pyn3rd @pyn3rd

Security Researcher&Red Team&Cloud Security. BlackHat&HITB&CanSecWest Speaker. blog.pyn3rd.com Melbourne, Victoria Joined February 2016

Tweets

844
Followers

14K
Following

607
Likes

4K

Qubit @q810034

2 weeks ago

I just published From XSS to RCE: Critical Vulnerability Chain in Anthropic MCP Inspector(CVE-2025–58444) medium.com/p/from-xss-to-…

0 7 20 19K 11

pyn3rd @pyn3rd

a month ago

Over coffee, found a vulnerability.

0 0 16 2K 0

Download Image

Wiz @wiz_io

2 months ago

🚨 New research: A cryptomining campaign is hijacking exposed PostgreSQL, hiding payloads in fake 404 pages, and abusing legit infra. Multiplatform, stealthy, and still active 👉 wiz.io/blog/soco404-m…

0 10 19 2K 7

Download Image

#Bugcrowd Team's handling of my recent report has been absurd. I reported a bug 6 days ago, but they didn’t attempt to reproduce it right away. Today, after it was already fixed, they reproduced it and claimed the bug is no longer applicable, considering it theoretical.@Bugcrowd

10 1 65 8K 6

Download Image

pyn3rd @pyn3rd

2 months ago

Old but GOld! That's a good one!

H4x0r.DZ 🇰🇵 @h4x0r_dz

2 months ago

Old but GOld! That's a good one!

1 21 215 16K 143

Download Image

0 0 5 2K 1

Nir Ohfeld @nirohfeld

6 months ago

We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @kubernetesio project "Ingress-NGINX". The impact? From zero permissions ➡️ to complete cluster takeover 🤯 This is the story of #IngressNightmare 🧵⬇️

15 156 630 81K 302

Download Image

pyn3rd @pyn3rd

7 months ago

It was a genuine pleasure meeting @infosec_au in Sydney and receiving your insightful advice and valuable information. Thank you! Hope to see you again soon!

2 0 24 3K 0

Michael Stepankin @artsploit

8 months ago

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

8 84 303 28K 156

Download Image

pyn3rd @pyn3rd

8 months ago

I truly appreciate @albinowax's kind help in adding both my blog and slides to Web Hacking Techniques 2024.Thank you so much!

0 1 16 3K 2

pyn3rd @pyn3rd

10 months ago

#CVE-2024-49194 Databricks JDBC Driver via JAAS, Make JDBC Attack Great Again!! I’ve included the link to my write-up below. Enjoy!! blog.pyn3rd.com/2024/12/13/Dat…

4 49 177 18K 69

pyn3rd @pyn3rd

10 months ago

Activiti is a lightweight workflow and Business Process Management (BPM) platform that supports Expression Language expressions within its flows. In this example, I demonstrate how to exploit this feature to trigger RCE in a SpringBoot environment.

2 6 48 4K 9

Download Video

pyn3rd @pyn3rd

10 months ago

Use MSSQL CLR Assembly To Bypass EDR blog.pyn3rd.com/2024/11/22/How…

0 43 135 10K 58

pyn3rd @pyn3rd

10 months ago

XSS based on DNS CNAME Type Record

40 146 1K 100K 549

Download Image

pyn3rd @pyn3rd

11 months ago

I’m developing a DNS server that responds with random IP addresses and tracks response times. It’s designed to handle a high volume of cache-miss queries for DNS caching, like Local DNS Server.

0 1 25 4K 11

Download Image

pyn3rd @pyn3rd

11 months ago

I developed an SSH client rootkit to test EDR detection. When a user logs in, it captures the root password and sends it covertly via a DNS TKEY record. With high daily DNS traffic, EDR systems are unlikely to flag this, as analyzing every query would impact performance.

8 45 367 36K 247

Download Image

tonghuaroot @tonghuaroot

11 months ago

Just read "Make JDBC Attacks Brilliant Again", a fantastic 3-year-old research piece that @pyn3rd recently recommended to me. It starts with JDBC attack principles and root causes, dives deep into implementation issues—including their discovery of a Weblogic RCE—unveils new…