Jacob

Offensive Security Managing Consultant at @CyberCX | Threat Researcher

[Jacob @larsencyber]

I'm excited to share that my talk from #BlackHatUSA is now live on YouTube! https://t.co/tt0kfpPqCL

[Jacob @larsencyber]

@trace37_labs @Hacker0x01 It is such a difficult situation to be in as a hunter. I value doing everything by the rules, but in circumstances like there where the platform is creating risk, not mitigating it, direct contact to the company is sanctioned. I really hope this bug you found gets resolved ASAP.

[Jacob @larsencyber]

@prebenve @metabugbounty Great read, very cool bug!

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[Jacob @larsencyber]

@_naaash_ Nice work, I find basically an identical bug to this, same techniques and method.

[Jacob @larsencyber]

@hakluke The tax changes definitely makes small businesses and startups reconsider where they are based. Honestly sad, hopefully it doesn't pass.

[Elon Musk @elonmusk]

SpaceX is actively hiring world-class engineers/physicists for SpaceXAI, even if you have zero prior experience in AI. Smart humans figure it out fast.

Please send an email with ~3 bullet points demonstrating evidence of exceptional ability to [email protected].

[bugcrowd @Bugcrowd]

Tip of the day:

When you're hacking with AI, it pays to know when deterministic tooling is better than AI.

A good rule of thumb is this:

AI = fuzzy inputs and outputs
Deterministic tools = clear inputs and outputs

For example:
Want a list of subdomains? Use a deterministic tool like subfinder or amass.
Want to "check the list of subdomains to see if any of the hostnames look interesting"? use AI.

The real magic happens when you combine them.

[Jacob @larsencyber]

@thezdi @orange_8361 Wow this is insane!

[Jacob @larsencyber]

@Zaddyzaddy @BugBunny_ai @Hacker0x01 You should probably validate by human first before submitting. I'd be curious what your accuracy % rate is. A lot of the platforms are complaining from being spammed by AI validated bugs that haven't been reviewed by humans.

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Jacob @larsencyber]

@ggwhyp Wow, incredible work. Can't wait for the writeup.

[Jacob @larsencyber]

@caseyjohnellis Jeez people Photoshopping XSS.. that is so pathetic

[Jacob @larsencyber]

@caseyjohnellis Second thought - how about prioritised triage for submissions which contain a PoC video? Or even enforcing videos for P3 and above?

[Jacob @larsencyber]

@caseyjohnellis I've seen your first point circling around a lot. Tbh I think the focus should be on implementing historic submission accuracy % requirements for submissions. Sure there will still be slop, but it will at least prevent people who are spamming fp bugs with 1-25% historic accuracy.

[Jacob @larsencyber]

@Mr_Husky1 This is horrible. Unfortunately academia is rife with professors publishing students papers as their own as the "main author", offering only "editor" or nothing at all to the student. When I first saw this it made me realise academia is a complete scam.

[Jacob @larsencyber]

@3ugman You should try change the user's email to an existing user's email and see if it is possible to do an account takeover or similiar.

[Jacob @larsencyber]

@3ugman Marked as informative because there is no security impact. A user with a valid session can change their own email? Even despite the UI not permitting it, there is no clear risk or impact.

[Jacob @larsencyber]

@termireum Try use alterx to create intelligent target specific subdomain permutations.

[Jacob @larsencyber]

@siratsami71 @Hacker0x01 Nice, found it purely by recon and fuzzing?