Web Security Researcher | h2c smuggling, JSON Interop vulns, Server-side Spreadsheet Injection | AppSec @OpenAI; formerly @BrexHQ, @BishopFox
Joined October 2012
- Tweets437
- Following403
- Followers2.3K
- Likes495
Amazing work @albinowax! I’m just blown away with your creativity in finding new desync variants. I’m looking forward to trying it out in the labs.
Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling by @albinowax
portswigger.net/research/bro…
Jake Miller retweeted
The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2021!
portswigger.net/research/top…
Jake Miller retweeted
It seems that there is a lot confusion about the log4j JNDI injection vulnerability (CVE 2021-44228). In our latest blog post we provide additional background fundamentals about JNDI and JNDI exploitation (and a lot of links): mogwailabs.de/en/blog/2021/1…
Jake Miller retweeted
Check out our blog post on Context Aware Content Discovery blog.assetnote.io/2021/04/05… - we drop a tool (Kiterunner - github.com/assetnote/kiterun…) and some datasets. Hope you can find more endpoints through our work!
Jake Miller retweeted
Found another jndi bypass like 🟠's groovy bypass using org.yaml.snakeyaml.Yaml. Heres a controller for rouge-jdni to add it to your arsenal gist.github.com/TheGrandPew/….
Great research by @artsploit! Also, be sure to check out the labs and updates to content at portswigger.net/web-security…
New attacks on OAuth: SSRF by design and Session Poisoning by @artsploit portswigger.net/research/hid…
Awesome to see @seanyeoh finding some epic examples of h2c smuggling! Great work @assetnote team!
My colleague @seanyeoh wrote up his security research on H2C smuggling and the various cloud providers he successfully exploited (Cloudflare, Azure). He also released a tool called h2csmuggler! Check it out at blog.assetnote.io/2021/03/18…
Excited to share that I have just started a new position on the AppSec team @BrexHQ! Looking forward to being a part of their awesome team :)
Jake Miller retweeted
I used Radamsa to fuzz and find an inconsistency between 2 NodeJS URL parsers and bypass host whitelisting in Kibana webhooks. The impact was low here but the parser issue can probably cause some trouble in other Node code bases. Read more details 👇 blog.deesee.xyz/fuzzing/secu…
More great lessons on fuzzing from @Nosoynadiemas! I am always excited when I see a new post in this series. Thank you for sharing!
Learn how to take aim at HTTP attack surfaces in @Nosoynadiemas series on fuzzing the Apache Web Server github.co/2OdR2SK
Jake Miller retweeted
Istio vulnerability with an 8.2 CVSS. They're calling it a 0day. Also a lesson in JWT validation mistakes.
> If a JWT token is presented with an issuer that does not match the issuer field specified in JwtProvider, then the request is mistakenly accepted
groups.google.com/g/envoy-se…
Jake Miller retweeted
JSON Interoperability vulnerabilities sound like they have some serious bug-bounty potential. Nice work once again by @theBumbleSec/@bishopfox
labs.bishopfox.com/tech-blog…
Just when you thought JSON was the one thing you could trust. My latest research on JSON interoperability vulnerabilities highlights the risks of inconsistent parser behavior (40+ parsers) and attacks to bypass business logic in microservice architectures. labs.bishopfox.com/tech-blog…
Accompanying labs and cheat sheet: github.com/BishopFox/json-in…
This is a career highlight and an incredible honor. Thank you so much!
The top 10 web hacking techniques of 2020, by
@albinowax with help from @filedescriptor, @irsdl, @Agarri_FR and the entire community
portswigger.net/research/top…
Jake Miller retweeted
A short post to address an exploit chain I did in last year. Both slides and YouTube video are online now - A Journey Combining Web Hacking and Binary Exploitation in Real World! blog.orange.tw/2021/02/a-jou…
Jake Miller retweeted
#CodeQL was also used by @NASAJPL to find critical bugs on Curiosity mission 9 years ago and they were fixed remotely!
Honored that @NASA is using GitHub, Actions, and CodeQL for the Mars drone flight software: github.com/nasa/fprime
If anyone working on this needs GitHub support, please feel free to DM me directly!
Jake Miller retweeted
This is very clever: renaming the process to "a\rUid: 0\rGid: 0"! Absolutely kicking myself that I didn't think of that when I was working on an exploit for Apport a little while ago.
@Gr33nh4t has found a new Ubuntu LPE, he found a way to #exploit @ubuntu's "Apport" crash handler to achieve privilege escalation. Check out his new research.
@ubuntu_sec
alephsecurity.com/2021/02/16…
Jake Miller retweeted
I Own your Cloud Shell...
Taking over “Azure Cloud Shell” Kubernetes Cluster Through Unsecured Kubelet API
hencohen10.medium.com/i-own-…
[30,000$ Bug Bounty]
via @chencococococo
