@br0kenpipe

app sec @Doyensec

Joined February 2016
  • Tweets156
  • Following567
  • Followers125
4Media
Mohamed retweeted
Doyensec
@DoyensecJul 9
Hey pentesters📢, make your lives easier by using maSSO - a weaponized SSO Identity Provider for security testing of OIDC & SAML 2.0 Service Providers. The IdP your target trusts - that you fully control. Intercept, edit, re-sign. 👇 github.com/doyensec/maSSO #doyensec #appsec #security
30
141
9,939
Mohamed retweeted
Doyensec
@DoyensecMay 26
Our new post shows how #AWS ELBs break #security boundaries via rule shadowing, CloudFront/WAF bypasses, & alternate routing. 📢 Plus ELBaph - a new tool to map routing graphs, detect exposed paths & find attack chains across ALBs/NLBs blog.doyensec.com/2026/05/25… #AppSec #Doyensec
5
20
1,542
Mohamed retweeted
anaxim@lacerenza_fraMay 5
Just released with @ouadmoha a Malicious SSO IdP for OIDC / SAML / SCIM security testing. If you are trying to exploit a Service Provider, you should check maSSO 🪨 at github.com/doyensec/maSSO Built at @Doyensec
1
2
212
Mohamed retweeted
Doyensec
@DoyensecMar 6
AuthN/Z is always a #security minefield & MCP adds even more complexity with agents, remote servers, and transitive trust. This @goteleport -sponsored deep dive breaks down attack vectors & why each step is a potential trust boundary. 🔗 blog.doyensec.com/2026/03/05… #doyensec #ai
1
14
32
1,622
Mohamed retweeted
Doyensec
@Doyensec6 Oct 2025
🧞Your wish has been granted - the latest @pagedout_zine edition is out! In it, our @tell1c0 takes a quick look at #vibecoding, walking through the creation of an AI agent🤖. Check it out today! #doyensec #appsec #ai #Security pagedout.institute/

Paged Out!

Deeply technical zine. And it's free.

pagedout.institute
8
27
2,837
Mohamed retweeted
Doyensec
@Doyensec5 Jun 2025
🚨Just posted🚨: Learn about real-world API authorization vulnerabilities we frequently see with the slides from @tell1c0's recent presentation at @CONFidenceConf in Krakow. doyensec.com/resources/CONFi… #doyensec #appsec #security
1
36
104
4,798
🥳The latest !exploitable is here! We're sharing all the joy that comes with exploiting an arbitrary file write in GitLab, while cruising the Mediterranean. 🚢 Everything from onerous configurations to spotty internet! Enjoy! #doyensec #appsec #security blog.doyensec.com/2025/03/18…
27
1
113
6,958
Despite being central to their security, many orgs struggle to securely implement #OAuth. Our new post walks through common issues & how to prevent them, along with a useful checklist! Read it today & ensure your org is secure: blog.doyensec.com/2025/01/30… #doyensec #security #appsec
2
63
2
203
11,463
Mohamed retweeted
Doyensec
@Doyensec7 Jan 2025
In the latest Doyensec research, our Norbert Szetei (@73696e65) takes a closer look at the SMB3 Kernel Server (ksmbd) component of the Linux kernel. Check it out today & learn what he found, which led to multiple CVEs! #Doyensec #Appsec #Security #Linux blog.doyensec.com/2025/01/07…
1
14
1
39
4,444
Mohamed retweeted
Doyensec
@Doyensec2 Jul 2024
CSRF in modern web apps? It's still possible! Our latest research by @maxenceschmitt dives into using Client-Side Path Traversal to perform CSRF. Check out our latest blogpost and brand new #Burp extension for finding bugs. #doyensec #appsec #CSPT2CSRF blog.doyensec.com/2024/07/02…
1
48
6
114
14,543
Checkout @maxenceschmitt's presentation at @owasp's Global AppSec in Lisbon to learn how Client-Side Path Traversal can be leveraged for CSRF attacks! #owasp #appsec #doyensec sched.co/1Vajr lisbon.globalappsec.org/
10
1
36
3,868
Mohamed retweeted
Doyensec
@Doyensec7 May 2024
Congratulations 🎉 to Doyensec's own @73696e65 for discovering an out-of-bounds memory read vulnerability in the Linux kernel! Details: groups.google.com/g/syzkalle… The fix has been committed here: github.com/torvalds/linux/co… #doyensec #appsec #linux #security
8
33
1,989
New blog post on our new Server Side Prototype Pollution Gadgets Scanner plugin for #BurpSuite! It features a modern detection approach and a focus on real-world exploitation. Download it today! blog.doyensec.com/2024/02/17… github.com/doyensec/Server-S… #Doyensec #AppSec #websecurity
25
72
5,536
PoIEx, a new #Doyensec tool, identifies "Points of Intersection" where code & IaC definitions meet. Visualize & explore IaC, plus create & share real-time notes w/ teammates in VS Code. Try it out today‼️ blog.doyensec.com/2024/01/30… github.com/doyensec/PoiEx #CloudSecurity #appsec
1
10
2
23
3,084
Learn more about how having a security-oriented scheduling strategy for #k8s can limit opportunities for lateral movement within your environment in our latest blog post. #doyensec #Kubernetes #security #appsec blog.doyensec.com/2024/01/23…
8
1
13
1,958
Just posted! Learn how to achieve privilege escalation via misconfigured #AWS Batch & the solution for our previous lab, in the latest installment of #Doyensec's "Cloudsec Tidbits" series by @ouadmoha and @lacerenza_fra. #cloudsecurity #DevSecOps #appsec blog.doyensec.com/2023/06/13…
6
17
1,705
Mohamed retweeted
Doyensec
@Doyensec5 May 2023
Zero Touch Production platforms improve security while also making auditing and IR easier. Our latest post talks about common pitfalls found in their implementations and how to avoid repeating past mistakes. blog.doyensec.com/2023/05/04… #doyensec #appsec #devops #infosec #security
3
1
11
2,445
Read the full technical details here >> wiz.io/blog/azure-active-dir…

BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog

How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal

wiz.io
1
122
7
989
186,188
Phishing scams targeting #crypto wallets are everywhere. In our latest blog post, @viktorot details one such attack and offers suggestions on how wallets can improve their security. #doyensec #appsec #phishing #infosec blog.doyensec.com/2023/03/28…
9
1
9
1,297
In our latest blog post, learn how Szymon Drosdzol found a trivial SSRF bypass in #NodeJS 's `request` library (18M weekly downloads). Learn how to patch it and get the details on how other widely used libraries handle the same vector. #Doyensec #appsec blog.doyensec.com/2023/03/16…
4
26
1
66
26,175
Load more