Pepijn

hacker at @hadriansecurity. volunteer at @divdnl. developer. foss lover.
getting rid of nano since 2010

[Pepijn @xstplanet]

https://t.co/41EtihxSNx
It's been well over 20 days to say a single f... word on the hackerone report I have with them.

@Hacker0x01, @TMobile when can I publicly disclose?

[Stephen Sims @Steph3nSims]

Zero to Hero: The process of reversing and exploiting complex vulnerabilities! https://t.co/TvQsPzhNGH

[an0n @an0n_r0]

Here is why NetNTLMv1 should be disabled in prod networks ASAP. Besides cracking the hash back to NTLM (and then forging Silver Tickets) is straightforward, there is also a lesser known but immediate relay attack path by removing the MIC and doing RBCD abuse. Demo in screenshots.

[vx-underground @vxunderground]

We are excited to announce our friend @corg_e will be the new manager of vx-underground merchandise.

In the following days (or weeks?) we will have a new e-commerce domain.

tl;dr kawaii merchandise, or something

[Nguyen Van Hiep @meulody_]

@testanull

[Pepijn @xstplanet]

@vxunderground maybe start replying to hackerone reports

[Paul Seekamp @nullenc0de]

I have like 50 RCE bugs on this BB target. But EVERY time I have submitted a bug to this company it's a dup.
So I'm conditioned to not submit them.

I think bug bounties are creating some type of bystander effect...

[Radar by Qrator @Qrator_Radar]

January 22, 2023 — AS21859 — ZEN-ECN [US] — leaked 1348 prefixes creating 1349 conflicts with 44 ASNs in 8 countries. Propagation: 100%. Duration: 1 hour 20 minutes.

[Pepijn @xstplanet]

@infosec_au May be @DIVDnl can help informing the owners of vulnerable instances? :)

[x0rz @x0rz]

When I see TikTok being used as C2, this is how I know I’m getting too old for this shit

[Pepijn @xstplanet]

https://t.co/ZF7NGbdlCS

[Pepijn @xstplanet]

@vxunderground maybe start replying to hackerone reports

[Pepijn @xstplanet]

@stokfredrik ❤️

[MakerThrive @MakerThrive]

Get idea.

Buy domain.

Watch domain expire.

Repeat.

[Nasreddine Bencherchali @nas_bench]

Palo Alto vs Crowdstrike giving credit. 😂
cc @Purp1eW0lf

[Xeno Kovah @XenoKovah]

It’s like I always say: “These sequence diagrams aren’t going to animate themselves!”
CVE-2021-1732 (win32k kernel type confusion -> OOB-R/W)
(Based on https://t.co/EmpEzw3nyq)

[Pepijn @xstplanet]

@kruveon @Sonar_Research apache will normalize this back to ../

[Pepijn @xstplanet]

@kruveon @Sonar_Research On linux you can set the Windows UA

[fail0verflow @fail0verflow]

Another one bites the dust 😎