putsi

White hat hacking in Team ROT. Also, hacker-for-hire & bug bounty hunter --

[putsi @putsi]

Wrote a blog post about how to host private Burp collaborator instance. It also has some scripts to make it a bit easier and faster.
https://t.co/YQc2mbNcNg

[putsi @putsi]

Modifying Burp Collaborator config file every time you need to host a new payload takes too much time.

If self-hosted Burp collaborator could serve files from a web root directory like Nginx does, would you use it? (I’m gathering votes for a support case)

[putsi @putsi]

@0xd0m7 @Bugcrowd Bro you are a hero 🙏

[Burp Suite @Burp_Suite]

As promised, here's the first sneak peek into our new AI-powered features coming to Burp Suite Professional next month... 👀 🤫

First up, we have Explain This.

#BurpAI #BurpSuite

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top ten web hacking techniques of 2024! https://t.co/XHPEeqPQLR

[Zack Witten @zswitten]

Spamming "hi" at every LLM: a thread.

[Natalie Silvanovich @natashenka]

Can LLMs find vulns? Here’s what Project Zero found

https://t.co/lH6lksfTwR

[@mikko @mikko]

I bet a song composed and performed by an AI will be a Top 40 hit during this year.

[@mikko @mikko]

Video of the Keynote talk from last T2 infosec conference in history:
𝒮𝒴𝒮𝒯𝐸𝑀𝒮 𝒜𝐿𝒞𝐻𝐸𝑀𝒴. By @thegrugq.

https://t.co/5NrHNuNAmA

[faulty *ptrrr @0x_shaq]

This is how tears look like under the microscope. Insane

[Steve @SteveFlanders22]

The first two weeks of the Vision Pro were absolutely insane.

Here are 13 examples that prove the Vision Pro is the best piece of tech ever invented.

1) Real-time 3D surgery

https://t.co/DdQOZlnDV0

[HTTPVoid @httpvoid0x2f]

Check out our new blog post! We hacked into Apple Travel Portal (yes, again!) using a 0-day Remote Code Execution exploit. Part 1 is live now, stay tuned for the follow-up on another RCE worth a total bounty of $40k!

https://t.co/az4wNhDYyO

[shubs @infosec_au]

The SSRF/auth bypass affecting Ivanti Pulse Connect Secure (CVE-2024-21893), is a great example of what can be achieved with a fully blind SSRF vulnerability (RCE).

Read the @assetnote blog here which includes a reliable payload and generation steps: https://t.co/cOYpmbWHrS

[Corben Leo @hacker_]

I've made $500k+ from SSRF vulnerabilities.

Here are my tricks:

[publiclyDisclosed @disclosedh1]

PortSwigger Web Security disclosed a bug submitted by @mattaustin: https://t.co/2eqUVAsOLn - Bounty: $3,000 #hackerone #bugbounty

[Chris Evans @scarybeasts]

Hackers, an important one. e.g.: we heard that CVSS "PR" is handled inconsistently (should be PR:None for self-sign-up). We're transparently listing a set of Detailed Platform Standards for consistency across programs. Need your help -- what to cover next? https://t.co/sCmLSLJUnn

[LiveOverflow 🔴 @LiveOverflow]

Web Security vs. Binary Exploitation

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

As promised: Here's the first $10,000 @Intel bug (aka CVE-2022-33942) that allows to bypass the authentication of Intel's DCM by spoofing Kerberos and LDAP responses.

Exploit inside, enjoy 🥳

https://t.co/PmK0Xq2T4o

#BugBounty #security

[The Paranoids @TheParanoids]

Earlier this year, the Paranoids Vulnerability Research team  disclosed a critical remote code execution (RCE) vulnerability in @GoIvanti’s endpoint management product: https://t.co/CMIktsDTH8.

[Bipin Jitiya @win3zz]

CVE-2023-21939 - Code Exec - PoC
https://t.co/f1fpkVMRWR

[Jeti @0xJeti]

Here's a write-up on a Browser-Powered Desync bug that I discovered in the Azure CDN service known as Front Door. The entire concept is built upon the excellent research by @albinowax. Initially identified within the @intigriti program.
https://t.co/sgpXEFVxzm
#bugbounty