Rojan Rijal

Offensive security research & building @OphionSecurity

[Rojan Rijal @mallocsys]

Have we tried turning the Internet on and off again? #PHP2Shell #node2shell #http2shell

[Rojan Rijal @mallocsys]

If you’re engineering new projects or writing code, I’d recommend @ThinkstCanary. With how fast companies are getting hacked and API keys keep getting stolen, setting up these tripwires might help you get alerted before a vendor even tells you they’ve been hacked. #cybersecurity #hacking

[Rojan Rijal @mallocsys]

@JustJake Sorry to hear this @JustJake ! Let us know if we can help!

[Rojan Rijal @mallocsys]

@S1r1u5_ This has been my experience with building out Ophion Security with the team. There is so much fun things happening in security

[Niraj Bhusal @bhusalnj]

https://t.co/9et8svB6Qv is now live.

You can donate to the Government of Nepal Prime Minister’s Disaster Relief Fund from anywhere in the world via debit/credit card (Visa/Mastercard, 3D Secure), mobile banking, connectIPS, wallets, UPI-India, UnionPay, eSewa, or Alipay+.

Choose USD or NPR. Large donations can also go via SWIFT.
Official channel. Direct. Transparent.
Support rescue, relief and rehabilitation operations.

Donate: https://t.co/ddlfcLJYKs

#DonateToNepal #PMDRF #NepalRelief

[Rojan Rijal @mallocsys]

If you are an on-site volunteer working on rescue effort, helping provide medicine and more in Nepal, please also consistently check https://t.co/OPmgXTYwwl.

We are consistently uploading more photos and data on missing loved ones. If you identify anyone, contact information of their loved ones is also shared directly.

#nepal #nepaldisaster #nepalflood #rasuwa

[Rojan Rijal @mallocsys]

With the devastating situation going on in Nepal, we have built a website to share about your loved ones with ease allowing you to uploda their photos and information. We also correlate the data with NDRRMA website to identify rescued loved ones with the profile.

https://t.co/OPmgXTYwwl

#nepal #nepaldisaster #nepalflood

[Rojan Rijal @mallocsys]

Damn, I get it Claude it is critical.

[Rojan Rijal @mallocsys]

@adnanthekhan What has been your experience with Bedrock like specially around the cost? Have been thinking of doing something similar for a different use case but I am not sure what the cost would be like.

[Rojan Rijal @mallocsys]

@disputifier @disputifier let us know if we can help in any way! No expectations or selling anything.

[Matthew Prince 🌥 @eastdakota]

Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online.

That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values.

In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country.

Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers.

I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection.

In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders.

THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!

[Rojan Rijal @mallocsys]

If you are building a vibe coded app and launching a product out of it, hit us @OphionSecurity and we will do a security assessment and have actionable security measures ready within 72 hours. #vibecoding #security #cybersecurity

[Pop Punk 🇺🇸 @PopPunkOnChain]

If you want free API keys just open the network tab on literally every vibe coded app.

In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.

[Rojan Rijal @mallocsys]

I just got access to an attacker's daily diary. Here is what I learned 👇

🕘 9:00 AM: Clock in.
🔎 9:12 AM: Google Dork says https://t.co/PpN8LQE7bz is still alive.
😎 9:30 AM: No rate limits, no auth. Just vibes.
🗃 10:00 AM: Dumped staging DB from https://t.co/aa8ZDOvcp3.
😬 10:20 AM: Reused creds work on prod. Consistency is key.
🛡 10:45 AM: Oh no… a WAF!
😈 10:46 AM: JK, it’s only on www. Your 12 forgotten subdomains are unprotected.
🥪 12:00 PM: Lunch break. Your asset inventory is crying is forgottenland.
💀 2:00 PM: You schedule a pentest.
📅 2:01 PM: For next quarter.
🪄 3:00 PM: Still pivoting. Still no alert.
🎯 4:30 PM: Internal Jenkins on an old subdomain. Secrets everywhere.
💰 4:45 PM: Got user data, employee data, AWS keys. It’s a buffet.
🕔 5:00 PM: Clock out. Easy day.

jk.....
Attackers don’t follow your IR plan.
They don’t wait for your quarterly pentest.
They don’t work 9–5.
They hunt exposed assets, old creds, shadow subdomains, public GitHub leaks, leaked data in SaaS that will give away more information or give PII etc.
They’re hacking every minute.
Are you?

#attacksurfacemanagement #offensivesecurity #cybersecurity #hacking #continuousmonitoring #assetinventory #offensivemonitoring

[Rojan Rijal @mallocsys]

I hacked UberEats in 2017. Here is the story.

#ubereats #hacking #uber #cybersecurity #bugbounty

[Rojan Rijal @mallocsys]

It was amazing to present at @_kernelcon_ today. Thank you for the gift KernelCon team! #kernelcon #offensivesecurity #researchontheroad

[Rojan Rijal @mallocsys]

💥 Q1 Update from the Field: Real-World Hacking with Orion 💥

In Q1, we pointed Orion, our offensive Attack Surface Management platform, at a large enterprise to see what it could uncover. The results speak for themselves:
🔍 𝟵 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱
🚨 𝟴 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹, 𝟭 𝗛𝗶𝗴𝗵
🤖 The High severity finding was discovered entirely by Orion with no human involvement
💰 Approximately $𝟰𝟱,𝟬𝟬𝟬 in rewards from responsible disclosure
🌐 Orion also surfaced multiple vulnerabilities in widely-used open-source software such as a supply chain vulnerability in a Microsoft repository

The 9 issues had the potential to expose millions of users’ sensitive data including 𝗦𝗦𝗡𝘀, 𝗗𝗼𝗕𝘀, 𝗲𝗺𝗮𝗶𝗹𝘀, 𝗮𝗻𝗱 𝗮𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀. If exploited, they could have led to major regulatory fines, incident costs, and increased insurance premiums.

𝗤𝟮 𝗴𝗼𝗮𝗹: 𝟱𝟬+ 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀. 𝗟𝗲𝘁’��� 𝗴𝗼 🔍⚔️

#OffensiveSecurity #AppSec #RedTeam #SecurityAutomation #BugBounty #ASM

[Rojan Rijal @mallocsys]

RT @uraniumhacker: We are doing #VibeSecurityForAI

If you are an AI startup (pre-seed or seed ) we will test your application for free. We…

[Rojan Rijal @mallocsys]

Not yet a full multiplayer but doing some basic "Simon Says" style game with increasing difficulties. Will add leaderboard style system soon. Open to ideas to improve it further @levelsio https://t.co/H7LfymszAt