Francis Alexander

Security Engineering

[Francis Alexander @torque59]

NoSQL Exploitation Framework v2.0 Released , Added features,
https://t.co/cgPd2asGo8
#MongoDB #couch #redis #hbase #nosql @OpenSecurity_IN

[Francis Alexander @torque59]

@kernelpool Any benchmarks ? or mostly local runs ?

[Francis Alexander @torque59]

@decodebytes I see btw, I saw from the documentation that After apply(), there is no way to expand permissions. The sandbox persists for the lifetime of the process and all child processes. /tmp/myapp-<session-id> would not work with nono in that case right ?

[Francis Alexander @torque59]

@dguido @trailofbits Are there plans to add skills for AI specific threat modeling or threat modeling in general ?

[Francis Alexander @torque59]

@ZackKorman Definitely observability and detection. Also wouldn't it be better to just manage the MCP servers, especially with enterprise controls available for claude ?

[Francis Alexander @torque59]

@mitchellh no vscode was hurt 🤣

[Francis Alexander @torque59]

4 Chained zero days and to top it of ML to detect what pictures/documents are relevant to them. Operation Triangulation is quite interesting.

Vid: https://t.co/rTbPpmZWc8

[Francis Alexander @torque59]

@JustJake @LinkedIn @JustJake You can actually verify employment https://t.co/qKS1gXszZ5, It's current enabled for selected companies only though , with plans to expand.

[Luke Young @TheBoredEng]

I'm kicking off a series of blog posts about interesting vulnerabilities I've found and responsibly disclosed over the years, starting with a complex chain of vulnerabilities leading to XSS on https://t.co/rI8AvwILsh back in 2016: https://t.co/oH8Kc7z3ho

[stephen @_tsuro]

I made a website: https://t.co/4KJAv1BOzY

[LiveOverflow 🔴 @LiveOverflow]

I never thought I would experience a XSS on Google Search. But @kinugawamasato blew my mind!

This is a video going over the difficulties of sanitizing HTML in JavaScript.

https://t.co/T61VJJEuDE

[Francis Alexander @torque59]

The awesome @WEareTROOPERS badge

[Bharadwaj Machiraju @flabbergastedbd]

Finally wrapped up writing on an interesting distributed tracing helper which I initially built in #python and then had to rewrite in #golang https://t.co/E5wyvBPUDW

[Francis Alexander @torque59]

@ronenshh m 87,

[Francis Alexander @torque59]

@ajinabraham i think they named it as Workers as a Service (WaaS)

[Francis Alexander @torque59]

https://t.co/U0nKRqNBSY

Should change a bunch of things in the serverless world.

[𝓵𝓪𝓶𝓫𝔂 @lolamby]

CVE-2018-10933

[Black Hat @BlackHatEvents]

Learn to pentest the modern stack including continuous build & deployment tools, message brokers, configuration & resource management systems, and distributed file systems from end-to-end in #BHEU Training w/ @torque59 & @tunnelshade_ https://t.co/cG6Nm9nBlB

[Bharadwaj Machiraju @flabbergastedbd]

Intel PT and it's usage in Hongfuzz - https://t.co/UDCFQ7bVAP

[renorobert @renorobertr]

VirtualBox VM escape - CVE-2018-2844 PoC exploit - https://t.co/uky6eRTc9K