Joe Leon (@JoeLeonJr) profile picture

Joe Leon

@JoeLeonJr

Security Researcher

Joined February 2013
  • Tweets71
  • Following280
  • Followers18.1K
2Media
Photo by Joe Leon (@JoeLeonJr)Photo by Joe Leon (@JoeLeonJr)
Joe Leon retweeted
Aikido (@AikidoSecurity) profile picture
Aikido
@AikidoSecurityAug 4
‼️ The popular npm package keyv is being actively compromised (127 million weekly downloads). The attacker is still pushing malware across packages right now. Developing story.
Image from Aikido (@AikidoSecurity)
32
132
44
686
173,131
Here's a couple of things worth a try to get an IDOR Comment below if you've other useful tips & techniques. 🧵👇 #bugbounty #bugbountytips #infosec
9
103
1
274
Black Friday is here! Get FREE recurring API credits if you like + retweet this tweet. If we get up to 100 RTs everyone gets 100 recurring monthly API credits. If we get over 100 RTs, everyone gets the # of API credits in the amount of RTs. Cut out time: November 28th 10AM EST.
Image from SecurityTrails, A Recorded Future Company (@securitytrails)
2
402
3
462
Black Friday warmup🔥 Get a chance to win a SecurityTrails swag pack: Comfy t-shirt ✔️ Classic (and a favorite) hacker hoodie ✔️ Stickers ✔️ Just RT this tweet and make sure to follow @securitytrails - one winner will be chosen randomly on November 26th 2021 at 00:00 EST.
Image from SecurityTrails, A Recorded Future Company (@securitytrails)
28
219
2
153
Hitting F12 in a browser is not hacking. If your code leaks personal data via public development tools that any person can see by simply pressing F12 on a keyboard then you have a huge data leak issue, not a hacking situation, on your hands. Fix your website.
This Post is from an account that no longer exists. Learn more
70
666
46
3,374
🎵 If you're having cert issues I feel bad for ya son, I got $99 problems but the bill ain't one...🎵 All you have to do is pass the Burp Suite cert exam before 15th Dec and we'll refund you your $99 exam fee. #burpsuitecertified #99problems
6
35
3
110
TIL that since hashcat 6+, you can pass your wordlists in the .zip or .gz format and it will decompress them on-the-fly.... pretty great for space savings on my 150GB+ of wordlists.
7
35
1
96
Burp Suite > Proxy > Options > TLS Pass Through. Add these: .*\.google\.com .*\.gstatic\.com .*\.mozilla\.com .*\.googleapis\.com .*\.pki\.goog No more noise in your logs! #bugbountytips #Bugbounty #CyberSecurity
10
352
2
796
Trying to get into .NET lately I ended up putting together a new project as a result. LittleCorporal is an automated Maldoc generator that leverages VBA, Donut, and thread hijacking to load a user specified shellcod blob into a remote process. Project: github.com/connormcgarr/Litt…
Image from Connor McGarr (@33y0re)
2
112
4
310
Joe Leon retweeted
Jonas L (@jonasLyk) profile picture
Jonas L@jonasLyk19 Jul 2021
yarh- for some reason on win11 the SAM file now is READ for users. So if you have shadowvolumes enabled you can read the sam file like this: I dont know the full extent of the issue yet, but its too many to not be a problem I think.
Image from Jonas L (@jonasLyk)
34
389
58
958
Joe Leon retweeted
dylan (@_batsec_) profile picture
dylan
@_batsec_16 Jul 2021
I've written a tool to escalate from domain user to a full AD compromise using ESC8 by @SpecterOps. You can see in the pictures below how, when combined with a method to coerce authentication, it is extremely powerful.
Image from dylan (@_batsec_)
Image from dylan (@_batsec_)
Image from dylan (@_batsec_)
15
296
3
989
Joe Leon retweeted
Hubbl3 (@_Hubbl3) profile picture
Hubbl3@_Hubbl314 Jul 2021
Along with the release of our blog post on #XLSEntanglement we have published a git repo with POC code and some examples github.com/BC-SECURITY/Offen…
GitHub - BC-SECURITY/Offensive-VBA-and-XLS-Entanglement

GitHub - BC-SECURITY/Offensive-VBA-and-XLS-Entanglement

Contribute to BC-SECURITY/Offensive-VBA-and-XLS-Entanglement development by creating an account on GitHub.

github.com
56
1
104
Process Creation is Dead, Long Live Process Creation — Adding BOFs Support to PEzor Since the release of Beacon Object Files (BOFs), I wanted to support them as a new kind of output format in PEzor... Let’s dive into this short journey! iwantmore.pizza/posts/PEzor4…
Image from Francesco Soncina (@phraaaaaaa)
5
132
5
276
Joe Leon retweeted
mr.d0x (@mrd0x) profile picture
mr.d0x
@mrd0x6 Jul 2021
Finally ready! Check out filesec.io to find out what file extensions are being used by attackers and in what way. Drop any feedback or suggestions in my DMs.
5
15
1
27
Yet another comspec-based #LOLBin to be added to your blue- or red-tinted repos. For couple dozens of predefined commands, "help xxx" will launch "%comspec% /c xxx /?" The finding itself is nearly year old, and it's high time I converted it into something practical.
Image from Grzegorz Tworek (@0gtweet)
6
112
3
321
alert() is dead, long live print() - by @albinowax and @garethheyes portswigger.net/research/ale…
alert() is dead, long live print()

alert() is dead, long live print()

Cross-Site Scripting and the alert() function have gone hand in hand for decades. Want to prove you can execute arbitrary JavaScript? Pop an alert. Want to find an XSS vulnerability the lazy way? Inje

portswigger.net
8
209
10
545
Image from Luke Stephens (hakluke) (@hakluke)
13
114
11
613
If you find an SSRF vulnerability in an ASP application, try reading trace.axd file. It contains logs of HTTP requests, you can find sensitive information in there.
8
159
3
641
Fun fact: The "Referer" header in HTTP is spelled incorrectly. It should be "Referrer", but computer scientist Phillip Hallam-Baker misspelled it in the HTTP spec and it just never got changed. Wikipedia article: en.wikipedia.org/wiki/HTTP_r… RFC: datatracker.ietf.org/doc/htm…
HTTP referer - Wikipedia

HTTP referer - Wikipedia

en.wikipedia.org
8
41
2
238
Have you ever heard about F# language? No? Time to change that! @christruncer and @JoeLeonJr will demonstrate how they've used F# for offensive security engagements. Learn more: x33fcon.com/#!s/chrisjoe.md Register today :) x33fcon.com/#!conferenceregi…
Image from /ˈziːf-kɒn/ (@x33fcon)
1
4
1
5
Load more