Lev

"Resilience is the ultimate foundation for triumph"

[Lev @ledz1996]

I have a blasting 2020 with doing #bugbounty on @gitlab Hackerone. I will be publishing write-ups of some findings that may sound interesting to people here:
https://t.co/qCC9F41NZe

[HackerOnTwoWheels @HackerOn2Wheels]

I’ve hacked every major crypto exchange. Reported critical vulnerabilities that would make the news if we disclosed.

If you are scared of holding your crypto in cold storage because of the Coldcard hack and is thinking you are better off holding in an exchange, I can tell you one thing with certainty.

Do not trust Binance. You WILL lose your funds.

[Lev @ledz1996]

This was done with zero AI as well, the poc script is the only thing generated out of it, im very disappointed with the decision that they are making and the lack of comms

[HackerOnTwoWheels @HackerOn2Wheels]

Me and @ledz1996 are still trying to communicate with the @coinbase and @JLunglhofer team regarding an extreme severity vulnerability and still getting ghosted and no replies.

I used to praise this program, and always recommended to every researcher. It is completely changed. Seems like we will likely have to go for the disclosure route unfortunately.

Trying to make last ditch effort to have some kind of dialog with them though.

Sad

[HackerOnTwoWheels @HackerOn2Wheels]

Me and @ledz1996 are still trying to communicate with the @coinbase and @JLunglhofer team regarding an extreme severity vulnerability and still getting ghosted and no replies.

I used to praise this program, and always recommended to every researcher. It is completely changed. Seems like we will likely have to go for the disclosure route unfortunately.

Trying to make last ditch effort to have some kind of dialog with them though.

Sad

[Lev @ledz1996]

@al_f4lc0n pull out the risk management and rate limit card after everything xddddd

[Lev @ledz1996]

@Xeratricky Abrams deal stupid amount of damage at any given point of the game. Vamparic burst and dbr make anti heal feel useless lategame

[HackerOnTwoWheels @HackerOn2Wheels]

Karma for Binance being the biggest scammers in bug bounty.

[Lev @ledz1996]

I may be the lucky one since that was the only time that I was truly disappointed in a program and how they react. Despite all that, the trust is not lost in some programs in web2/web3. Most of them are old, battletested but you won't be disappointed when you spend time one them

[Lev @ledz1996]

WE just had the worst experience on one program for one of the (if not) the biggest exchange in the world. A lot of gas lightings, downplayings, legal threats.But I still believe in the bug bounty world, it changed my life. there are still some trustworthy programs (OKX, GitLab)

[100proof.org @1_00_proof]

Absolutely awesome to see @MitchellAmador go out to bat for us whitehats at @summit_defi

https://t.co/FWjq4wKyR2

[HackerOne @Hacker0x01]

Our #H165 live hacking event with @tiktok_us and @okx in Singapore was a big success! It's time to celebrate this year's winners. Here we go... 🥁

For TikTok:
Eliminator: avishai
Exterminator: kevin_mizu, shubs, hashkitten
Vigilante: m4II0K

For OKX:
Eliminator: hackerontwowheels, ledz1996
Exterminator: corraldev
Vigilante: corraldev

Overall:
Community choice: nadino
Best collab: kevin_mizu, shubs, hashkitten & hackerontwowheels, ledz1996
Most valuable hacker: corraldev

[Lev @ledz1996]

https://t.co/bvaXTJ7vCC - The Yeah Thing

[HackerOnTwoWheels @HackerOn2Wheels]

Thanks @Hacker0x01 and @okx team for an amazing LHE and warm reception.

#h165 was awesome, really cool meeting everyone.

Leaving Singapore 2nd place 🥈 , and taking these cuties home.

Won Best Collaboration and Eliminator rewards with my buddy @ledz1996 .

God is good.

[Lev @ledz1996]

@HackerOn2Wheels Brother, it would be a worthless bug bounty report, oos for sure lol

[Lev @ledz1996]

@S1r1u5_ And it sometime requires your intuition and instinct thinking (sorry i dont know how to phrase the word correctly) that something LLM is lacking of but you can use it to accel yourself in some boring works to bring out your creativity

[Lev @ledz1996]

@HackerOn2Wheels its like driving without destination once you've got something or done something

[Lev @ledz1996]

@HackerOn2Wheels same brother

[Lev @ledz1996]

@fchralph @antoniogm I would lol, western standards is so fked up lmao try going there please, open ur eyes, jesus christ.
What youve wrote is basically said "its ok to steal from others"

[Lev @ledz1996]

@Creastery excellent find.

[Lev @ledz1996]

Reading the description just angered me so much. MS never fails to disappoint

[FFmpeg @FFmpeg]

The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion dollar corporations expect free and urgent support from volunteers.

@Microsoft @MicrosoftTeams posted on a bug tracker full of volunteers that their issue is "high priority"

[Halvar Flake @halvarflake]

@tdietterich Almost the entire IT infrastructure globally relies on OpenSSH being free of remote vulnerabilities. Hundreds of people have read the code carefully, trying to find new flaws. No closed-source software no matter the amount of third party testing would ever reach that level of ...

[Lev @ledz1996]

@cyb3rops He did that so that 100 engineers from 100 orgs dont have to fuking reverse the god damn patch, thats basically half of the job done, be grateful of what you got and dont be an ass, wont you?

[Carlos Vieira @carlos_crowsec]

if you found an SSRF in an application running on Kunernetes (AWS EKS), the default IAM profile for the node has "eks:DescribeCluster" privileges.
With these privileges, you have access to the "aws eks update-config" command which gives access to cluster certificates.