d7x @d7x_real

a s1x2n3r Synack Red Team | OSEP, OSCP, OSWE, CEH d7x.promiselabs.net Joined December 2017

Tweets

369
Followers

70
Following

409
Likes

315

Justin Gardner @Rhynorater

2 years ago

I've made over 100k on SSRF vulnerabilities. They aren't always as simple as pointing it at localhost or AWS Metadata service. Here are some tricks I've picked up over the past 5 years of web app testing:

45 933 3K 439K 3K

Download Image

d7x @d7x_real

3 years ago

My OSEP review and exam prep advise: d7x.promiselabs.net/2023/02/07/off…

0 0 0 108 1

d7x @d7x_real

3 years ago

this course has been a real wealth of knowledge explaining the concepts of advanced evasion techniques and most effective Active Directory breaches in depth, highly recommend it to anyone who want to advance their evasion techniques and/or Active Directory skills @offsectraining

0 2 7 5K 2

Download Image

James Kettle @albinowax

3 years ago

ICYMI: Browser-Powered Desync Attacks is now on YouTube. Enjoy! #DEFCON30 youtube.com/watch?v=B8KW8K…

1 49 144 0 12

PortSwigger Research @PortSwiggerRes

3 years ago

The seventh way to call a JavaScript function without parentheses by @garethheyes portswigger.net/research/the-s…

2 83 210 0 47

Gareth Heyes \u2028 @garethheyes

3 years ago

This works on Safari iOS I swear this didn’t work on Chrome: Reflect.apply.call`${alert}${undefined}${[1]}`

1 3 5 0 2

README_ @README_Security

3 years ago

Researchers at @proofpoint have tracked a financially motivated cyberthreat actor, TA558, as it targets hotel and travel organizations in Latin America. The group has drawn from at least 15 different malware families since 2018: proofpoint.com/us/blog/threat…

1 3 3 0 1

Orange Tsai 🍊 @orange_8361

3 years ago

Just wrote a short write-up on my latest research at #BHUSA and #DEFCON! You can check the slides and video there! Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS! blog.orange.tw/2022/08/lets-d…

7 238 627 0 113

PortSwigger Research @PortSwiggerRes

3 years ago

Found thanks to a question from @li96614233 and then I remembered I did this with non-alpha code a while ago

1 11 76 0 8

Download Image

Burp Suite @Burp_Suite

3 years ago

How to exploit CSPP (on our early adopter channel) 1) Go to the proxy tab 2) Click Open Browser 3) Pin the extension 4) Enable prototype pollution 5) Visit ginandjuice.shop 6) Open devtools > DOM Invader 7) Scan for gadgets 8) Open devtools > DOM Invader 9) Click exploit

9 206 568 0 209

Download Gif

Tony @TJ_Null

3 years ago

Since Microsoft plans to disable macros by default, I have decided to release a proof of concept that I use on my engagements by leveraging the document properties built in Microsoft Office. Here is the link to the article: offensive-security.com/offsec/macro-w…

7 259 727 0 197

James Kettle @albinowax

3 years ago

"Abusing HTTP hop-by-hop request headers" by @nj_dav was nominated as a top web hacking technique back in 2019, and has just blossomed into an F5 BIG-IP unauth RCE! nathandavison.com/blog/abusing-h… portswigger.net/research/top-1… github.com/horizon3ai/CVE…

2 168 540 0 111

PortSwigger Research @PortSwiggerRes

3 years ago

Hunting evasive vulnerabilities: finding flaws that others miss - from @albinowax - premiered at Nullcon Berlin. If you didn't catch the live event, it's now available on YouTube. portswigger.net/research/hunti…

6 141 410 0 87

Gareth Heyes \u2028 @garethheyes

3 years ago

Wow. I never knew about the evt argument until now :D

1 2 50 0 11

Download Image

Gareth Heyes \u2028 @garethheyes

3 years ago

Firefox only: <img src onerror=arguments[0].originalTarget.ownerDocument.defaultView.alert(1)>

1 29 141 0 31

Gareth Heyes \u2028 @garethheyes

3 years ago

I’ve been doing web security research for many years now and what I’ve noticed is results depend on a combination of luck, skill, knowledge and persistence. That’s why persistence is so important because an element of luck is required. This is why some knowledgable people don’t -

5 66 252 0 25

JS0N Haddix @Jhaddix

3 years ago

4/8/22 #bugbountydiary #bugbountytips Everyone is sick in the house but I had some running scans I needed to check up on. I found a SQL injection bug on a blog. Here's how I did it, so you can learn... 👇 🚨Like, retweet, & follow for more hacker tips!🚨 1/x

68 305 1K 0 396

Brute Logic @BRuteLogic

4 years ago

#WAF #Bypass (Akamai's Kona) <a href="javas%09cript:[1].map(top['ale'+'rt'])"> Built with tricks you find in xsscheatsheet.com! PoC Vector: brutelogic.com.br/gym.php?p05=%3… PoC Bypass: