pyn3rd @pyn3rd

Security Researcher&Red Team&Cloud Security. BlackHat&HITB&CanSecWest Speaker. blog.pyn3rd.com Leeds, England Joined February 2016

Tweets

843
Followers

13K
Following

605
Likes

4K

pyn3rd @pyn3rd

3 weeks ago

Over coffee, found a vulnerability.

0 0 15 2K 0

Download Image

Wiz @wiz_io

a month ago

🚨 New research: A cryptomining campaign is hijacking exposed PostgreSQL, hiding payloads in fake 404 pages, and abusing legit infra. Multiplatform, stealthy, and still active 👉 wiz.io/blog/soco404-m…

0 10 20 2K 7

Download Image

#Bugcrowd Team's handling of my recent report has been absurd. I reported a bug 6 days ago, but they didn’t attempt to reproduce it right away. Today, after it was already fixed, they reproduced it and claimed the bug is no longer applicable, considering it theoretical.@Bugcrowd

10 1 65 8K 6

Download Image

pyn3rd @pyn3rd

2 months ago

Old but GOld! That's a good one!

H4x0r.DZ @h4x0r_dz

2 months ago

Old but GOld! That's a good one!

1 20 215 15K 143

Download Image

0 0 5 2K 1

Nir Ohfeld @nirohfeld

5 months ago

We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @kubernetesio project "Ingress-NGINX". The impact? From zero permissions ➡️ to complete cluster takeover 🤯 This is the story of #IngressNightmare 🧵⬇️

15 157 630 81K 302

Download Image

pyn3rd @pyn3rd

7 months ago

It was a genuine pleasure meeting @infosec_au in Sydney and receiving your insightful advice and valuable information. Thank you! Hope to see you again soon!

2 0 24 3K 0

Michael Stepankin @artsploit

8 months ago

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

8 84 303 28K 155

Download Image

pyn3rd @pyn3rd

8 months ago

I truly appreciate @albinowax's kind help in adding both my blog and slides to Web Hacking Techniques 2024.Thank you so much!

0 1 16 3K 2

pyn3rd @pyn3rd

9 months ago

#CVE-2024-49194 Databricks JDBC Driver via JAAS, Make JDBC Attack Great Again!! I’ve included the link to my write-up below. Enjoy!! blog.pyn3rd.com/2024/12/13/Dat…

4 49 177 18K 69

pyn3rd @pyn3rd

9 months ago

Activiti is a lightweight workflow and Business Process Management (BPM) platform that supports Expression Language expressions within its flows. In this example, I demonstrate how to exploit this feature to trigger RCE in a SpringBoot environment.

2 6 48 4K 9

Download Video

pyn3rd @pyn3rd

10 months ago

Use MSSQL CLR Assembly To Bypass EDR blog.pyn3rd.com/2024/11/22/How…

0 43 135 10K 58

pyn3rd @pyn3rd

10 months ago

XSS based on DNS CNAME Type Record

40 147 1K 100K 548

Download Image

pyn3rd @pyn3rd

10 months ago

I’m developing a DNS server that responds with random IP addresses and tracks response times. It’s designed to handle a high volume of cache-miss queries for DNS caching, like Local DNS Server.

0 1 25 4K 11

Download Image

pyn3rd @pyn3rd

10 months ago

I developed an SSH client rootkit to test EDR detection. When a user logs in, it captures the root password and sends it covertly via a DNS TKEY record. With high daily DNS traffic, EDR systems are unlikely to flag this, as analyzing every query would impact performance.

8 45 369 36K 248

Download Image

tonghuaroot @tonghuaroot

11 months ago

Just read "Make JDBC Attacks Brilliant Again", a fantastic 3-year-old research piece that @pyn3rd recently recommended to me. It starts with JDBC attack principles and root causes, dives deep into implementation issues—including their discovery of a Weblogic RCE—unveils new…