thapr0digy @rshift

💻 fuzz researcher & aspiring magician ♠️ NY Joined May 2009

Tweets

1K
Followers

420
Following

900
Likes

3K

shubs @infosec_au

3 months ago

IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: github.com/assetnote/newt…

14 239 879 45K 630

thapr0digy @rshift

10 months ago

Excellent article on using graph theory in security

Zerotistic @gegrgtezrze

10 months ago

Excellent article on using graph theory in security

4 68 234 19K 125

0 0 1 72 0

Tavis Ormandy @taviso

a year ago

The libarchive e8 vulnerability is actually really cool, but the ZDI advisory doesn't explain why it's so wild lol. For some reason, I know about RAR filters, so let me provide the background. 🧵 1/n

3 176 613 116K 237

thapr0digy @rshift

2 years ago

This is awesome!!!!

Oliver Chang @halbecaf

2 years ago

This is awesome!!!!

2 14 46 8K 5

0 0 0 202 0

quarkslab @quarkslab

2 years ago

#Fuzzing still faces many challenges when applied to Android native system services. Eric Le Guevel tested AFL++'s Frida mode to fuzz directly on Android devices and reports the process and results in today's #blog post: bit.ly/445VWn7

1 24 61 6K 8

Download Image

thapr0digy @rshift

2 years ago

After looking at @hackerpinup's post on @Fox0x01's ARM assembly book, I had to get a copy myself. Ready to dig deep into some ARM assembly internals and do some reversing 😁

0 0 5 576 0

Download Image

Ronen Shustin @ronenshh

2 years ago

Today we share our Alibaba Cloud research for the first time, where we gained unauthorized access to other customers' databases in two different services 🚨 This complex research involved RCE, PE, Container escape, K8s lateral movement, and supply chain attack. Check it out 🧵

13 401 1K 195K 394

Download Image

MG @_MG_

3 years ago

New details on the 2nd LastPass incident are fun: - got into Sr DevOp's home via vuln media software - installed keylogger - got master pass to corp vault (seemingly because it was being accessed from home computer) Cool to see that LastPass is sharing support.lastpass.com/help/incident-……

25 340 1K 344K 357

thapr0digy @rshift

3 years ago

Didn't know about this. Makes me wonder how many bugs have been missed because of it

lander @landaire

3 years ago

Didn't know about this. Makes me wonder how many bugs have been missed because of it

0 56 222 32K 87

0 0 0 197 0

Omer Tsarfati @OmerTsarfati

3 years ago

Finding one vulnerable kernel driver is cool, but finding multiple vulnerable drivers it’s even better! I’m excited to share my blog post about an interesting vulnerable driver code base that many different vendors tend to share. cyberark.com/resources/thre…

3 65 137 15K 39

thapr0digy @rshift

3 years ago

This is a simple but effective idea to reduce the amount of data ingested into data collection platforms.

John Althouse @4A4133

3 years ago

This is a simple but effective idea to reduce the amount of data ingested into data collection platforms.

10 91 333 50K 123

0 1 4 386 0

thapr0digy @rshift

3 years ago

Fix the database integration and I'm in! The local Cayley graph is useful, but I want to store it in a Postgres or Neo4j db if possible.

Jeff Foley @jeff_foley

3 years ago

Fix the database integration and I'm in! The local Cayley graph is useful, but I want to store it in a Postgres or Neo4j db if possible.

0 9 21 4K 3

Download Image

0 0 2 210 0

thapr0digy @rshift

3 years ago

Whoa ty!

Mara @m_ou_se

3 years ago

Whoa ty!

62 635 3K 305K 773

0 0 2 533 0

Alex Plaskett @alexjplaskett

3 years ago

Here are some of the presentations I found the most interesting within the macOS/iOS Kernel Security research space in 2022! 🧵 alexplaskett.github.io/macos-ios-secu…

3 65 219 44K 78

Download Image

thapr0digy @rshift

3 years ago

A ton of valuable techniques here for those looking for ideas outside of standard email phishing

Praetorian @praetorianlabs

3 years ago

A ton of valuable techniques here for those looking for ideas outside of standard email phishing

0 2 6 0 4

0 0 0 93 0

thapr0digy @rshift

3 years ago

Everyone knows about Bloodhound for the offensive side, but what about the defensive side? Well, look no further! A thought I've had for the past two years was implemented by the great team at @ZeroNetworks called BlueHound. github.com/zeronetworks/B… and youtu.be/IMeZ66ZI_kM

0 0 2 126 0

HackSys Team @HackSysTeam

3 years ago

Check out our new blog post on exploiting PDF reader vulnerabilities! Part 2 features a use-after-free vulnerability in Foxit Reader which we exploited using JIT spraying. Blog: hacksys.io/blogs/foxit-re… Github: github.com/hacksysteam/CV… cc: @shsirk