My @securitytrails#reconmaster methodology/thoughts in a thread. I started somewhat late, many people already in the millions of hosts discovered. My first instinct was to automate the submission of Certstream data. 1/n
Team Oceania is seeking sponsors for the 2025 International Cybersecurity Challenge!
Support top 🇦🇺🇳🇿 cyber talent and showcase your brand on the world stage.
Learn more: https://t.co/HLz27o0oKr or send me a message.
#cybersecurity#ICSC2025#infosec
We’re stoked to announce that @sk8boardingdog – Australia’s top CTF team – are writing and hosting the BSides Canberra 2025 CTF! 🐶🛹💻
They’ve won our CTF 3 years running, and now they’re bringing their skills to make this year’s comp unforgettable.
https://t.co/0WLOMveHMG
The Fetch API supports Blob objects as request bodies, not just strings!
Blobs can omit a type, enabling cross-site POST requests without a Content-Type header.
Even with non-empty bodies, the Blob's data becomes the request body!
(credit: @lukejahnke)
Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: https://t.co/2yTgn1NzhY
Australia's largest online CTF competition now welcomes New Zealand in July 2024! With 4200+ users and 2000+ teams as of 2023, it aims to up-skill the next generation of Cyber Security Professionals. Prize eligibility now includes Aussie and NZ students!
#CTF#DownUnderCTF
🎁 Source Code Disclosure in IIS 10.0! Almost.
There is a method to reveal the source code of some .NET apps. Here's how it works.
👉 https://t.co/Fo4tpkaHey
Today we're releasing a public beta of Talkback, a smart infosec resource aggregator to help you keep up with news and research. Please visit https://t.co/y3ubhdeLwK and give it a try! We'll be releasing new features and improvements over time.
A few months ago, we reported a pre-auth Remote Code Execution #RCE vulnerability to @vBulletin. The exploitation of this unserialize() bug was tricky, as vBulletin classes are not deserialisable. Discover the exploitation in our latest blogpost:
https://t.co/6FDbtS4U8K
This is the technical writeup in how we found and exploited the CVE-2022-41343 (RCE via Phar Deserialisation in Dompdf <= v2.0.0). We presented this vulnerability at Ruxmon September and we are finally doing the public disclosure! I hope you like it ;-) https://t.co/DPgmK2ELXO