dls

dot dot slash enthusiast

[dls @putersarehard]

My @securitytrails #reconmaster methodology/thoughts in a thread. I started somewhat late, many people already in the millions of hosts discovered. My first instinct was to automate the submission of Certstream data. 1/n

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[toasterpwn @toasterpwn]

Team Oceania is seeking sponsors for the 2025 International Cybersecurity Challenge!

Support top 🇦🇺🇳🇿 cyber talent and showcase your brand on the world stage.
Learn more: https://t.co/HLz27o0oKr or send me a message.

#cybersecurity #ICSC2025 #infosec

[BSidesCanberra @BSidesCbr]

We’re stoked to announce that @sk8boardingdog – Australia’s top CTF team – are writing and hosting the BSides Canberra 2025 CTF! 🐶🛹💻

They’ve won our CTF 3 years running, and now they’re bringing their skills to make this year’s comp unforgettable.

https://t.co/0WLOMveHMG

[elttam @elttam]

New blog post: New Method to Leverage Unsafe Reflection and Deserialisation and gain RCE on Rails https://t.co/pc2ytyA1PM

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

The Fetch API supports Blob objects as request bodies, not just strings!

Blobs can omit a type, enabling cross-site POST requests without a Content-Type header.

Even with non-empty bodies, the Blob's data becomes the request body!

(credit: @lukejahnke)

[elttam @elttam]

New Blog post: DUCTF 2024 ESPecially Secure Boot Writeup

https://t.co/IS2wyn6LfZ

[shubs @infosec_au]

Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: https://t.co/2yTgn1NzhY

[elttam @elttam]

New blog post and tool release: plORMbing your Prisma ORM with Time-based Attacks

https://t.co/DfUfQR1yJq and
https://t.co/eHlEWIRJWc

[DownUnderCTF @DownUnderCTF]

Australia's largest online CTF competition now welcomes New Zealand in July 2024! With 4200+ users and 2000+ teams as of 2023, it aims to up-skill the next generation of Cyber Security Professionals. Prize eligibility now includes Aussie and NZ students!
#CTF #DownUnderCTF

[Luke Jahnke @lukejahnke]

Blog is live, for now there is a quick puzzle to get to the posts https://t.co/xI316Irhsu

[elttam @elttam]

New slides: Causing Funky Things in your NodeJS Servers by @GhostCcamm (Ruxmon)

https://t.co/KwM8wBg9ox

[PT SWARM @ptswarm]

🎁 Source Code Disclosure in IIS 10.0! Almost.

There is a method to reveal the source code of some .NET apps. Here's how it works.

👉 https://t.co/Fo4tpkaHey

[elttam @elttam]

New blog post: PwnAssistant - Controlling /home's via a Home Assistant RCE

https://t.co/Qu1NZFA2Aq

[elttam @elttam]

Today we're releasing a public beta of Talkback, a smart infosec resource aggregator to help you keep up with news and research. Please visit https://t.co/y3ubhdeLwK and give it a try! We'll be releasing new features and improvements over time.

[elttam @elttam]

New blog post and tool: Cracking the Odd Case of Randomness in Java, by @josep68_

https://t.co/wH5Y2dnSJO

[Lexfo @LexfoSecurite]

A few months ago, we reported a pre-auth Remote Code Execution #RCE vulnerability to @vBulletin. The exploitation of this unserialize() bug was tricky, as vBulletin classes are not deserialisable. Discover the exploitation in our latest blogpost:
https://t.co/6FDbtS4U8K

[elttam @elttam]

Happy new year! We're excited to welcome dls / @putersarehard to the team today.

[@[email protected] @emilyposting_]

we pwned @Tailscale❤️
ft. @JJJollyjim
https://t.co/pIEty139n8

[Márcio Almeida @marcioalm]

This is the technical writeup in how we found and exploited the CVE-2022-41343 (RCE via Phar Deserialisation in Dompdf <= v2.0.0). We presented this vulnerability at Ruxmon September and we are finally doing the public disclosure! I hope you like it ;-) https://t.co/DPgmK2ELXO

[Programmer Humor @PR0GRAMMERHUM0R]

Wizards... https://t.co/SutpnCnt9k