Asish @asishinfosec

Joined January 2010

Tweets

211
Followers

78
Following

332
Likes

59

Nicolas Krassas @Dinosn

4 years ago

LSASS dumping in 2021/2022 - from memory - without C2 s3cur3th1ssh1t.github.io/Reflective-Dum…

0 101 234 0 57

Riyaz Walikar @riyazwalikar

6 years ago

Published a short blogpost about how the introduction of #IMDSv2 affects #SSRF attempts on #AWS #EC2 instances, especially when attempting to retrieve #metadata information. blog.appsecco.com/server-side-re… #reInvent2019 #cloudsecurity #owasp cc: @appseccouk

1 44 64 0 7

Francesco Soncina @phraaaaaaa

6 years ago

CVE-2019-10392 — Yet Another 2k19 Authenticated Remote Command Execution in Jenkins read the blog post @ iwantmore.pizza/posts/cve-2019… /cc @jenkinsci @TheHackersNews

3 106 218 0 11

Julien | MrTuxracer 🇪🇺 @MrTuxracer

6 years ago

Here we go! Chaining a Stored XSS and a SQL Injection to compromise an Uber Wordpress. Bonus point: I've used a quiz 🙃 (and both are still 0-days) rcesecurity.com/2019/09/H1-442… #BugBounty #togetherwehitharder #h14420

8 174 372 0 57

RIVER @wugeej

6 years ago

The Universal SSL pinning bypass for Android applications //frida -U -f <your_application_package_name> -l <path_to_fridascript.js_on_your_computer> --no-paus frida -U -f -l D:\frida\fridascript.js --no-paus medium.com/@ved_wayal/hai…

1 188 487 0 93

Download Image

Ed @EdOverflow

6 years ago

I want to give another shout-out to @streaak for his amazing work on github.com/streaak/keyhac…. This is an excellent reference for anyone that wants to determine the security implications of a publicly-disclosed API key.

2 56 157 0 27

Yassine Aboukir 🐐 @Yassineaboukir

6 years ago

A handy and well-polished tool to enumerate permissions associated with AWS credentials you may have stumbled upon in the wild. It looks like it's released as part of a research that will be presented at BH this summer. github.com/andresriancho/…

0 42 124 0 23

SamBeckS @SamBeckS

7 years ago

Looking for new way to exploit Tomcat Host-Manager ? certilience.fr/2019/03/tomcat…

0 34 61 0 2

Yanick Fratantonio (@[email protected]) @reyammer

7 years ago

I'm releasing all the slides (~800!) of my Mobile Security class: mobisec.reyammer.io! They are not perfect, but students learned how to reverse apps, find&exploit real-world bugs, reason about threat modelling / system security, etc. Very proud of them :-) 👶 => 👨‍💻👩‍💻

56 1K 3K 0 445

Dinesh Shetty @Din3zh

7 years ago

Want to learn how to use Frida Without Jailbreak on devices running Latest iOS 12.4? Take a look at link.medium.com/ff9fZ7r0zU #iOS #MobileSecurity #iOSsecurity #Frida #Jailbreak #JailbreakiOS12

1 25 46 0 5

Orange Tsai 🍊 @orange_8361

7 years ago

Here is the whole exploit chain of Jenkins Unauthenticated RCE(and PoC video youtu.be/abuH-j-6-s0)! Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE! blog.orange.tw/2019/02/abusin…

10 560 1K 0 64

Ronnie Flathers @ropnop

7 years ago

Love Impacket? Ever land on a box and wanna run it, but either don't have Python2 installed or don't want to install new dependencies? I wrote a pipeline to statically build all the examples to Windows and Linux x64 binaries. Hope it helps! github.com/ropnop/impacke…

2 192 353 0 24

Paul Seekamp @nullenc0de

7 years ago

Most common ways to compromise Domain Admin accounts github.com/swisskyrepo/Pa…

0 8 25 0 7

Orange Tsai 🍊 @orange_8361

7 years ago

Hacking Jenkins Part 1 - Play with Dynamic Routing! The part 2 is an interesting RCE, and will be published in February :P blog.orange.tw/2019/01/hackin…

8 442 844 0 57

Mobile Security @mobilesecurity_

7 years ago

Frida Hooking Android #MobileSecurity #AndroidSecurity @fridadotre by @11x256 Part 1: 11x256.github.io/Frida-hooking-… Part 2: 11x256.github.io/Frida-hooking-… Part 3: 11x256.github.io/Frida-hooking-… Part 4: 11x256.github.io/Frida-hooking-… Part 5: 11x256.github.io/Frida-hooking-…

2 296 593 0 75

Download Image

Pedro Ribeiro @pedrib1337

7 years ago

Unauth RCE as root in Cisco Prime Infrastructure... widely used for data center management. Quick n' easy vuln: blogs.securiteam.com/index.php/arch…

0 72 84 0 7

n00py @n00py1

7 years ago

Fun fact: if you ever get into a Splunk web console (as admin), you can shell it too. n00py.io/2018/10/poppin…

5 197 399 0 30

Scott Sutherland @_nullbind

7 years ago

[BLOG] Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions blog.netspi.com/get-azurepassw… Thanks @kfosaaen, super handy!

0 82 113 0 7

hashcat @hashcat

7 years ago

We've developed a new attack on WPA/WPA2. There's no more complete 4-way handshake recording required. Here's all details and tools you need: hashcat.net/forum/thread-7…