Bitspinner @_bitspinner

Security Engineer alecmaly.com Joined December 2012

Tweets

77
Followers

34
Following

527
Likes

484

Bitspinner @_bitspinner

12 months ago

I've been looking at source code review and had trouble finding real world vulns that link to the problematic source code. Ended up building a quick tool to parse //osv.dev and make the data more searchable. Data is refreshed every 6 hours. oss-vulns.alecmaly.com

0 0 1 47 1

Bitspinner @_bitspinner

2 years ago

TLDR: Don't accept Power Apps / Power Platform permissions prompts unless you trust the source. Blog post: alecmaly.com/blog/2024/02/2… YouTube POC: youtu.be/lNHcZscX5Uw?si… #m365 #powerplatform #powerapps #powerautomate #hacking #infosec

0 0 0 64 0

Ron Masas @RonMasas

2 years ago

I found 2 stored XSS vulnerabilities in ChatGPT. The XSS bug was the easy part, but sharing it required bypassing CSP, leveraging a mass assignment issue for client-side path traversal (thanks @ctbbpodcast) to force a request to a BFLA endpoint. 🧵 [1/5]

13 160 803 71K 321

Download Image

JS0N Haddix @Jhaddix

2 years ago

Ok fam. I’m giving away TWO free tickets to my course which takes place in two/three weeks. All you have to do to win is like, retweet this tweet, and reply with “tbhmlive.com!” I’ll pick winners next week! If you haven’t seen my course, check out the link!

707 696 914 159K 65

Cantina 🪐 @cantinaxyz

2 years ago

🪐 Cantina Code Demo Release 🪐 A new era for security reviews is starting. We will continue to roll out updates and features to make this the best code review experience across any industry. Available to all Cantina researchers to explore below👇

18 28 101 26K 8

Download Video

Cantina 🪐 @cantinaxyz

2 years ago

Plenty of big news coming this week with our first competition only 1 week away 👀 What better way to kick off Monday than with a classic Cantina Cipher 🪐 - Prizes - • 1st Correct Answer: $250 USDC • Random Retweet Raffle: Cantina T-shirt (Want a hint? See Below 👇)

79 42 57 29K 11

Download Image

Bitspinner @_bitspinner

2 years ago

This was a fun high severity bug. If you rely on gps spoofing browser extensions for physical security, this may be worth a read. Grateful to ExpressVPN for allowing disclosure. Blog: alecmaly.com/blog/2023/08/2… #BugBounty #bugcrowd #cybersecurity #cybersec

0 0 0 43 0

Linus Tech Tips @LinusTech

2 years ago

NEW VIDEO!: I was told this was simple - AMD $5,000 Ultimate Tech Upgrade youtu.be/qdoOwCXuePg Enter the giveaway for three AMD Ryzen™ 7 7800X3D CPUs below! lmg.gg/7800x3d-giveaw… #sponsoredby @AMD

607 12K 4K 649K 94

Download Image

bluecapesec @bluecapesec

3 years ago

We are giving away 5 FREE enrollments for our signature course: *Practical Windows Forensics* on the @TCMSecurity Academy! Retweet and follow @bluecapesec for a chance to win - we'll pick the winners on Friday 5pm EST! #forensics #dfir #giveaway

41 343 216 0 7

Download Image

TryHackMe @RealTryHackMe

4 years ago

1,000,000 people use TryHackMe!🔥 🎉 We're giving away a bunch of year-long subscriptions to TryHackMe, plus limited edition t-shirts! Share this post and leave us a comment to enter👇 Here's our journey, the launch of new training labs, and a thank you! tryhackme.com/resources/blog…

2K 2K 3K 0 107

Download Image

Nguyen The Duc @ducnt_

4 years ago

Just got worked exploit PoC for path traversal in Apache HTTP Server 2.4.49 (CVE-2021-41773) with my collab again @yabeow #bugbountytips 👀

6 129 435 0 40

Download Image

unknown @Unknownuser1806

6 years ago

Binary exploitation / reverse engineering course github.com/guyinatuxedo/n… A collection of resources for linux reverse engineering github.com/michalmalik/li… A tool to fastly get all javascript sources/files github.com/003random/getJS #bugbounty,#bugbountytips

2 163 361 0 96

James Forshaw @tiraniddo

6 years ago

New blog post outlining how to use my .NET RPC Client tooling from PowerShell and C# to test and exploit local RPC security vulnerabilities. Also an early xmas present for those who enjoy long standing design flaws in UAC :-) googleprojectzero.blogspot.com/2019/12/callin…

1 201 358 0 36

PentesterLab @PentesterLab

6 years ago

Four years ago, we officially announced PentesterLab PRO (after a soft-launch late November)... What a journey! Thanks everyone for your support!

PentesterLab @PentesterLab

10 years ago

Four years ago, we officially announced PentesterLab PRO (after a soft-launch late November)... What a journey! Thanks everyone for your support!

1 26 39 0 0

5 10 95 0 1

Kali Linux @kalilinux

6 years ago

We promised something awesome, so here you go! Kali 2019.4 is live! kali.org/news/kali-linu… New theme and desktop environment, new Kali Undercover mode, updated way of doing documentation, package your own tools, full Kali desktop on NetHunter, and more!

101 1K 2K 0 63

Oddvar Moe @Oddvarmoe

6 years ago

Defenders should deploy this settings: HKLM\SYSTEM\CurrentControlSet\Control\Lsa Dword: RunAsPPL Value: 1 Protects dumping of Lsass with a simple registry value. Encountered that on an engagement recently. 🤯 Mimikatz driver needed to bypass Details docs.microsoft.com/en-us/windows-…

20 584 1K 0 234

Ori Damari @0xrepnz

6 years ago

Everyone knows Driver Signature Enforcement.... 🙃 The problem is: Attackers can load any signed driver and abuse its functionality. For example, the process hacker driver can be abused to dump the memory of lsass.exe. Read about it in my blog😋 repnz.github.io/posts/abusing-…

1 141 302 0 42

Download Image

Mazin Ahmed @mazen160

6 years ago

I'm publishing my work on the practical testing and breaking of JWT authentication. mazinahmed.net/blog/breaking-… The scripts that can make your JWT testing easier: github.com/mazen160/jwt-p… Feedback are always welcome!