PombaLabs

XGH Certified Professional | Opinions are not my own; they are from the hivemind. All hail the hivemind.

[PombaLabs @pombalabs]

@emergencedaily @chompie1337 LAN parties!

[disco elysium physique quotes @discophysique]

YOU - What am I doing?

SHIVERS - Looking up at the sky, cold water dripping from your hair.

YOU - What do I see?

SHIVERS - Grey sky like great battleships, clouds colliding with one another. Rain falls down on the world.

[PombaLabs @pombalabs]

@trackchartt @araki_jojo

[Lukáš Hozda @LukasHozda]

Someone made a counterstrike 1.6 CSS framework.

Design is over, we have reached peak

[manfer @manferscores]

passando mal com o show de drones na virada da praça da liberdade em bh e o react com o queijo partindo

[Augusto @bur6u35]

inclusive, recomendo a leitura para qqr pessoa que é de segurança.
https://t.co/RzJlJ10YFG

[s1r1us @S1r1u5_]

Pick a niche, become an expert, find bugs maybe even 0days or reverse n-days, and write blogs. Even if you don’t hit those $100k bounties, it’ll be a stepping stone toward a $100k job.

What niche? How to pick? Examples?

infosec being so vast from web3 sec to web2, mobile, desktop, recon, client-side, server-side, cryptography and so on. These are umbrella terms, but if we zoom in, there are specific areas where spending a lot of focused time will make you a top 20 expert -- 100% sure.

The key thing is, that the current top 20 experts in any niche will eventually be replaced as they get bored or burned out. This leaves room for you, and the easiest way to pick a niche is to learn from an existing expert in the niche, take inspiration, and grind to build on top of it.

1. For instance, I got into the client-side JS niche by following @terjanq’s work. From there, I went down even further to focus specifically on ElectronJS.

2. Another example: @rootxharsh and @iamnoooob their niche is in reversing n-days and finding new ones based on that knowledge. I don’t think anyone in India can compete with them on reversing n-days, writing blogs, and submitting findings to bounty programs.

3. And off the top of my head, @ajxchapman, from his tweets, seems to have a specific niche in V8 n-day exploits. I don’t think there’s anyone else in the web security scene who can write V8 exploits 😅.

4. Like @orange_8361 , pick a complex target and grind on it for months eventually uncovering mind-blowing findings.

5. Or, like @albinowax, choose a complex specification, such as HTTP, and find bugs from every aspect of it from top to bottom
(Sorry for tags xD)

I could list so many more people, but my point is this: if you look at the top bug bounty hunters or experts, there’s a pattern. Their blogs or tweets consistently focus on a specific niche (or two) for years and years. No one ever becomes a pro in a night.

How to Become an Expert in a Specific Niche?

Spend a lot of time. There’s no shortcut. Follow the work of the expert you picked for inspiration, read their blogs, dive into the blogs they learned from, and explore everyone else in that specific niche. Solve CTFs and write about them.

For example, not to make it all about myself, but just as an example. I’ve read every blog from the people I listed as inspirations(https://t.co/5MCSPeoygf) while learning client-side security.

If it’s taking time to understand, you’re likely on the right path. That’s where most people give up, so keep pushing. Just dedicating days to it will put you ahead of at least 100 others. It’s that simple.

Expert = Spent Time × IQ

Find Bugs or 0days, Reverse n-days, and "Write Blogs

Once you’re an expert, finding bugs will start to feel natural. But let’s be real, sometimes you might not get lucky. When that happens, reverse other n-days and write about it. I mean write about anything. Nothing gives you as much exposure as writing blogs: you’re helping others, plus you’re building a network that will eventually help you land a $100k job or $100k bounties.

[Cloud Village @cloudvillage_dc]

The Oracle Awakens: Demystifying Privilege Escalation in the cloud talk is out now!

https://t.co/L7z9L7g5X0

Subscribe the channel to not miss any future video releases.

Cheers!

[PombaLabs @pombalabs]

@HmnAdi88 @kbalakri @meatballtimes @Carl9000 Do what, invest in a profitable line? Yeah, that's what uber is doing.

[PombaLabs @pombalabs]

@HmnAdi88 @kbalakri @meatballtimes @Carl9000 Are you serious?...
If you have 100$ and invest it in a line which pays you 105$, you still have the "original" 100$ to invest in a non-profitable line, plus 5$.

"I'm sure city designers would have done it" - Lmao, lol, haha, omg

[あいか# @aika_ai_110]

※クリック推奨
#OMORI #OMORIFANART

[Cloud Village @cloudvillage_dc]

Here's our updated list of speakers! We were able to squeeze in a couple more talks to our @defcon 32 lineup!

Get ready for action-packed days of talks, workshops, and tool demos.

Don't miss out to mark your calendars! 📅
More details at - https://t.co/T8ABCGEfxR

#DEFCON32

[PombaLabs @pombalabs]

Seems like their MO is to copy recent "trending" comments, get more likes on them (maybe using their own botnet for this) and let them continue trending to the top.

This causes the top comments majoritarily porn bots.

[PombaLabs @pombalabs]

Interesting observation from yesterday:

Youtube comments from some channels are infested with porn bots. The comments are "good" - they're getting likes, they're relevant to the video, they don't seem AI generated, etc. (1/2)

[Cloud Village @cloudvillage_dc]

Join us at @defcon 32 for @Pr0teusBR and @pombalabs talk on Oracle Cloud privilege escalation!
Learn how attackers exploit misconfigured policies and discover ways to enhance your security posture.

#DEFCON32 #CloudVillage #CyberSecurity #OracleCloud

[Liv Matan @terminatorLM]

Meet ConfusedFunction 😕 - A privilege escalation vulnerability I recently discovered in GCP:
https://t.co/rQo8jmn4Sn

[PombaLabs @pombalabs]

@sushicomabacate Isso aí não significa necessariamente que a Alura foi vazada, só que a mesma senha que ele usou na Alura vazou em algum lugar, talvez de uma conta que nem seja dele.

...Mas se ele tinha essa senha SÓ pra Alura, aí é suspeito.

[PombaLabs @pombalabs]

The WAF Swiss-Knife

"You’ll learn to use your WAF as a swiss knife. Not the absolute best at anything, but very versatile, quick and life-saving in some situations."

https://t.co/3NguG4n2nA