mar73Lon

Principal Consultant @Google Cloud (Mandiant)
Bug Bounty Hunter:

[mar73Lon @mar73lon]

Working on releasing a CommandoWeb, @FireEye tool. This docker container will be filled with all different web testing tools, dependencies, and code that can help you during the different phases of your engagements, bug bounty hunting, AppSec research and more!!

[mar73Lon @mar73lon]

@intigriti Or content type converter extension!

[mar73Lon @mar73lon]

@ConsciousHacker @microcenter They like to do the post it notes on the door! Haha

[mar73Lon @mar73lon]

@YShahinzadeh Especially with output on reactJS. I have found several stored XSS because developers fail to sanitize output on forms, etc.

[mar73Lon @mar73lon]

This is so accurate for all of us web testers out there! lol

[LiveOverflow 🔴 @LiveOverflow]

Web Security vs. Binary Exploitation

[mar73Lon @mar73lon]

I don't care how advanced you are...

Every once in a while, you need to revisit the fundamentals of your technology knowledge.

Do yourself a favor... enroll in an introductory course with updated materials.

You might be surprised at what you've missed.

[mar73Lon @mar73lon]

@Alra3ees Sorry I meant paramspider but I guess gospider also applies lol

[mar73Lon @mar73lon]

@Alra3ees To increase the chances of finding a vulnerability, you should add a step using GoSpider to help spider to application to find more potential endpoints, then a quick find/replace to see {targets}

[Alyssa (she/her) @ramen0x3f]

🚨🚨This is your friendly reminder, we (@Mandiant) are looking for a **researcher/threat hunter** to join us
- diving into cool tradecraft
- tracking down big game threat groups

What are you waiting for? 👀Research is a blast! (the team is cool too) https://t.co/pJg3B2sLOb

[mar73Lon @mar73lon]

@r3dQu1nn Or, just install the duckduckgo browser extension 😉

[Chris Higgins @ch1gg1ns]

Every time I write "senior consultant", I want to instead write "señor consultant". Hello, I am señor consultant.

[Edward Snowden @Snowden]

Facebook and Instagram go mysteriously offline and, for one shining day, the world becomes a healthier place.

#facebookdown

[Ben Sadeghipour @NahamSec]

Udemy course for free. Part 2. Enjoy!

https://t.co/G4UftyGYX1

[mar73Lon @mar73lon]

@Matt_Grandy_ Where are you staying man?

[Sam Curry @samwcyo]

Found a really interesting reverse proxy vulnerability where the frontend authorization check parsed/validated the integer from the string (123/\?& == 123) then passed the whole argument to the internal API. You could access other people's data via id=YOUR_ID/../VICTIM_ID, and...

[mar73Lon @mar73lon]

My boy doing work!!

[mar73Lon @mar73lon]

The Docker image will contain tools for these separate phases:
Information Gathering
Discovery
Application Configuration
Input Validation
Injection Tools
Bruteforce and fuzzing tools - with corresponding wordlists
Cracking tools such as JTR/Hashcat

[mar73Lon @mar73lon]

Working on releasing a CommandoWeb, @FireEye tool. This docker container will be filled with all different web testing tools, dependencies, and code that can help you during the different phases of your engagements, bug bounty hunting, AppSec research and more!!

[mar73Lon @mar73lon]

This container aims to have all of the sufficient tools and wordlists without research, dependency issues, installation, and have a successful web app engagement.

[mar73Lon @mar73lon]

@ConsciousHacker @FireEye I think I know a guy lol