plenum 🇹🇳

I work as a QA and part time bountyhunter. @hackerone @bugcrowd @intigriti Plenum

[plenum 🇹🇳 @plenumlab]

I just published Identifying and Exploiting Unsafe Deserialization in Ruby XMLRPC https://t.co/ErM5wB8m7R

[Volerion @VolerionSec]

Launching today!

Volerion transforms raw CVEs into structured and instant insights

#CVE #CyberSecurity #infosec

[plenum 🇹🇳 @plenumlab]

@NahamSec And then wonder why do I keep doing this to myself

[plenum 🇹🇳 @plenumlab]

@Blaklis_ @SopraSteriaSecu Félicitations @Blaklis_ j’espère que au moins tu aura une augmentation cette année

[plenum 🇹🇳 @plenumlab]

@rez0__ Congrats all the best

[plenum 🇹🇳 @plenumlab]

Started using bluesky
https://t.co/qYFvY8h39g

[plenum 🇹🇳 @plenumlab]

@intigriti Ssrf -> dns rebind -> access to cloud metadata. The rest is history 😁

[plenum 🇹🇳 @plenumlab]

@ITSecurityguard 🤔

[plenum 🇹🇳 @plenumlab]

@rez0__ Congrats 👏

[plenum 🇹🇳 @plenumlab]

@albinowax @h4x0r_dz Using individual by name is also interesting, to be able to hide all the tracking and unnecessary cookies

[plenum 🇹🇳 @plenumlab]

@_godiego__ In the ever evolving landscape of ...

[plenum 🇹🇳 @plenumlab]

@Jhaddix @DanaEpp @rez0__ @Shopify @G0LDEN_infosec Agreed, regardless of the program, things have been piling up for quite some time now, and we have seen this behavior becoming more common.
Some reports have been disclosed already where we clearly see triage or vendor giving wrong cvss explanation sometimes totally made up.

[plenum 🇹🇳 @plenumlab]

@rez0__

[plenum 🇹🇳 @plenumlab]

@zseano Glad it went good, hope you get well soon buddy

[plenum 🇹🇳 @plenumlab]

The new critical content injection, quality over quantity

[publiclyDisclosed @disclosedh1]

U.S. Dept Of Defense disclosed a bug submitted by ezequielpuig: https://t.co/xtOORAgJbX #hackerone #bugbounty

[plenum 🇹🇳 @plenumlab]

@ctbbpodcast @domain Fun fact you can actually exploit it the other way around, if the app allows incoming emails and uses/shows the sender field, you can send emails with netcat, although it is tricky to not break SMTP syntax it is still a nice bug

https://t.co/X8IzNoDH7c

[plenum 🇹🇳 @plenumlab]

@_godiego__ AC:H, UI:R

[plenum 🇹🇳 @plenumlab]

Are you a hacker ?

[plenum 🇹🇳 @plenumlab]

I'm buying this one.

[plenum 🇹🇳 @plenumlab]

CVSS: custom vulnerability scoring system

[Joseph Thacker @rez0__]

🧠

[plenum 🇹🇳 @plenumlab]

@renniepak Strange way to say "I'm a cool guy" -_(*.*)_- ok