rayh4c @rayh4c

Joined August 2010

Tweets

120
Followers

2K
Following

4K
Likes

206

Massimo @Rainmaker1973

3 years ago

How many of these science laws and math equations/constant do you know? [source, zoomable hi-res: buff.ly/2Y9AcHj]

531 1K 9K 0 1K

Download Image

Yuki Chen @guhe120

3 years ago

wormable？

3 13 116 0 9

0 0 0 0 0

hackerfantastic.x @hackerfantastic

4 years ago

😂

1 31 124 0 18

0 0 0 0 0

The ultimate problem of security, all operable and input variables are code execution loopholes, because all variables may be printed in logs. This is a loophole in the annals of history, the ultimate dream of hackers, and the jewel in the crown.

0 0 1 0 0

rayh4c @rayh4c

4 years ago

This is a privacy detector. All fields related to personal privacy can be filled in.

Haifei Li @HaifeiLi

4 years ago

This is a privacy detector. All fields related to personal privacy can be filled in.

0 1 1 0 1

1 0 0 0 0

rayh4c @rayh4c

4 years ago

YES~Lookups is an object lookup requirement, it has no security design.

Haifei Li @HaifeiLi

4 years ago

YES~Lookups is an object lookup requirement, it has no security design.

1 0 2 0 0

0 1 1 0 0

rayh4c @rayh4c

4 years ago

A joke, the automatic discovery of the windows client normally does not request the TLD, but the external network firewall may block all the automatic discovery requests of the client, causing it to eventually go to the TLD.

BleepingComputer @BleepinComputer

4 years ago

2 50 81 0 8

0 0 0 0 0

rayh4c @rayh4c

4 years ago

nice~ The key is that the directory traversal of ExtractInfFile leads to a predictable path

heige @80vul

4 years ago

nice~ The key is that the directory traversal of ExtractInfFile leads to a predictable path

0 30 80 0 9

0 0 1 0 0

rayh4c @rayh4c

4 years ago

This is not a new thing, a semi-public red team technique, Microsoft's official domain name can become the c&c of cobalt strike! Reference vullnerability.com/blog/microsoft…

0 0 4 0 0

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Automatic on-premises Exchange Server mitigation is now in Microsoft Defender Antivirus. We have taken this additional step to further support our customers who have not yet implemented the complete security update. Learn more: msft.it/6017VMA3d

3 163 289 0 14

rayh4c @rayh4c

5 years ago

nice work~

0 0 1 0 0

rayh4c @rayh4c

5 years ago

Godaddy's sso api does not seem to be secure, it is full of security holes, such as yenthanh.medium.com/how-did-i-hack…. But the official should have a better security plan to deal with, and give users an account of the loss.

Cream Finance 🍦 @CreamdotFinance

5 years ago

22 50 256 0 3

0 0 1 0 0

rayh4c @rayh4c

5 years ago

I really want to know the story behind it. I don’t know how much money was lost in this attack.

2 0 1 0 0

rayh4c @rayh4c

5 years ago

The security of cloud-based IOT devices concentrates all the key points on the supplier company itself, and getting one company puts the entire industry at risk ~ verkada.com/security-updat…

0 0 0 0 0

rayh4c @rayh4c

5 years ago

The epic security breach massacre that lasted three months～

ESET Research @ESETresearch

5 years ago

The epic security breach massacre that lasted three months～

3 112 191 0 10

0 0 0 0 0

rayh4c @rayh4c

5 years ago

Yes, APT actors have also noticed this, and the IE 0day (CVE-2021-26411) attack carried out in the wild was also hunted down by the Chinese security team.

Haifei Li @HaifeiLi

5 years ago

Yes, APT actors have also noticed this, and the IE 0day (CVE-2021-26411) attack carried out in the wild was also hunted down by the Chinese security team.

0 1 0 0 0

0 1 9 0 0

rayh4c @rayh4c

5 years ago

In fact, the attack log has already given clues to the vulnerability...&schema=ResetOABVirtualDirectory ~ reddit.com/r/sysadmin/com…

Praetorian @praetorianlabs

5 years ago

In fact, the attack log has already given clues to the vulnerability...&schema=ResetOABVirtualDirectory ~ reddit.com/r/sysadmin/com…

0 54 89 0 8

Download Image

0 0 0 0 0

rayh4c @rayh4c

5 years ago

Such mitigation measures should be released as soon as possible, not after the mass attack.

Ann Johnson @ajohnsocyber

5 years ago

Such mitigation measures should be released as soon as possible, not after the mass attack.

0 21 29 0 3

0 0 0 0 0

rayh4c @rayh4c

5 years ago

Although many security companies have published detailed reports of attacks, for most customers, this is an unsuspecting massacre. Shameful~huntress.com/hubfs/Mass%20E…

Huntress @HuntressLabs

5 years ago

Although many security companies have published detailed reports of attacks, for most customers, this is an unsuspecting massacre. Shameful~huntress.com/hubfs/Mass%20E…