Timo Müller

[Nicolas Grégoire @Agarri_FR]

I just updated my "Freebies" page, in order to add the content I recently published:

- the 30' talk given at @NorthSec_io
- the 70' hands-on workshop streamed during #nahamcon2023

The page now contains direct links to the slides and videos, enjoy! 🎁

https://t.co/NA4KbudIJ8

[Timo Müller @mtimo44]

Excited to be at the German #OWASP day with @mogwailabs
If you're here just say hi :)

[Timo Müller @mtimo44]

@mogwailabs More self-generated #Keycloak #CVE content coming soon :)

[Hans-Martin Münch @h0ng10]

Im Rahmen des Cyber Security Challenge Germany (CSCG) Finales in #Ulm findet Ende Juni ein CTF-Einsteigerworkshop statt. Ideal für alle die schon einmal in das Thema #Cybersecurity / #CTF reinschnuppern wollen. Vielen Dank an
@ulm_donau
@c_s_c_g
@codewhitesec
@mogwailabs

[MOGWAI LABS GmbH @mogwailabs]

Ever gained access to a Laravel .env file/APP_KEY but cookie deserialization is no longer a thing? @mtimo44 researched some other attack vectors for this scenario. More in our latest blog post: https://t.co/JGfa3i6VY2

[MOGWAI LABS GmbH @mogwailabs]

Rapid7 just released a blog post for a vulnerability in Ruby-MySQL that we originally reported last year as an Metasploit issue.

[Timo Müller @mtimo44]

@lgrangeia @h0ng10 Sorry that was a small syntax error within the post. It should show the "${java:version}" just fine now :)

[Timo Müller @mtimo44]

@PortSwigger Thanks for the reply, after some more waiting the machine was working as expected again and i could finish the exam :)

[Timo Müller @mtimo44]

Hey @PortSwigger . I'm in the middle of the certified practitioner exam, and made the exam machine unresponsive during the exploitation of a SQLi vuln. After 22 minutes it hasn't recovered. Is there a way to reset the machine or is this just a failed attempt?

[Timo Müller @mtimo44]

Leaving the lovely #Ulm to attend #BruCON0x0D.
Looking forward to a great conference, friendly faces, and tasting Belgium treats. Prayers to the German DB to actually get me there.

[MOGWAI LABS GmbH @mogwailabs]

Here our blog post about bug hunting with #CodeQL, finding variants of CVE-2016-3427 (Java deserialization vulnerabilities in JMX/RMI authentication): https://t.co/ZqPektWTWx

[Timo Müller @mtimo44]

@Burp_Suite I just tried out this configuration and couldn't get it to work. (I assume it works the same as customHttpContent?). Could you please confirm this issue?
A nice to have usability feature request: a warning for unexpected keys within the collaborator config would help troubleshoo

[Timo Müller @mtimo44]

Hey @Burp_Suite in the patch "professional 2021.4.2" you announced that it's now possible to add DNS TXT records to self hosted collaborators. I can't find any documentation for it, could you please hit me up with a link to the doc or an explanation? Thanks!

[Timo Müller @mtimo44]

@Zweilandstadt Söder hat es explizit eine #ausgangsbeschraenkung genannt. Es jetzt als #Ausgangssperre zu bezeichnen mindert nur den Effekt einer wirklichen #Ausgangssperre, sollte diese in Zukunft kommen. Leider schreibt sich die headline "Ausgangssperre" einfach besser...

[MOGWAI LABS GmbH @mogwailabs]

In our latest blog post, we take a closer look at @_tint0 s RMIRegistry Bypass gadget
https://t.co/X4CinCuf9R

[MOGWAI LABS GmbH @mogwailabs]

Ever asked yourself what you can do with a SNMP rw-community on a Linux target? Look no further! Check our new blog post by @mtimo44 and @h0ng10
https://t.co/UkYyYqumHT

[Timo Müller @mtimo44]

Feels like I'm carrying 5 weeks worth of stuff through a storm front ... Still hyped though for an amazing week full of learning and networking @WEareTROOPERS thanks again for helping a student out :)

[MOGWAI LABS GmbH @mogwailabs]

New blog post on patching and repacking iOS apps during security audits:
https://t.co/hBSLh38nnV

[MOGWAI LABS GmbH @mogwailabs]

We are sponsoring BSides Munich this year :)

[Timo Müller @mtimo44]

@stfn42 https://t.co/2KpsEcE3xV has a nice selection of (eye pleasing/ easy to follow) recipes.
On top of that, with a 50% "News customer" voucher these boxes are decent value and worth a try.