ticarpi

Pentester, Vulnerability Researcher, Hacker of things.
My views are entirely my own.

[ticarpi @ticarpi]

This month I found a new JWT zero-day vulnerability! An issue I've not seen before.
I used some tests I built into the jwt_tool 'Playbook' scanner to find it.
Great vendor response, patch being built, CVE assigned.
More details when disclosure is allowed.
#jwt #ZeroDay #CVE

[ticarpi @ticarpi]

Congrats @RadioTimes for getting someone to write a @OfficialBlueyTV article without ever seeing the show before, let alone the episode in question.
😅
That's an impressively inaccurate sentence.

[ticarpi @ticarpi]

@jyopur can you drop me a line? It's about a vulnerability in one of your NPM packages. I've emailed, but wanted to connect to make sure the fix is in hand. Thanks.

[ticarpi @ticarpi]

Ten years ago I was waiting sooooo patiently as each of the beautiful 'Color Editions' of Scott Pilgrim were released. Still pride of place on my shelf. So perfect. So wild and yet so relatable.
And now this, @bryanleeomalley?! Explain yourself! How are you so damn genius?

[ticarpi @ticarpi]

What an amazing day at @bsidesbristol
Thanks so much to all the people who organised it, spoke at it, attended, and generally just made it great.
See you next year!
#BSidesBristol

[ticarpi @ticarpi]

It's been a while... Back at #bsidesbristol
Hello everyone!

[ticarpi @ticarpi]

@garethheyes @PortSwiggerRes @avlidienbrunn @fransrosen Just what I've used since building my first long payloads for the Cookieless Feature XSS in .NET
Ah, those were the days...

[ticarpi @ticarpi]

@garethheyes @PortSwiggerRes @avlidienbrunn @fransrosen 🤣 not picking holes, your research work is always stellar. I use it every frickin' day.
Good to know, just checking I wasn't going mad.

[LiveOverflow 🔴 @LiveOverflow]

Did you ever see a technical tweet you didn't understand? No worries, I'm here for you! 🧑‍🏫

https://t.co/7M5Auo7EJi

[ticarpi @ticarpi]

Chipotle is the perfect seasoning for everything.
#provemewrong

[ticarpi @ticarpi]

@snyff @PentesterLab Of course. Go for it.

[ticarpi @ticarpi]

I just completed @Pentesterlab's Yellow Badge!
RCE in several server applications, authentication bypasses and privesc == fun!
Give it a go.

[ticarpi @ticarpi]

@nullenc0de Thanks for that. Always glad to see it's helpful 😊

[ticarpi @ticarpi]

One day we might actually be able to report directly from @Burp_Suite... maybe.
Good effort with this, keeping things tagged and organised sounds really useful.

[James Kettle @albinowax]

You can now attach notes to requests via the new 'Organizer' tab, on @Burp_Suite's early-adopter release channel! More details here:
https://t.co/L7c3QDgS1I

[ticarpi @ticarpi]

@fuzz_sh Interesting like flashy? Or impactful?
Personally I usually try to find an authed page on the site with sensitive data, and use onsite request forgery to fetch() it in the victim's session and show that in an alert. Good fun to pop the user's password that way.

[ticarpi @ticarpi]

@fuzz_sh CSP misconfigured can weaken browser defenses, as can X-Xss-Protection. Sometimes Cache-Control.

[ticarpi @ticarpi]

@fuzz_sh Cookies missing attributes is a misconfiguration, and has impact only under certain contexts. I only report on Session/sensitive cookies, but they usually work out to a 3.1 Low anyway due to AC:H

[ticarpi @ticarpi]

@fuzz_sh CVSS requires direct impact on C/I/A, and best practice headers aren't exploitable directly without other vulnerabilities being present. The one exception IMHO is Strict-Transport-Security. Some of the others can have a score if misconfigured of course.

[ticarpi @ticarpi]

@TheSteveMair Perhaps ironically these are used by forensic investigators to prevent data being lost or encrypted at the time of acquisition. So sometimes #infosec #security #win ? 😂

[ticarpi @ticarpi]

Calling #pentest and #BugBounty pros: how often do you find #SQLi?
I'm trying to impress on a client how bad it is that I've found SQL Injection on EACH of the 3 apps I've tested for him in the last 6 months...

[ticarpi @ticarpi]

Watched it a hundred or more times and somehow only just realised that the opening credits of @OfficialBlueyTV is a game of musical statues.
Oh man. #sleepdeprivation #dadlife