Dhiraj @RandomDhiraj

Learning & Fuzzing! (https://t.co/6tO5jCpR7e) inputzero.io nowhere Joined June 2015

Tweets

544
Followers

3K
Following

132
Likes

19K

Panos Gkatziroulis 🦄 @netbiosX

3 days ago

🛠️ A serverless command & control (C2) framework 🗓️ Leverages Google Calendar APIs, as a covert communication channel between operators and a compromised system github.com/deriv-security…

1 28 114 5K 66

Dhiraj @RandomDhiraj

3 days ago

I just published MeetC2 - A serverless command & control (C2) framework that leverages Google Calendar APIs, as a communication channel. github.com/deriv-security… #infosec #redteam

0 6 14 958 4

Dhiraj @RandomDhiraj

a week ago

Just thought of sharing. YubiKey's OATH app lets you name accounts anything including base64 files, turning into a tiny file storage. #infosec #redteam

0 1 5 375 1

Download Image

Dhiraj @RandomDhiraj

2 weeks ago

Through libfuzzer, I found a heap-overflow in libssh2 which is now fixed. github.com/inputzero/Secu… #infosec #fuzzing

0 0 4 178 0

Yesterday at DEFCON 33, we participated in the Bio Hacking Village and conducted security assessment of PET/CT imaging systems. Successfully identifying three vulnerabilities, which were responsibly reported to the vendor. #infosec #defcon33

1 2 7 892 0

Download Image

Dhiraj @RandomDhiraj

a month ago

Through libFuzzer, double-free of icalproperty objects. github.com/inputzero/Secu… #infosec #fuzzing

0 0 3 227 1

Dhiraj @RandomDhiraj

a month ago

Through libFuzzer, LibArchive ACL Buffer Overflow Vulnerability (Low) - github.com/inputzero/Secu… #infosec #fuzzing

0 0 6 334 2

Dhiraj @RandomDhiraj

2 months ago

I wrote a blog on Medium, "Brewing Trouble - Dissecting a macOS Malware Campaign". medium.com/deriv-tech/bre… #infosec #redteam

1 2 4 725 2

Dhiraj @RandomDhiraj

3 months ago

We (@p1ngfl0yd) are currently running 10% discount on our fuzzing course for DEFCON use the below link to register your interest in our two-day training program. Discount link: training.defcon.org/discount/DCTLV… #infosec #fuzzing #defcon

0 1 2 883 0

Dhiraj @RandomDhiraj

3 months ago

Alright! I'll be presenting my tool "SmuggleShield" at BlackHat USA, see you there if you are around.(github.com/RootUp/Smuggle…) #infosec #redteam #blueteam

0 0 4 975 0

Download Image

MalDev Academy @MalDevAcademy

3 months ago

Offensive Phishing Operations Update 2 Released: maldevacademy.com/phishing-cours… - HTML Smuggling Strategies - Analyzing and Evading SmuggleShield (S/O @RandomDhiraj) - Integrating Anti-Bot With HTML Smuggling - SVG Smuggling - WebAssembly Smuggling

0 29 173 9K 71

MalDev Academy @MalDevAcademy

4 months ago

The next update for the Offensive Phishing Operations course will be heavily focused on HTML Smuggling and will be going up against @RandomDhiraj's awesome SmuggleShield. We'll also be demonstrating a module that combines anti-bot capabilities with HTML smuggling. More info:…

0 12 116 8K 20

Dhiraj @RandomDhiraj

5 months ago

Stoked! Our (@r00treaver) work on SVG Smuggling is now part of MITRE ATT&CK (T1027.017)! attack.mitre.org/techniques/T10… #infosec #redteam

1 15 73 5K 19

Download Image

The Hacker News @TheHackersNews

5 months ago

Never trust a favicon at face value. 👀 @RandomDhiraj demonstrates how attackers can hide malicious files inside .ico icons by exploiting their dual directory structure — allowing payloads to slip past filters in a stealth move similar to HTML smuggling.

Dhiraj @RandomDhiraj

5 months ago

5 59 305 34K 260

Download Image

0 21 63 17K 16

Dhiraj @RandomDhiraj

5 months ago

Just learned a neat way of hiding file within favicon (.ico). You can manipulate the dual directory entry structure and smuggle any file type in it. Here is a quick raw script I put together for testing.(github.com/RootUp/Persona…) #infosec #redteam

5 59 305 34K 260

Download Image

Dhiraj @RandomDhiraj

6 months ago

I'll be at @BlackHatEvents Asia presenting my tool "SmuggleShield", do visit my station if you are around. #infosec

0 1 11 3K 2

Download Image

Dhiraj @RandomDhiraj

6 months ago

Great research here this technique leverages Rust’s capabilities to compile to WASM for HTML smuggling (lrqa.com/en/cyber-labs/…) - Next Level Smuggling with WebAssembly. However, my extension "SmuggleShield" prevents such crafted file by default. #infosec #redteam #blueteam

0 14 81 6K 29

Download Image

Dhiraj @RandomDhiraj

6 months ago

Thank you @1ns0mn1h4ck I had fun delivering the talk last week, such a great audience. I talked about my research named SVG smuggling and the open-source tool "SmuggleShield". (github.com/RootUp/Smuggle…) #infosec