n3mo

[n3mo @n3mohb]

@y198_nt vjp

[TrendAI Zero Day Initiative @thezdi]

Collision – The VNG Security Response Center was able to execute a 2-bug chain against the QNAP TS-464. However, the exploit they used was previously known. They still earn $5,000 and 1 Master of Pwn point. #Pwn2Own

[VNG Security Response Center @vngsecresponse]

We're really happy to share our improvements and some experiments for the CookieMonster tool.

Weaponizing Monster for Cookies Attacks: https://t.co/zUlvGEHTkr

Also include burp-extender plugin for burp suite. Hope you guys enjoy it.

~Cheers,
VSRC

[B/R Football @brfootball]

This summer's transfer window was wild 🤑 https://t.co/Z0ISbwrvMX

[VNG Security Response Center @vngsecresponse]

Ladies and Gentlemen: The new Dojo opens to welcome black belt Hackers to fight for honor!!! #VSRC

Liferay revisited: A tale of 20k$. https://t.co/Opa58lorMO
Hope you guys enjoy it and stay tuned for more technique writeups / blogs / exploits ... will come.

~Cheers,
VSRC

[shubs @infosec_au]

1/10 - I've been doing offensive security source code review for a long time now, and along the way I've learnt a lot of lessons that can make you more effective. Some of them include:

[shubs @infosec_au]

I've released the first episode of Bug Bounty Redacted today (Exposed Redis & HAProxy):

https://t.co/AA0xlUE1k2

This series walks you through real bug bounty reports that were rewarded, and explains the discovery process, and reporting process in detail.

New episodes Monthly!

[Polaris @polarisinfosec]

Polaris rolled out protection for our customers using our Web Application & API Protection against log4j2 vulnerability (CVE-2021-44228). We have refined the rules to block more advanced WAF bypass payloads.

https://t.co/0mqG7cszAx

[s1r1us (mohan) @S1r1u5_]

Slides for our(@rootxharsh) BSides AMD talk

Felt good sharing on the speakerdeck because I learned a lot of cool stuff from Filedescriptor's and Masato's slides on speakerdeck.

https://t.co/mCAceSj6Qh

[n3mo @n3mohb]

@arkark_ can i get this blog?

[Thanh Nguyen @redragonvn]

Our Pre-Auth RCE exploit for Atlassian Confluence (CVE-2021–26084) was leaked after reporting it to @VMware. They have refused to admit the leak and ignored our emails.

https://t.co/cwainPWv9y

[LiveOverflow 🔴 @LiveOverflow]

using z3 to reverse a custom hash during a CTF be like

[Cyber Advising @cyber_advising]

👺XSTREAM<=1.4.17:
-CVE-2021-39141（RCE）
- CVE-2021-39144（RCE）
- CVE-2021-39150（SSRF）
- CVE-2021-39152（SSRF).

PoC
https://t.co/hzyk189ApL

[最多情報局 @tyomateee]

野生のフクロウ、間違えて一瞬だけ気持ちよくなる https://t.co/rUh3Y9gDmR

[Google VRP (Google Bug Hunters) @GoogleVRP]

Get ready for the 2021 Google CTF! Runs for 48 hours, starting Saturday, July 17, 00:01 UTC! Details: https://t.co/jfbAZtTN4g

[Forrest Brazeal @forrestbrazeal]

Finally, a use for math!

"The Ransomware Song"

[n3mo @n3mohb]

@ptracesecurity may you dont need to brute reset-token!

[Patrik Grobshäuser @ITSecurityguard]

I found two more!!! #XSs #payloads

1. stop:alert()
2. posting:alert()
3. nonesense:alert()
4. bugbountytips:alert()
5. please:alert()
6. thank:alert()
7. you:alert()
8. bro:alert()

#bugbountytips