Jake Miller

Web Security Researcher | h2c smuggling, JSON Interop vulns,
RMIScout, GadgetProbe, Server-side Spreadsheet Injection | AppSec @BrexHQ; formerly @BishopFox

[Jake Miller @theBumbleSec]

Amazing work @albinowax! I’m just blown away with your creativity in finding new desync variants. I’m looking forward to trying it out in the labs.

[PortSwigger Research @PortSwiggerRes]

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling by @albinowax

https://t.co/Xa1GwNaIVd

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2021!

https://t.co/t3pMqnLt2T

[MOGWAI LABS GmbH @mogwailabs]

It seems that there is a lot confusion about the log4j JNDI injection vulnerability (CVE 2021-44228). In our latest blog post we provide additional background fundamentals about JNDI and JNDI exploitation (and a lot of links): https://t.co/0UytHFBkga

[Jake Miller @theBumbleSec]

@projectzerodays Sure! I found a few of these over the course of that year on services that accepted XLS uploads. They were all instrumenting MS Excel on a backend server for document processing: https://t.co/rJb9nzRusY and https://t.co/9AFTdCE7uc

[shubs @infosec_au]

Check out our blog post on Context Aware Content Discovery https://t.co/ma7hdgPPfI - we drop a tool (Kiterunner - https://t.co/u9mb9DUlkg) and some datasets. Hope you can find more endpoints through our work!

[Pew @TheGrandPew]

Found another jndi bypass like 🟠's groovy bypass using org.yaml.snakeyaml.Yaml. Heres a controller for rouge-jdni to add it to your arsenal https://t.co/VtSNSDgyRO.

[Jake Miller @theBumbleSec]

Great research by @artsploit! Also, be sure to check out the labs and updates to content at https://t.co/ZbjjHtcbyL

[PortSwigger Research @PortSwiggerRes]

New attacks on OAuth: SSRF by design and Session Poisoning by @artsploit https://t.co/MCjIDMQg3q

[Jake Miller @theBumbleSec]

Awesome to see @seanyeoh finding some epic examples of h2c smuggling! Great work @assetnote team!

[shubs @infosec_au]

My colleague @seanyeoh wrote up his security research on H2C smuggling and the various cloud providers he successfully exploited (Cloudflare, Azure). He also released a tool called h2csmuggler! Check it out at https://t.co/C4QTDcI7JH

[Jake Miller @theBumbleSec]

Excited to share that I have just started a new position on the AppSec team @BrexHQ! Looking forward to being a part of their awesome team :)

[Dominic @dee__see]

I used Radamsa to fuzz and find an inconsistency between 2 NodeJS URL parsers and bypass host whitelisting in Kibana webhooks. The impact was low here but the parser issue can probably cause some trouble in other Node code bases. Read more details 👇 https://t.co/WF4OANSpym

[Jake Miller @theBumbleSec]

More great lessons on fuzzing from @Nosoynadiemas! I am always excited when I see a new post in this series. Thank you for sharing!

[GitHub Security Lab @GHSecurityLab]

Learn how to take aim at HTTP attack surfaces in @Nosoynadiemas series on fuzzing the Apache Web Server https://t.co/z8MNrbsCwA

[Mark Manning @antitree]

Istio vulnerability with an 8.2 CVSS. They're calling it a 0day. Also a lesson in JWT validation mistakes.

> If a JWT token is presented with an issuer that does not match the issuer field specified in JwtProvider, then the request is mistakenly accepted

https://t.co/Hrd06hgyMD

[Jake Miller @theBumbleSec]

@h3xstream @nst021 Thank you for letting me know! Love the depth of this piece. It also provides coverage for languages that I skipped like Swift, Perl, Obj-C, and Lua. Added a link and shout out in the Takeaways section :)

[Jake Miller @theBumbleSec]

@nlohmann The trials included: 1) attempting to induce duplicate keys through truncation 2) fuzzing Unicode codepoints/raw/transforms 3) using unofficial JSON grammar 4) edge-case numbers 5) adding small quirks/errors: stray quotes or backslashes, odd whitespace. Hope that helps! (2/2)

[Jake Miller @theBumbleSec]

@nlohmann Hey Niels! Nice to meet you :) During my tests, nlohmann/json had behavior consistent with JSON parsing "norms" and the spec. Notably, it made excellent use of exceptions! I'd be happy to provide more context on the test cases. (1/2)

[Jake Miller @theBumbleSec]

@pry0cc Haha I was biting my tongue earlier this week, as my new research was just about to be published, but now I can share it. JSON Interoperability Vulnerabilities: https://t.co/A3MQkLpAXe

[James Kettle @albinowax]

JSON Interoperability vulnerabilities sound like they have some serious bug-bounty potential. Nice work once again by @theBumbleSec/@bishopfox
https://t.co/uHCGJAmt4f

[Jake Miller @theBumbleSec]

@albinowax @irsdl @bishopfox Can't wait to see it! Feel free to DM me. I have some ideas :)

[Jake Miller @theBumbleSec]

Accompanying labs and cheat sheet: https://t.co/4RZeYjebNZ

[Jake Miller @theBumbleSec]

Just when you thought JSON was the one thing you could trust. My latest research on JSON interoperability vulnerabilities highlights the risks of inconsistent parser behavior (40+ parsers) and attacks to bypass business logic in microservice architectures. https://t.co/A3MQkLpAXe