey": "dsfsfdfgsdfsgfdg",

I guess their version of a cryptographically secure RNG is to smash the 4 main fingers of their left hand on the keyboard 4 times.

[Tim Tomes @LaNMaSteR53]

@Ch33z_plz There is admin enforcement in the actual code, but I left out for brevity. Probably should have made that more clear. But yes, your disgnosis is correct. Lastly, the route for `schedules`, is missing the preceding `/`, which means it isn't a match and can already be accessed.

[Tim Tomes @LaNMaSteR53]

This is real code I am working with today. This is an authorization check protecting admin-only resources. There are multiple ways to bypass this. What are they? For additional context, this is middleware for an Express.js back end.

[Tim Medin @TimMedin]

Join us on the @RedSiege Wednesday Offensive with @LaNMaSteR53 discussing testing web apps for authorization issues. Join us for just 30 minutes (and no slides!) at https://t.co/atzUBErk1N.
Awkward fam photo time!

[Tim Tomes @LaNMaSteR53]

I'll be on Wednesday Offensive with @RedSiege today talking about testing for authorization issues in web applications. Would love you have you along. Join us! https://t.co/ir49H9kVrn

[Tim Tomes @LaNMaSteR53]

As always, I thoroughly enjoyed presenting at WWHF and appreciate the opportunity. If you enjoyed the content of my presentation, then keep an eye on my socials, as I will be announcing my first training opportunities for 2025 in the next week. Happy New Year everyone!

[Wild West Hackin' Fest @WWHackinFest]

Check out @LaNMaSteR53 's talk, "{JWT}.{ Misuse}. & Abuse," from Wild West Hackin' Fest - Deadwood 2024! https://t.co/yeQMIgVch7

[Wild West Hackin' Fest @WWHackinFest]

Check out @LaNMaSteR53 's talk, "{JWT}.{ Misuse}. & Abuse," from Wild West Hackin' Fest - Deadwood 2024! https://t.co/yeQMIgVch7

[Tim Tomes @LaNMaSteR53]

@PortSwigger What parts of the API were added? The dropdown documentation looks the same. Is the AuditIssue class accessible?

[Tim Tomes @LaNMaSteR53]

Anyone on my feed have a connection with the Carolina Hurricanes?

[Tim Tomes @LaNMaSteR53]

I was literally saying this to a friend the other day and wondered if I was the only one that noticed. I'm glad I'm not. https://t.co/ZX7vrDBXxB

[Tim Tomes @LaNMaSteR53]

@hacks2learn My pleasure. The filtering capabilities are in the proxy configuration panel. It behaves like a split-tunnel for HTTP traffic. Pretty awesome. Make sure you set FoxyProxy to proxy by filters though, or they won't apply.

[Tim Tomes @LaNMaSteR53]

I actually use the FoxyProxy browser extension to accomplish this. It's another tool you have to install (downside), but it persists across projects (upside). Thanks for the tip!

[Tim Tomes @LaNMaSteR53]

@brightball Pay to play, eh?

[Tim Tomes @LaNMaSteR53]

I'm going to try and be more active on this platform again. Any tips for finding favor with the algorithm? My engagement is next to zero, and it doesn't seem to matter how many followers I have. Thanks!

[Tim Tomes @LaNMaSteR53]

@jessecooper Communities and Spaces? ... I've been gone for a while. I got some catching up to do.

[Tim Tomes @LaNMaSteR53]

@bl4nk_io Bah. That's too bad. Maybe I can add some value. I'll try not to be a bot.