Alon Mazor

Just another cyber security guy :D Github:

[Alon Mazor @TheMaziland]

How to chain a crazy “dlopen() dlclose()” primitive to a server-to-client RCE in openssh’s ssh-agent 🤯 Amazing research by ⁦⁦@qualys⁩ https://t.co/JqNvsXnCUE

[Alon Mazor @TheMaziland]

Here we go again 😨

[Rowan Cheung @rowancheung]

🚨Breaking:

Microsoft just launched 365 Copilot, and it's insane.

It's essentially ChatGPT for:
-Word
-Excel
-Powerpoint
-Outlook
-Teams

Check out the demo👇

[raptor @0xdea]

Very well written #Windows #patchdiffing and #nday #exploitation walkthrough ✊

Dissecting and Exploiting TCP/IP RCE #Vulnerability EvilESP (CVE-2022-34718)

// by Valentina Palmiotti

https://t.co/CI1aJpnUj1

[Alon Mazor @TheMaziland]

@NahshonEran Amazing read 👑

[Alon Mazor @TheMaziland]

The primitive-chaining on GCP is priceless here. Thanks for the research and for the amazing read 👑

By @nirohfeld @shirtamari @sagitz_

https://t.co/aXC7EBX6a3

[Alon Mazor @TheMaziland]

@Elad_PT @neo4j @dandan_arad Looks amazing 🤩

[elad @Elad_PT]

PCAP visualization tool based on @neo4j that @dandan_arad and I wrote:
https://t.co/F5gcgBgMzD

[Alon Mazor @TheMaziland]

@tadm0rC @NahshonEran Amazing research!! 💪🏻

[Hacking Articles @hackinarticles]

Docker Penetration Testing

Abusing Docker API
https://t.co/3oVFt1rKo5

Image Vulnerability Assessment
https://t.co/kdENQA5zcM

Pentesting Framework
https://t.co/a006yuU8Z6

Privilege Escalation
https://t.co/KQkXrYea99

#infosec #cybersecurity #cybersecuritytips #pentesting

[Filip Dragovic @filip_dragovic]

Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service not installed but you still want to relay DC authentication to ADCS?
Don't worry MS-DFSNM have your back ;)

https://t.co/idwMnM8nIV

[张惠倩 @momika233]

Atlassian Jira Seraph Authentication Bypass RCE
CVE-2022-0540

https://t.co/AGCZEvbJ31

#nday #bugbountytips #bugsbunny

[Alon Mazor @TheMaziland]

@UrielYochpaz @TomNomNom @hakluke Amazing 👑

[חזי לפלסיאן @HezyLaplacian]

שבת ראשונה אחרי הפסח מקבלים את המלכה אומר לבת אחותי שון הבת תכיני חלה מפתח ליכבוד השבת לברכה והצלחה אחרי שלוש חוזרת לי אם זה לא היבנתי אומרת לי חזי זה מפתח הצפנה ישר באתי לתת לה אחת אם הצד אם הצד האסימטרי אבל חזי וואלה לא מרביץ לבנות קודם כל מה נפלת עליי אם בדיחות אבא

[Omar Ωr Santos @santosomar]

BITB - Browser In The Browser (BITB) Templates https://t.co/KH6gAUuzwq #cybersecurity #bugbountytips #hacking #tools

[Alon Mazor @TheMaziland]

Thx Microsoft 🥲

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam

[elad @Elad_PT]

Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators | The GitHub Blog https://t.co/qNN3u9s42J

[JS0N Haddix @Jhaddix]

Another long (hacker) story thread 🧵

= Stealing checks worth millions & pwning a bank =

Here’s how I did it, so you can learn.

I was once contracted to do a penetration test on a bank…

Like, retweet, and follow for more hacker stories!

(1/x)

[Alon Mazor @TheMaziland]

@tadm0rC @na7irub Respect 👑
Wish I could make it there

[Florian Hansemann @CyberWarship]

LSASS dumping in 2021/2022 - from memory - without C2

#pentest #redteam #infosec
https://t.co/r1zmuz9lei