VmxhZA==

Hack to live.. they also call it pentester.
CTF with #paumd

[Tristan Gosselin-Hane @eltdude]

Achieved first blood jackpotting the ATM at @NorthSec_io #nsec2023 CTF this weekend! The most insane and thrilling hack I've pulled off at a CTF so far, it certainly caught the eyes of everyone in the room and the event organizers, describing it "straight out of a movie"!

[davidlebr1 @davidlebr1]

This year, I designed and developed a complete Windows Track for the @NorthSec_io CTF and one of the participant did a full write up of the track which is awesome. The write up is from @b13bs_ @ @OKIOKdata. Have a good read.

https://t.co/T6nYoWyUHe

[HTTPVoid @httpvoid0x2f]

Thread - Confluence Blind OGNL Injection analysis from our limited java knowledge. From vulnerable sink to becoming admin of the confluence instance. #CVE-2022-26134. Tested on latest vulnerable version 7.18.0.

[VmxhZA== @yol0nline]

#paumd 1st once again. What an amazing team work! Thank you @NorthSec_io for the challenges! 👏

[VmxhZA== @yol0nline]

@olivier_boschko @NorthSec_io Yes! 🔥💪

[VmxhZA== @yol0nline]

@NorthSec_io First metaverse CTF 👏

[Florian Roth ⚡️ @cyb3rops]

#Spring4shell - good news and bad news

Good:
It's less prevalent than initially expected

Bad:
It's not up to the administrators. They can't solve the problem with a patch. It seems to be the developers task to find vulnerable apps and deploy a fix in form of code.

[C💥🖥💥 @C0axx]

@35Foss Someone should have called it Spring Break 🥁

[Randori Attack Team @RandoriAttack]

The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE. An HTTP 400 return code indicates vulnerability.

$ curl host:port/path?class.module.classLoader.URLs%5B0%5D=0

#SpringShell #Spring4Shell #infosec

[Florian Roth ⚡️ @cyb3rops]

First YARA rules to detect the PoC code and webshells dropped by the public POC exploiting the #Spring4Shell vulnerability

Signature set of THOR Lite should be updated in a minute

Thx to @xyantix @testanull

Next step: log file based detection

https://t.co/O4wlMJ2uc7

[NorthSec @NorthSec_io]

(Please retweet)
Actively looking for speakers for our conference May 19-20
Topics we love:
-Application & Infrastructure Security
-Cryptography & Obfuscation
-Society, law & ethics
We're welcoming of everyone as long as you're an expert in your domain. 💙
https://t.co/IgtIMFxU3Y

[Soufiane @S0ufi4n3]

Seriously what the hell is going on !!
#Lapsus is claiming attacks on #Nvidia then #Nvidia hit back with a #Ransomware

Lapsus claims to have 1TB of data and is leaking all Nvidia employees' passwords and NTLM hashes

@Cyberknow20
@SOSIntel
@vxunderground
@ransomwaremap

[Vincent Yiu @vysecurity]

Life of a Red Teamer.

Client: "Is it you? Did you guys run calculator?"

[Boschko @olivier_boschko]

Check out my blog! It's a quick read. Solving the payment village ATM/Kiosk hacking challenges.
https://t.co/oZWnZoJJFa

[Paul Axe @Paul_Axe]

@testanull @infosec_au LOL, I have described this vulnerability in 2019 at ZeroNights conference: https://t.co/J3FEEOIp00

[🇷🇴 cristi @CristiVlad25]

Leak size: 997 GB
Document count (elastic): 1.6+ billion
Found & reported: December 26, 2021

Mobile app with 100+ million installs on Android. Massive leak of private user activity and videos. Reported and in the process of informing @GoogleVRP too

[Cyber Advising @cyber_advising]

CVE-2021-44228 log4j2 Waf Bypass
https://t.co/MUvFBTp41s

[Bruno Borges @brunoborges]

For how long has this #log4 being exploited?

For *at least* 9 months.

https://t.co/uQtVWqdvVx