Deepankar Arora

I break things.

Views expressed are my own and not my employer

[RyotaK @ryotkak]

I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.

This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.

https://t.co/puM7hZWIlE

[Josh Lemon @joshlemon]

@vxunderground @MITREattack @coolestcatiknow

[Deepankar Arora @sec403]

@AmazonHelp I have not received any email from the OFM team. I have provided the docs on Amazon itself and I can't reply to your "no-reply" email address. DM me please?

[Andy Li @andyfeili]

A thread of my journey in web3 security in 2022. From noob to security engineer in 1 year.

1.
Discovered the world of web3 security in January with damn vulnerable defi

https://t.co/agIVVfX5My

[The Bug Bounty Hunter @tbbhunter]

Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities.

https://t.co/XBd9HkHwte

[The Bug Bounty Hunter @tbbhunter]

Prototype Pollution Primer for Pentesters and Programmers
https://t.co/ZibRE3VWEP

[Rami (drunkrhin0) @drunkrhin0]

Want to learn about Active Directory security? Start with these blogs 👇

A thread 🧵 (1/8)

[Paul Seekamp @nullenc0de]

Did you know you can feed sqlmap swagger files?!

python https://t.co/uw8r8CXP3y --swagger-uri https://t.co/xlv4pRFl7S

[🐞Sara Badran @SaraBadran18]

How to exploit SQL injection without comma = 10,000$ bounty

https://t.co/BGsWHQWb4l

By @0x4148

#hackerone #BugBounty #bugbountytips
#hackeronereport
#writeups #Bugbountywriteupspublished

[Mr.programmer @freeprogrammers]

Good Search Engines for Pentesters

#Pentesting #CyberSec #cyberawarness #cybersecuritytips #informationsecurity #infosec #ethicalhacking #bugbounty #bugbountytips #aws

[Simon Scannell @scannell_simon]

⚠️ Zimbra Mail pre-auth RCE via Path Traversal bug in unrar (CVE-2022-30333). This is probably my most impactful bug so far, especially after Zimbra has been the target of a 0day campaign likely conducted by a state actor. More details in this blog post: https://t.co/8v0ujC1Nyl

[Phith0n @phithon_xg]

Very simple POC for Atlassian Confluence Pre-Auth OGNL Injection && RCE (CVE-2022-26134)
Setup a pre-built environment to test it in 5 seconds: https://t.co/oH6GJ1mel1
Why 5 minutes not 10 seconds? Because you should apply a trial license from Atlassian😂#vulhub

[pyn3rd @pyn3rd]

My new write-up about arbitrary file upload in Java. I guess you guys like the juicy tricks, especially during WAF evasion.

https://t.co/EHRLnmrUbU

[Hacking Articles @hackinarticles]

Pic of the Day

#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec

[Malware Unicorn @malwareunicorn]

Be prepared for more clippy ...

[an0n @an0n_r0]

reproduced, awesome! from owned (or just freshly created) computer account to domain admin in couple of steps using ADCS by exploiting CVE-2022-26923 reported and documented by @ly4k_. patch DCs ASAP! :)

[The Bug Bounty Hunter @tbbhunter]

NahamCon CTF 2022 — Web Exploitation — All Challenges — Writeup

https://t.co/Ib4iCGjjQA

[Corben Leo @hacker_]

It's easy to find attack surfaces that others haven't.

You just need to think creatively.

"But Corben, I don't know how!"

That's what I'm here for.

I'll share some simple methodology that works.

(so you can find vulnerabilities...and make money)

A story:

[The Bug Bounty Hunter @tbbhunter]

Exploitation and Sample Vulnerable Application of the JWT Null Signature Vulnerability (CVE-2022-21449)

https://t.co/I1kngZUQpZ