L1M4R

[Kirill Firsov @k_firsov]

php2shell

Tomorrow is a helluva day.

[s1r1us @S1r1u5_]

"3 random dudes”

1. hacked apple, again and again.
https://t.co/5aZcB0RbjF
https://t.co/UdsKrmfFJW
https://t.co/hWDQaimW8c

2. your github enterprise is our github enterprise.
https://t.co/u3UjajnBKq

3. get a discord message from me, get pwned.
https://t.co/pX3RkjxNOX
https://t.co/noscPNmZm9

4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research.
https://t.co/1Th5fvpa21

5. your supabase database is my database.
https://t.co/nOIKthdDnM

6. we got the posthog prod database.
https://t.co/VIeGJz1hKq

7. react2shell? vercel paid us $170k for helping secure their waf.
https://t.co/Y2RgQSdl3g

8. your palo alto vpn is my vpn.
https://t.co/oVB068UhST

9. ai ides? we got shells for you, antigravity
https://t.co/tsvSXQuSS0

10. windsurf rce.
https://t.co/DpdGqmNRvu

11. turning cluely into malware.
https://t.co/8QcIYhXQfS

12. ai browsers? sure, uxss: your perplexity browser is my browser.
https://t.co/WVXlHzY0CB

13. openai atlas too. kinda uxss
https://t.co/jkQWnLD7rV

14. hey, it’s not even our first time hacking discourse.
https://t.co/viI1op7aMf

15. adobe coldfusion: pre-auth rce. because apparently we needed another one.
https://t.co/aFILo3suP2

there’s a lot more. go dig.

anyway, yes: “3 random dudes.”

and @HacktronAI is full of more random dudes like these.

[Joseph Thacker @rez0__]

HUGE news here. Deepseek has remote code execution vulnerabilities on their dev server as well as direct access to one of their databases. 😬😬😬

[Max Hoppenstedt @m_hoppenstedt]

A severe security breach at Volkswagen exposed private data of 800.000 vehicles and their owners, including sensitive GPS info of politicians, business leaders, and police, according to a @derspiegel investigation.
Full story ⬇️ https://t.co/si82p3bOOf

[L1M4R @Mr_Limar]

@christruncer @an0n_r0 @__Masq__ Only for US :(

[L1M4R @Mr_Limar]

@LiveOverflow 😂😂😂

[Intigriti @intigriti]

Did you know a new JWT Attack was recently published?! 🤯️

CVE-2023-30845 bypasses JWT checking by using the X-HTTP-Method-Override request header!

[Hillai Ben-Sasson @hillai]

I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️

[Patrik Grobshäuser @ITSecurityguard]

I just found an unbelievable number of unauthorized API endpoints using this 1 liner.

katana -u $url -hl -nos -jc -silent -aff -kf all,robotstxt,sitemapxml -c 150 -fs fqdn |subjs | python3 /opt/JSA/jsa.py |goverview probe -N -c 500 |sort -u -t';' -k2,14 |cut -d ';' -f1

[Horizon3 Attack Team @Horizon3Attack]

CVE-2022-39952, announced today, allows for unauthenticated RCE against #Fortinet FortiNAC as the root user. Blog post and POC to be released soon.

See Fortinet's PSIRT: https://t.co/sBsrs8Wxqb

[OffSec @offsectraining]

Did you know that you can send information with hping?

Watch and learn from the full box walkthrough of ICMP, a PG Play machine: https://t.co/MuOOj4iCcN

[Het Mehta @hetmehtaa]

How To Hack Traffic🚦Lights?

A Thread 👇 | #Infosec

[Sam Curry @samwcyo]

Super excited to release our car hacking research discussing vulnerabilities affecting hundreds of millions of vehicles, dozens of different car companies:

https://t.co/xCHG5oLYWK

Contributors:
@_specters_ @bbuerhaus @xEHLE_ @iangcarroll, @sshell_ @infosec_au @NahamSec @rez0__

[Corben Leo @hacker_]

My favorite hacking stories of 2022:

[HackerContent @hacker_content]

10 types of web vulnerabilities that are often missed

🐞 HTTP/2 Smuggling
🐛 XXE via Office Open XML Parsers
🐜 SSRF via XSS in PDF Generators
🕷 XSS via SVG Files
🦟 Blind XSS

#bugbounty #pentest #hacking

Thread 🧵👇

https://t.co/c2AIi8ev8Q

[Dylan LeClair @DylanLeClair]

The 29-yr old co-founder of MakerDAO, Nikolai Muchgian has been found dead in in San Juan #PuertoRico, just three days after tweeting the following from his personal twitter account.

[Runa Sandvik @runasand]

I'm able to provide free VPN accounts to journalists in Ukraine. DMs open, reach out and I'll get you set up. 🇺🇦

[The Record From Recorded Future News @TheRecord_Media]

The three political parties set to form the new German government have agreed to stop buying zero-day vulnerabilities and limit the government’s future use of monitoring software https://t.co/VtW8UlC7p9

[ᴀʙᴅᴇʟʀʜᴍᴀɴ ᴢᴀʏᴇᴅ @aufzayed]

scrape subdomains from SSL certs with cero

ssl_scrape(){
whois -h https://t.co/qmduAl3QtJ -- "-i origin $1" | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq | mapcidr -silent | cero -c 500 -d -p 443,8443,10443 | tee -a output.txt
}

#bugbounty #cybersecuriy #infosec

[ᴀʙᴅᴇʟʀʜᴍᴀɴ ᴢᴀʏᴇᴅ @aufzayed]

403-bypass: a collection of wordlists, FFUF commands, and nuclei templates to bypass 403, based on @0xAwali Methodology

🔗https://t.co/pu3PeKQU3M

#bugbounty #cybersecurity #infosec