null @nulls3ssion

infosec ninja wannbe kyawthiha7.github.io myanmar Joined March 2012

Tweets

59
Followers

69
Following

893
Likes

555

James Kettle @albinowax

a year ago

Have you heard of ORM Leak vulnerabilities? @elttam just published a super interesting deep dive into them, with tons of potential for further research elttam.com/blog/plormbing…

4 96 307 19K 186

In this post I'll use CVE-2023-3420, an incorrect side effect modelling bug in the JIT compiler that I reported to Chrome, to gain a sandboxed remote code execution in the renderer: github.blog/2023-09-26-get…

4 109 297 41K 85

Trend Zero Day Initiative @thezdi

2 years ago

Unfortunately, the Team Orca of Sea Security could not get their exploit of the Xiaomi 13 Pro working within the time allotted. #Pwn2Own

0 2 6 7K 0

ϻг_ϻε @steventseeley

3 years ago

I wrote a blog post regarding the technical details of CVE-2022-31700. It's an interesting case study of attacking custom Java Bean Validators (JSR 380) for RCE: trenchant.io/vmware-workspa… The original advisory can be found here: srcincite.io/advisories/src…

4 85 231 47K 43

James Kettle @albinowax

3 years ago

Love this auth bypass via JSON Injection found by @GHSecurityLab, it's such an underrated attack class. Backslash Powered Scanner can detect JSON Injection but it takes dedication to build a real exploit black-box. github.blog/2023-03-03-git…

0 89 240 21K 88

publiclyDisclosed @disclosedh1

4 years ago

GitLab disclosed a bug submitted by @wcbowling: hackerone.com/reports/1154542 - Bounty: $20,000 #hackerone #bugbounty

3 67 267 0 26

Download Image

PortSwigger Research @PortSwiggerRes

4 years ago

The comprehensive list of today's emerging threats, nOtWASP bottom 10: vulnerabilities that make you cry by @albinowax, @artsploit and @garethheyes portswigger.net/research/notwa…

4 124 253 0 39

PortSwigger Research @PortSwiggerRes

5 years ago

The top 10 web hacking techniques of 2020, by @albinowax with help from @filedescriptor, @irsdl, @Agarri_FR and the entire community portswigger.net/research/top-1…

4 242 505 0 89

Zon8 Research @Zon8Research

5 years ago

JavaScriptCore Internals Part 1 - Tracing Source to Bytecode: In this series we look at the areas of Webkit's JavaScript engine relevant for vulnerability research. zon8.re/posts/jsc-inte…

0 70 208 0 44

Ben Sadeghipour @NahamSec

5 years ago

Here are all the recordings from #NahamCon2020 with talks from @TomNomNom, @securinti, @samwcyo, @ChloeMessdaghi, @BitK_, @mdisec, @defparam, @snyff, @jcran, @_JohnHammond, @Jhaddix and @jeff_foley! Enjoy! youtube.com/playlist?list=…

18 209 748 0 109

Download Image

Adam Chester 🏴‍☠️{AFK} @_xpn_

6 years ago

New blog post is up showing how Mimilib and memssp work to harvest credentials. blog.xpnsec.com/exploring-mimi…

3 208 423 0 48

Web Security Academy @WebSecAcademy

7 years ago

This is the official Twitter account of the Web Security Academy - free web security training from the makers of @Burp_Suite. Follow for updates as we add new materials and labs to the Academy. portswigger.net/web-security

7 231 471 0 22

null @nulls3ssion

7 years ago

I just published My Experience of OSCP Proctored Exam link.medium.com/VhCFyoEcAV

0 0 0 0 0

Panos Gkatziroulis 🦄 @netbiosX

7 years ago

Learning about Universal Links and #Fuzzing URL Schemes on #iOS with #Frida grepharder.github.io/blog/0x03_lear…

0 6 14 0 1

Burp Suite @Burp_Suite

7 years ago

Blog post: Nominations are now open for the Top 10 web hacking techniques of 2018. To make your nomination, reply to this thread or use the linked form. portswigger.net/blog/top-10-we…

6 144 283 0 18

SpecterOps @SpecterOps

7 years ago

New from @harmj0y - Releasing Rubeus 1.2.0, which adds fake delegation TGTs and Kerberos based password changes. posts.specterops.io/rubeus-now-wit…

0 55 82 0 7

null @nulls3ssion

7 years ago

#Frida_and_objection #without_jailbreak kyawthiha7.github.io/2018/09/27/obj…

0 0 0 0 0

Oddvar Moe @Oddvarmoe

7 years ago

Blogpost about a new #persistence technique I discovered abusing the Appx/UWP debugger. Technique is not shown by #Autoruns and runs commands at logon of the user. A simple registry key is all that is needed. Enjoy! #RedTeam #DFIR #Pentest #Blogpost oddvar.moe/2018/09/06/per…

8 327 526 0 43

null @nulls3ssion

7 years ago

I just registered for KringleCon, Santa’s online virtual conference uniting security professionals and ethical hackers around the world! You can see me there in December 2018. Here’s what I’ll look like: kringlecon.com/?share=2c68519… SANS #HolidayHack