@[email protected]

Principal security consultant @nettitude_labs. CHECK Team Leader (Applications). Frequently uninjured snowboarder.

@[email protected]

[@[email protected] @strawp]

If you miss Twitter back in pre-2010 days when it was just full of geeks sharing cool stuff, then get on Mastodon.

https://t.co/CugRleATGd is where I'll be now

👋

[@[email protected] @strawp]

YES! You found one! I pretty much laughed all the way through that😂

[@[email protected] @strawp]

@sampilgrim this guy who rides a penny farthing says he wouldn't know how to pop a wheelie on it. https://t.co/By5AaCf83W I figured if anyone could manual one, you could. Make it happen! 😁

[@[email protected] @strawp]

@Burp_Suite Didn't appear to but I got around the issue using sessions in the end. Odd though, figured it was a caching issue or something

[@[email protected] @strawp]

@Burp_Suite I'm sure the Intruder payload type "Runtime file" used to read the file for each request so you could use it to store an access token to refer to, but it seems like now it keeps the same value for the whole attack?

[@[email protected] @strawp]

@Burp_Suite Yes, but in the past I've used it to take the value from the file per request and have another process writing to that file, e.g. the current datetime and it would be correct at the time of the request. Talking probably v1.5 or so though 😂

[@[email protected] @strawp]

@_RastaMouse @benpturner @m0rv4i I don't deserve any credit, I think I probably just created that repo for the actual talent 😂

[@[email protected] @strawp]

@IGC_Ray https://t.co/kCVgmbtasB

[@[email protected] @strawp]

I did a thing

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Popular document storage solution, ONLYOFFICE, affected by multiple vulnerabilities. Our latest post by @strawp shows how to exploit this for unauthenticated remote code execution.

https://t.co/qlbJLlIC4X

[@[email protected] @strawp]

@IGC_Ray Sorry, only just saw this.

JS injection you can do through the UI. The other stuff, the version number is a firm indicator

[@[email protected] @strawp]

@0xCrashX Now :) https://t.co/kCVgmbtasB

[@[email protected] @strawp]

@nationaltrust @wbiggs I've had this working in Google Play/Wallet for years but it's only in the last year that staff have refused to scan it because "security" despite the fact that the physical cards have no security features 🤷‍♂️

[@[email protected] @strawp]

@IGC_Ray I'll release the tool in the new year

[LRQA Cyber Labs @LRQA_Cyber_Labs]

Popular document storage solution, ONLYOFFICE, affected by multiple vulnerabilities. Our latest post by @strawp shows how to exploit this for unauthenticated remote code execution.

https://t.co/qlbJLlIC4X

[@[email protected] @strawp]

@robmanuel @jbaert @fesshole Stephen Fry has been on there a week and he's already got 46k followers https://t.co/K1vC1Pm04p

[@[email protected] @strawp]

@scriptmonkey_ "... upon which, cracking the Kerberos ticket was a mere bagatelle"

[@[email protected] @strawp]

@joefizz420 Must remember to never write another function and just cut and paste my code multiple times

[@[email protected] @strawp]

Oh Jesus 🤦‍♂️

[Senior PowerPoint Engineer @ryxcommar]

congrats to every Twitter employee who commits their entire venv/ for avoiding the layoffs. Elon needs allstars like you who can push 200k lines of code in a single merge.

[@[email protected] @strawp]

@RoxanaKovaci @Mandiant @googlecloud 😮 you went blue?

[@[email protected] @strawp]

@W1ntrmut3 They're not all mine. Maybe I'll blog it or something

[@[email protected] @strawp]

I used to do this as a software developer, but now I actually am a hacker I take it more seriously and have playlists and shit

[Fesshole🧻 @fesshole]

I work from home as software developer. When I'm bored I turn of the lights and play techno music to pretend I'm in a hacker movie.

[@[email protected] @strawp]

@jim_taylor First playlist is basically all massive attack albums in chronological order 😄