@DotNetRussell

Founder of @Squid_Sec Senior AppSec Engineer / Software Engineer OSCP+ | GWAPT #Silversmith for fun and profit Built to Destroy Your company APT

SquidOffense.com
Joined April 2016
  • Tweets16.2K
  • Following1.2K
  • Followers2.1K
5KMedia
I pentested Starbucks for years. Not the Wi-Fi. The apps in front of 41k stores, 90 markets, and 36 million Rewards accounts. Lesson's that actually stuck:
3
3
4
33
2,465
So it has been written So it shall be done
☣️ Mr. The Plague ☣️
@DotNetRussellOct 22
Okay I decided I'm rolling a rouge for WoW Forever Time to pick the name
27%Crits Happen
0%Eviscerate DotEXE
18%Shadow Exploit
55%Rouge Process
22 votes • Final results
23
it's funny because it's true lol
CG
@cgtwts17h
“who should we lay off first” CEOs:
1
4
224
Wait..... What? youtu.be/4_AchM6w4Gk?is=Zx8I… > Gist
100%Juh-ist
0%G-eye-st
1 votes • 22 hours
31
☣️ Mr. The Plague ☣️ retweeted
SwiftOnSecurity
@SwiftOnSecurity26 Oct 2016
Democrats: The system is rigged. Republicans: The system is rigged. Linux users: The system does not support this webcam.
30
638
26
1,435
Day complete
2
236
tell me you're a fed without telling me
1
6
345
fact
Boardy
@boardyai22h
Replying to @DotNetRussell
the buyer still can't tell the difference
1
62
🚨BREAKING🚨: AI did not replace me on pentests this fall. It covered more surface than I could alone POC or GTFO, I still reproduce every finding manually. AI, shockingly, is EXTRA COVERAGE, not a replacement If the traffic and the model disagree, the traffic wins in my book and those are the only findings we include. squidhacker.com/2026/10/ai-p…

AI Pentest: Coverage, Not a Replacement

An AI pentest is not a replacement for a pentester. More coverage, still gated by someone who knows the bug class.

squidhacker.com
1
1
3
147
Idk how something could be so comfortable but here she is Hash, Monday morning
1
4
117
Are you doing Active Directory hacking? Have you setup or use GOAD? Are you taking the OSCP? I want to hear your feedback on the tool BloodBash! github.com/SquidSec/BloodBas… It's a CLI alternative to Bloodhound and if you're doing any of the above it's for you

GitHub - SquidSec/BloodBash: A Bloodhound alternative. BloodBash will ingest the same files...

A Bloodhound alternative. BloodBash will ingest the same files bloodhound does but no server is required to use this tool. It's great for quick AD enumeration. - SquidSec/BloodBash

github.com
1
113
This tool is worth every penny if you're doing bug bounty or small and medium business attack surface scanning See what you're missing
SQUID SEC
@Squid_SecOct 26
Good morning world! Today is a great day to scan your attack surface. SquidScan is online, armed, and standing by ~> SquidScanner.com
1
2
64
☣️ Mr. The Plague ☣️ retweeted
Harrison.Wells
@L33tH4xcyberOct 26
The project that was so hot GitHub banned me. AskWAM but it creates a scheduled task and exfiltrates access tokens to a remote server. github.com/Harrison-Wells-Cy…

GitHub - Harrison-Wells-Cyber/WAMStealer: AskWAM but it ex-filtrates to a remote server

AskWAM but it ex-filtrates to a remote server. Contribute to Harrison-Wells-Cyber/WAMStealer development by creating an account on GitHub.

github.com
1
3
1
6
1,135
Happy Monday world! youtu.be/Lo2qQmj0_h4

AC/DC - You Shook Me All Night Long (Official 4K Video)

Official 4K video for "You Shook Me All Night Long" by AC/DCListen...

youtube.com
1
143
☣️ Mr. The Plague ☣️ retweeted
pirate.moo
@apiratemooOct 24
cups local privilege escalation (libcupsfilters 2-2.2.1) --- You can exploit the interaction between cups-browsed, libcupsfilters, and ghostscript (-i [include path]) to obtain code execution as root via a privileged printing service. The poc abuses remotely advertised printer auto discovery + user-supplied attributes, which are passed to ghostscript without proper validation. poc: codeberg.org/piratemoo/cowcu… ./cowcups.sh ls ./mooshell #hack #vulnerability #exploit

cowcups

cowcups poc

codeberg.org
12
29
6
115
5,137
I just earned the "A05: Security Misconfiguration" badge on SquidScanner! 🦑 squidscanner.com/profile/Squ…

SquidSec • SquidScanner Operator Profile

SquidSec has completed 403 scan(s) and earned 61 badge(s) on SquidScanner.

squidscanner.com
3
225
☣️ Mr. The Plague ☣️ retweeted
International Cyber Digest
@IntCyberDigestOct 25
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone. tailworm.com x.com/IntCyberDigest…
205
560
481
5,170
1,268,131
☣️ Mr. The Plague ☣️ retweeted
Bluma@x25princessOct 24
jobs.ashbyhq.com/loancrate/d… Good company. Worth checking out.

Senior Security Engineer

WHAT IS LOANCRATE? We started Loancrate to make home-buying simpler and less expensive for lenders and borrowers (us!). Today, mortgage lenders are stuck running their companies on software products...

jobs.ashbyhq.com
1
2
166
☣️ Mr. The Plague ☣️ retweeted
anomali@Anomali210830Oct 24
Happy Pythagorean Theorem Day! 10/24/26 10² + 24² = 26² This is the last one we’ll experience in our lifetime.
549
56,633
1,668
306,968
3,855,942
So I didn't vote on this but I'm surprised that Eviscerate DotEXE didnt get a single vote. Few days left
☣️ Mr. The Plague ☣️
@DotNetRussellOct 22
Okay I decided I'm rolling a rouge for WoW Forever Time to pick the name
27%Crits Happen
0%Eviscerate DotEXE
18%Shadow Exploit
55%Rouge Process
22 votes • Final results
92
☣️ Mr. The Plague ☣️ retweeted
mohamedation
@mohamedationOct 24
I just earned the "Named Operator" badge on SquidScanner! 🦑
1
1
47
Load more