Pinned Tweet
Ending @defcon this year with @CVEnew dropping three more CVEs I discovered:
CVE-2023-40294- cve.mitre.org/cgi-bin/cvenam…
CVE-2023-40295- cve.mitre.org/cgi-bin/cvenam…
CVE-2023-40296- cve.mitre.org/cgi-bin/cvenam…
If you are at @NatlCyberSummit next month, come by and say hi!
I've completed my Zero-Day research sprint for March 2024 and discovered four more critical zero-day vulnerabilities: CVE-2024-27540, CVE-2024-27541, CVE-2024-27542, and CVE-2024-27543. In this article I thoroughly explore fuzzing projects with AFL++
halcyonic.net/zero-day-resea…
🔍 Diving deep into fuzz testing with #AFLplusplus 🐛, and the results are in! I found multiple unique vulnerabilities in LCI - a lambda calculus interpreter. The full write up with associated CVEs can be viewed here:
halcyonic.net/zero-day-resea…
#Fuzzing #Cybersecurity #BugHunting
Stay safe and stay secure! Here are two more CVEs I discovered recently published by @MITREcorp
Liblisp Out of Bounds Read (CVE-2023-48025)
Liblisp Use-after-free (CVE-2023-48024)
Another CVE I discovered was released by @MITREcorp @CVEnew . This one is a double free in the xHTTP server library:
github.com/Halcy0nic/CVE-202…
#CVE_2023_38434
Looks like this is a 12 CVE month for @Halcy0nic research. Thanks to @CVEnew and all of the development teams for the quick patches and amazing response time.
Halcy0nic retweeted
New blog post - Fuzzing for CVEs Part I (Local Targets):
somersetrecon.com/blog/fuzzi…
A few more zero days I discovered have been assigned CVEs. You can find more info on MITRE’s official website 🤙🏾
cve.org/CVERecord?id=CVE-202…
cve.org/CVERecord?id=CVE-202…
cve.org/CVERecord?id=CVE-202…
To check out the write-up I made about how I discovered this CVE, visit halcyonic.net
teapawt.net/CVEnew/status/15528174…
CVE-2022-34556 PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c. cve.mitre.org/cgi-bin/cvenam…
Buffer overflow I discovered in md2roff version 1.7
teapawt.net/cvenew/status/15433501…
CVE-2022-34913 ** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input. cve.mitre.org/cgi-bin/cvenam…
Halcy0nic retweeted
1997: Nmap was first released as a simple port scanner via an article in issue 51 of Phrack magazine which included the source code.
That's right - 23 years of Nmap.
phrack.org/issues/51/11.html
Halcy0nic retweeted
NBA Street Vol. 2 dropped 17 years ago today. 🎮 @SLAMftw
Great CTF!
Shout-out to @Cair07x, Les0eufs, and @eavenonearth for cracking some of the boxes. 🤙🏾
The #HalcyonicQuarantineCTF is officially a go next Thursday (04/02) from 6-9 PST. During our solidarity I am hosting a free online capture the flag event. Should be fun! You can get all the details here:
halcyonic.net/quarantine-ctf…
Check it out! Myself, @NickySlicksHaha @mlaerten hacked the #DEFCON27 badge! Our modified badge will complete your/other attendee's badge challenge wirelessly using our modified firmware. #dc27
#DEFCON
github.com/NickEngmann/Jackp…
