RedForce

security consultancy company providing offensive security services for unlimited scale of business.

[Bug Bounty Reports Explained @gregxsunday]

The video about blind SSRF in Google Cloud for which @david_nechuta got $31k is out!
Watch it to see how it's sometimes possible to exfiltrate data with blind SSRFs. You can also test your own skills with hands-on lab 😎

Enjoy!

https://t.co/glEjgKO4vV

[RedForce @RedForceSec]

Our team member @0x4148 just published the 2nd part of windows authentication attacks. This part covers Kerberos authentication process and technical analysis of widely used Kerberos attacks.
https://t.co/H00jbjdmAP
Happy reading

[RedForce @RedForceSec]

We've just published the 1st part of the Windows authentication attacks series.
https://t.co/QF43QTE4Si
The series suppose to cover the NTLM/Kerberos authentication in detail as well as how their attacks work.
Happy reading, and stay tuned for part 2.

[RedForce @RedForceSec]

@attritionorg Always a pleasure 😁

[RedForce @RedForceSec]

We have updated the article with another "UNPATCHED" vector to achieve RCE. Thanks @Zombiehelp54 for the heads up.

https://t.co/rwgWmOw0n3

[RedForce @RedForceSec]

Attacking Helpdesks (Part 1): Remote Code Execution (#RCE) chain on #Deskpro with #Bitdefender as a case study. Full technical details to #exploit RCE inside.
https://t.co/d5sx7Cascu

#BugBounty #websecurity #infosecwriteup

[Bo0oM @i_bo0om]

Twig 3 SSTI RCE

{{['cat${IFS}/etc/passwd']|filter('system')}}

https://t.co/q7EWleaRNa

[RedForce @RedForceSec]

@attritionorg You can find the advisory in there release notes under the following URL (https://t.co/Y9WxKAdNlJ)

[RedForce @RedForceSec]

@bad_packets @AboodNour Always a pleasure. If you need further information, please don't hesitate to reach out

[RedForce @RedForceSec]

Attacking Helpdesks (Part 1): Remote Code Execution (#RCE) chain on #Deskpro with #Bitdefender as a case study. Full technical details to #exploit RCE inside.
https://t.co/d5sx7Cascu

#BugBounty #websecurity #infosecwriteup

[Ahmed Aboul-Ela @aboul3la]

This will have huge impact!, another great example on how RCE can be achieved on OWA easily through ViewState deserialization attack. Red Teamers it's your chance now :)

https://t.co/Qu5CW01gkc

[RedForce @RedForceSec]

We are hiring, Sales Executive check the link for more details

https://t.co/BG4aJBEKit

[RedForce @RedForceSec]

We are hiring, Sales Executive check the link for more details

https://t.co/7emAGqNwHE

[RedForce @RedForceSec]

We are hiring, Back-end Developer check the link for more details

https://t.co/cprApukpFm

[RedForce @RedForceSec]

We are hiring, Front-end Developer check the link for more details

https://t.co/hW1FEOlqxV

[RedForce @RedForceSec]

We are Hiring, check the link for more details

https://t.co/i8OHz3BHs6

[/r/netsec @_r_netsec]

Jenkins pentesting notes and scripts https://t.co/9LgTSG5Tea

[Orange Tsai 🍊 @orange_8361]

"There is no pre-auth RCE in Jenkins since May 2017, but this is the one!"
Relase a more reliable and elegant exploit - "awesome-jenkins-rce-2019" from my #HITB2019AMS talk. Thanks @0ang3el and @webpentest join this party! https://t.co/qQCY2RYDa8

[André Baptista @0xacb]

Just released viewgen, a ViewState tool capable of generating both signed and encrypted payloads with leaked validation keys or web.config files. All algorithms supported.

TL;DR: Got a web.config file or LFI on https://t.co/cOwfXlDcKx? Pop a shell!

https://t.co/JAC90xowG7

[RedForce @RedForceSec]

Kerberoasting revealed.
The 1st part of Microsoft Kerberos implementation attacks series by our team member @Hatemsec .
https://t.co/VibyExol5R
Happy reading.
#PenTest #redteam

[Charles Fol @cfreal_]

Apache Local Root: CVE-2019-0211: Vulnerability description. Exploit will come later.
https://t.co/5ch5lSImx3