Viktor Chuchurski

yes, no, maybe, i don't know. can you repeat the question?

[Viktor Chuchurski @viktorot]

a small hand in helping improve OSS projects.

thanks @avelinorun for the quick and effective mitigation.

[Doyensec @Doyensec]

🚨Security Advisory🚨

Systemic SQL Injection vulnerability in pREST!

Initial report details published: https://t.co/HcMp9PxE77

#Doyensec #AppSec #Security #PostgreSQL #SQLInjection

[Doyensec @Doyensec]

Make sure to catch @viktorot's presentation at No Hat this weekend! It's 11:45 in the "Technical track" :
🏁A Race to the Bottom🏁: Database Transactions Undermining Your AppSec

#doyensec #appsec #DataSecurity #nohat

[Clint Gibler @clintgibler]

↓ A Race to the Bottom

How inadequate concurrency control in databases can lead to race condition bugs

@owasp AppSec Lisbon talk by @doyensec's @viktorot

🛠️ Vulnerable Go app
https://t.co/pWy1Vi2j0Q

📖 Slides
https://t.co/AnyuYN1kxU

+Semgrep rules

https://t.co/2nDFrfbwnd

[Doyensec @Doyensec]

We're proud our testing helps ensure the security of @ThinkstCanary's OSS Canary Tokens! As part of their transparency efforts, you can read the results of our latest round of testing here:

https://t.co/JlzxQ6uEOO

#doyensec #appsec #security #thinkst

[Viktor Chuchurski @viktorot]

@ottosulin @Doyensec @owasp it's always good practice to review documentation to see what the database providers and what first best for your application's use-case. there's unfortunately never a catch-all solution for these types of problems.

[Viktor Chuchurski @viktorot]

@ottosulin @Doyensec @owasp the Postgres comment is absolutely correct. the table in the post shows how isolation levels impacted the example we used. 'Repeatable Read' or 'Snapshot Isolation' provided by Postgres is better than the 'Repeatable Read' per the SQL spec, but still below 'Serializable'.

[Viktor Chuchurski @viktorot]

if your making heavy use of database transactions in your system, make sure that you properly handle concurrency control. head over to out blog and read about the details on how transactions are processed and what issues can arise in the worst case scenarios!

[Doyensec @Doyensec]

Just posted! Check out our @viktorot's presentation on DB race conditions from @owasp's Global AppSec. Our latest post gives all the details, slides and a playground to test your skills at finding these issues!

https://t.co/DaZLAoFqfK

#doyensec #appsec #owasp #security

[Viktor Chuchurski @viktorot]

Stop by and learn how to escape client-side path traversals to CSRF. @maxenceschmitt @Doyensec #owasp #appsec

[Maxence SCHMITT @maxenceschmitt]

Don’t miss @viktorot’s talk at #OWASP Global Appsec.

[No Hat Con @nohatcon]

Let's welcome @viktorot in our lineup with his talk "A Race to the Bottom - Database Transactions Undermining Your AppSec". Congrats!

[Viktor Chuchurski @viktorot]

stop by and say hi!

[Doyensec @Doyensec]

Congrats to Doyensec's @maxenceschmitt and @viktorot for being selected to present at @OWASP's Global AppSec conference this June in Lisbon!

https://t.co/bcGKroMZJZ

#doyensec #appsec #owasp

[Security Pills Newsletter @secpillsnews]

💳 The case for improving crypto wallet security

Research from @viktorot on phishing scams targeting crypto wallets and how their security can be improved

🧰 Check their PoC, a service to collect information on ETH Dapps:
https://t.co/8MlfjOZUgv

https://t.co/3GWCCcOK8S

[Doyensec @Doyensec]

New advisory! @viktorot provides details on a CSRF protection bypass he discovered in Sveltekit. Ensure your apps are up-to-date.

#doyensec #appsec #javascript #DevSecOps

https://t.co/9CqTj8pOn4

[Viktor Chuchurski @viktorot]

While crypto wallets are constantly improving, there is still more to be done. The post describes a potential wallet enhancement, which will provide users access to necessary information about the Dapp they’re using, helping them more easily weed out scam attempts.

[Doyensec @Doyensec]

Phishing scams targeting #crypto wallets are everywhere. In our latest blog post, @viktorot details one such attack and offers suggestions on how wallets can improve their security.
#doyensec #appsec #phishing #infosec

https://t.co/xxCjQ70NGy

[Clint Gibler @clintgibler]

📚 tl;dr sec 163

With great work from:
@nicolas_frankel, @raesene, @Doyensec, @viktorot, @includesecurity, @8x5clPW2, @sethsec, @luketucker, @emtunc, @mihai, @Tailscale, @blastbots, @simonw, @mikepsecuritee, @DanielMiessler

and more!

https://t.co/LwjgLW6EK4

[Doyensec @Doyensec]

Announcing the release of `safeurl` - a library to help #golang devs "Build with Security"! This module provides tested & versatile protection against Server Side Request Forgery (SSRF)! Hurry and check it out!

#doyensec #AppSec

https://t.co/qbVeEHgIkm
https://t.co/iJknyu32mB

[Doyensec @Doyensec]

The latest coordinated disclosure from our researchers (Norbert Szetei @73696e65 & Viktor Chuchurski @viktorot) details a SQLi and DoS via Prototype Pollution in #TypeORM! Time to update!

More details: https://t.co/sQWGdWA3OW

#doyensec #TypeScript #Electron #NodeJS #appsec

[Doyensec @Doyensec]

We're here as sponsors of #BSidesSF! Come find us to chat about career opportunities, your next AppSec project or just for some fresh new swag!

[Viktor Chuchurski @viktorot]

@SonarSource I've implemented a small app that showcases the vulnerability. You can run it locally and play around with it. The app lives in this repo https://t.co/pNiO0JIKLd. I plan to implement all of the challenges in this format #CodeChallenge

[Viktor Chuchurski @viktorot]

@gregorspagnolo @facyber_ @MicrosoftTeams I said nothing :)