@putsi

White hat hacking in Team ROT. Also, hacker-for-hire & bug bounty hunter -- https://xitter.cf/t.co/5sHK3CHtdm

 Tampere, Finland
rot.fi
Joined September 2015
  • Tweets940
  • Following2.6K
  • Followers2.9K
28Media
Wrote a blog post about how to host private Burp collaborator instance. It also has some scripts to make it a bit easier and faster. teamrot.fi/2019/05/23/self-h…
11
114
272
Claude figured out the origin of the NIST curve parameters. Turns out to have been timestamps! anthropic.com/research/ecdsa…
33
41
21
646
132,883
This was a great read, Stellar work @0xLupin
Lupin
@0xLupinAug 12
“Security researchers are doomed because of AI.” I kept hearing versions of this, so I went back through 500 years of people saying the same thing every time a machine learned a human skill. Some were idiots. Some were right. Here’s where I landed.

security researchers are doomed.

Article · @0xLupin
3
37
284
55,732
putsi retweeted
skull
@brutecatJun 11
Hacking Google with A.I. for $500,000 brutecat.com/r/hacking-googl…

Hacking Google with A.I. for $500,000

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

brutecat.com
66
535
64
2,577
370,319
Modifying Burp Collaborator config file every time you need to host a new payload takes too much time. If self-hosted Burp collaborator could serve files from a web root directory like Nginx does, would you use it? (I’m gathering votes for a support case)
92%Yes
0%No
8%Don’t care.
12 votes • Final results
4
540
As promised, here's the first sneak peek into our new AI-powered features coming to Burp Suite Professional next month... 👀 🤫 First up, we have Explain This. #BurpAI #BurpSuite
8
26
3
245
21,533
The results are in! We're proud to announce the Top ten web hacking techniques of 2024! portswigger.net/research/top…

Top 10 web hacking techniques of 2024

Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net
24
289
40
863
225,675
Spamming "hi" at every LLM: a thread.
317
1,257
275
14,452
3,507,712
Can LLMs find vulns? Here’s what Project Zero found googleprojectzero.blogspot.c…

Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models

Posted by Sergei Glazunov and Mark Brand, Google Project Zero IntroductionAt Project Zero, we co...

projectzero.google
5
78
9
254
52,524
putsi retweeted
@mikko
@mikko4 Apr 2024
I bet a song composed and performed by an AI will be a Top 40 hit during this year.
22
12
5
139
38,973
putsi retweeted
@mikko
@mikko16 Jun 2024
Video of the Keynote talk from last T2 infosec conference in history: 𝒮𝒴𝒮𝒯𝐸𝑀𝒮 𝒜𝐿𝒞𝐻𝐸𝑀𝒴. By @thegrugq. youtu.be/JYhIui542Xg

t2/2024 - Systems Alchemy: The Transmutation of Hacking (Thaddeus grugq)

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

youtube.com
9
1
28
14,096
This is how tears look like under the microscope. Insane
10
98
13
994
188,432
The first two weeks of the Vision Pro were absolutely insane. Here are 13 examples that prove the Vision Pro is the best piece of tech ever invented. 1) Real-time 3D surgery xitter.cf/Medivis_AR/status/1712…
278
2,484
497
21,050
9,577,846
Check out our new blog post! We hacked into Apple Travel Portal (yes, again!) using a 0-day Remote Code Execution exploit. Part 1 is live now, stay tuned for the follow-up on another RCE worth a total bounty of $40k! blog.projectdiscovery.io/hel…

Hello Lucee! Let us hack Apple again? — ProjectDiscovery Blog

Last year we conducted an in-depth analysis of multiple vulnerabilities within Adobe ColdFusion, we derived valuable insights, one of which revolved around CFM and CFC handling, parsing and executi...

projectdiscovery.io
4
110
5
351
44,600
The SSRF/auth bypass affecting Ivanti Pulse Connect Secure (CVE-2024-21893), is a great example of what can be achieved with a fully blind SSRF vulnerability (RCE). Read the @assetnote blog here which includes a reliable payload and generation steps: assetnote.io/resources/resea…

Ivanti's Pulse Connect Secure Auth Bypass Round Two

Second round of authentication bypass vulnerabilities in Ivanti Pulse Connect Secure, bypassing previous mitigations.

slcyber.io
3
83
2
346
32,827
I've made $500k+ from SSRF vulnerabilities. Here are my tricks:
84
1,198
19
4,388
443,814
PortSwigger Web Security disclosed a bug submitted by @mattaustin: hackerone.com/reports/127469… - Bounty: $3,000 #hackerone #bugbounty
19
2
115
24,229
Hackers, an important one. e.g.: we heard that CVSS "PR" is handled inconsistently (should be PR:None for self-sign-up). We're transparently listing a set of Detailed Platform Standards for consistency across programs. Need your help -- what to cover next? docs.hackerone.com/organizat…

Detailed Platform Standards | HackerOne Help Center

Organizations: HackerOne's Platform Standards for assessing rewards for a report

docs.hackerone.com
10
27
7
105
52,665
Web Security vs. Binary Exploitation
94
1,863
203
9,999
835,852
As promised: Here's the first $10,000 @Intel bug (aka CVE-2022-33942) that allows to bypass the authentication of Intel's DCM by spoofing Kerberos and LDAP responses. Exploit inside, enjoy 🥳 rcesecurity.com/2022/11/from… #BugBounty #security
16
247
5
803
Earlier this year, the Paranoids Vulnerability Research team  disclosed a critical remote code execution (RCE) vulnerability in @GoIvanti’s endpoint management product: yahooinc.com/paranoids/paran….

Paranoids Vulnerability Research: Ivanti Issues Security Alert | Paranoids | Yahoo Inc.

The Paranoids flagged a critical RCE vulnerability in Ivanti Endpoint Manager, leading to a hotfix to prevent malicious software distribution. Learn more.

yahooinc.com
1
16
53
11,151
Load more