Federico Dotta retweeted
Introducing Burp AT.
Agentic AI for human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills.
Now live in public beta for Burp Suite Professional users.
portswigger.net/blog/introdu…
Federico Dotta retweeted
🚀 Want to build your own Burp Suite extensions?
As part of Burp Extensibility Month, we’re sharing Burp Ambassador Federico Dotta's (@apps3c) 10-part guide to extending Burp Suite with the Montoya API.
Start here 👇
hnsecurity.it/blog/extending…
#BurpSuite #BurpExtensibility
Federico Dotta retweeted
Highlights include:
✨ Our new Burp Ambassadors, @apps3c and @0xTib3rius, present sessions covering creating custom extensions for complex testing scenarios and a Bambda generation framework.
🔬 A deep dive with PortSwigger researcher @zakfedotkin on vibecoding Burp extensions.
Federico Dotta retweeted
🚀 Extensibility Month is launching on the PortSwigger Discord!
Join us for a month of events, resources, and community discussion all about creating, sharing, and getting more from Extensibility in Burp Suite.
#BurpSuite #BurpExtensibility
Federico Dotta retweeted
Meet the Burp Ambassadors: @apps3c 🇮🇹
Federico Dotta is an offensive security researcher with a deep focus on Burp Suite extensibility.
#BurpAmbassador #BurpSuite #BurpExtensibility #BApps
Federico Dotta retweeted
🔄 Brida, Burp to Frida Bridge
A bridge between Burp Suite and Frida to help test Android applications.
👇
portswigger.net/bappstore/2c…
Federico Dotta retweeted
The unattainable unicorn in fault injection!
Our latest article reveals that single-bit faults are possible on ESP32. Discover how some bits are easier to flip and why lowest voltage isn't always best.
Join @0x696e6f6465 in his #hardwarehacking quest.
security.humanativaspa.it/fa…
Federico Dotta retweeted
Display responses that came from a server-side cache (Varnish/Cloudfront) with this filter bambda:
return requestResponse.response().headerValue("X-Cache").toLowerCase().contains("hit");
Federico Dotta retweeted
4. Brida, Burp to Frida bridge
Bridges Burp and Frida, enabling traffic manipulation across multiple platforms. Simplifies mobile testing with direct function usage for data encryption/decryption, offering custom plugins, tabs, menu options and more.
portswigger.net/bappstore/2c…
Federico Dotta retweeted
We just published “Nothing new under the Sun – Discovering and exploiting a CDE bug chain”, a new article by our @0xdea. He chains a printer name injection bug in dtprintinfo and a stack bof in libXm to achieve LPE to root on a fully-patched Solaris 10. security.humanativaspa.it/no…
Federico Dotta retweeted
Very cool series on IoT devices reverse engineering by @apps3c
A lot to learn!
Part 1: buff.ly/3CzUcqF
Part 2: buff.ly/3C7WPyn
Part 3: buff.ly/3M85jKh
#iot #xiot #embedded #Linux #reverseengineering #infotech #cybersecurity #informationsecurity
Federico Dotta retweeted
During a Red Teaming Assessment @smaury92 and @Th3Zer0 exploited CVE-2022-35405 on a Manage Engine Password Manager Pro instance, reversed the encryption/decryption routine to get the plaintext passwords and gain Domain Admin rights - learn how!
shielder.com/blog/2022/09/ho…
Federico Dotta retweeted
Here some details on some directory traversal on Zyxel admin interface.
security.humanativaspa.it/us…
#uselessbugs
Federico Dotta retweeted
New on the #hnsecurity blog by @0x696e6f6465
Zyxel authentication bypass patch analysis (CVE-2022-0342)
security.humanativaspa.it/zy…
Federico Dotta retweeted
Federico Dotta retweeted
Example of using Turbo Intruder in a "listen and attack" mode. A hidden secret: you can have turbo intruder scripts use the burp plugin API. Here we use burp.IProxyListener to intercept requests and reissue them inside turbo intruder mutating the method.
gist.github.com/defparam/840…
Federico Dotta retweeted
The first article of our new #Zyxel security audit series is out on the #hnsecurity blog!
Zyxel firmware extraction and password analysis
security.humanativaspa.it/zy…
Stay tuned for some juicy stuff in the upcoming weeks 🏴☠️
Federico Dotta retweeted
I took some time to write 36 new rules for @r2cdev’s Semgrep. Enjoy!
Semgrep ruleset for C/C++ vulnerability research
security.humanativaspa.it/se…
Federico Dotta retweeted
Did you know some embedded / #IoT devices encrypt their storage and firmware?
Dive into a bootloader #reversing adventure by @zi0black and @Th3Zer0 to learn how to analyze a bare metal binary (U-Boot) and decrypt the firmware!
shielder.it/blog/2022/03/rev…