totz

AppSec | Bug Bounty Hunter | #kaeferjaeger

[totz @totz_sec]

@ITSecurityguard really love to see a padding oracle again. good work guys!

[totz @totz_sec]

@ITSecurityguard Herzlichen Glyckwunsch!

[totz @totz_sec]

@RenwaX23 love this chain

[totz @totz_sec]

@marcolivermunz @intigriti nice! wann treffen?

[totz @totz_sec]

@fabian_bader love it. thanks for your work!

[Keanu Nys @RedByte1337]

Thanks to everyone who joined my DEFCON33 talk!🎉
For those of you who missed it and are interested in seeing how we can extract cleartext credentials and bypass MFA directly from the official Microsoft login page, I just uploaded the recording to YouTube:
https://t.co/MoPQiKgesd

[totz @totz_sec]

@RedByte1337 great techniques! thx for sharing

[totz @totz_sec]

@artsploit great work! thanks for sharing the details

[Michael Stepankin @artsploit]

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

[Orange Tsai 🍊 @orange_8361]

The detailed version of our #WorstFit attack is available now! 🔥
Check it out! 👉 https://t.co/EWlBSgXhpx

cc: @_splitline_

[m1tz @_m1tZ]

Another live hacking event with the #kaeferjaeger . This time with @intigriti in Heidelberg and the awesome targets #Allegro . Had a great time and found a couple of bugs. #lhe #bughunting #bugbounty

[totz @totz_sec]

@_superhero1 wir sehen uns am der bar

[Sebastian Stohr @_superhero1]

Fellow Hackers!

Next Sat I will host the first Intigriti Open Port Event Germany in Heidelberg with amazing #kaeferjaeger!

The last spots are left to grab! 😱 Tell us in the comments why you should get one 🎟️ I will DM the winners 🎉

This is an in-person event only, not remote

[daniel @hackermondev]

1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips
https://t.co/8pkfFsXRWR

[totz @totz_sec]

@EricaZelic @DrAzureAD @_xpn_ @rootsecdev @XPN @FuzzySec I have already checked this and had no success with it. there were a couple of file writes in %LOCALAPPDATA%\Packages\https://t.co/UIX6KTyaXu.Plugin_xxx\ but unfortunately I could not decrypt the files with DPAPI

[totz @totz_sec]

does anyone know where office apps on a win11 (non joined device) store their refresh token? I find access tokens in process memory and in the file system, but no refresh token anywhere🤔

[totz @totz_sec]

@rootsecdev @DrAzureAD @EricaZelic @_xpn_ yep, access token only

[totz @totz_sec]

@EricaZelic @DrAzureAD @_xpn_ @rootsecdev @XPN @FuzzySec there are only acces token in "%LOCALAPPDATA%\Microsoft\TokenBroker\" and "%LOCALAPPDATA%\Microsoft\IdentityCache\" but no refresh token.
it would make kind of sense if the RT is "managed" by MSAL but that means it can't be requested on a normal way

[frycos @frycos]

Me during code review...