Pit

🚨 New Open Source Audit Alert! 🚨 Shielder, with @OSTIFofficial & @CloudNativeFdn, audited @karmada_io: 🔍 6 issues found (1 high, 1 medium, 2 low, 2 info) ✔️ Most fixed, others planned. 🗣️ to @suidpit and @Th3Zer0 Full details in the blog post! shielder.com/blog/2025/01/k…

Cheers -- here in beautiful Bali 🏖️ for #theSAS2024 conference! If you happen to be here, please reach out and let's have a chat 🍻

🛡️

@smaury92 10/10 would help resurrecting ancient techniques again

Thanks to @suidpit I've finally found the motivation to document an iptables privilege escalation technique I've used as part of a CTF back in 2017! Also kudos to him for finding a brand new one by combining iptables and iptables-save!

sudo iptables -A ESCALATION -s shielder -j ACCEPT

lua interpreters something something fakeobj addrof something something wasm something deda.lol/posts/2024-09-…

🍎 With many #macOS security mechanisms at work, one might wonder how malware manages to bypass them. Get ready for a deep dive into macOS security architecture and novel evasion techniques during Pietro Tirenna's (@suidpit) talk at #TheSAS2024. 🚀 Secure your seat: kas.pr/6pyu

During a recent engagement @Mindlaess_ hacked his way through @vtigercrm which led to discover a privilege escalation and a SQL injection. Learn more in the dedicated advisories: - CVE-2024-42994 #sqli shielder.com/advisories/vti… - CVE-2024-42995 #privesc shielder.com/advisories/vti…

dojo-yeswehack.com/challenge/play… not all strings are made equal

Back in December 2023 our researchers @Th3Zer0 @suidpit and @Mindlaess_ performed an audit sponsored by @awscloud and facilitated by @OSTIFofficial on boost. It resulted in 7 findings and 15 new fuzzers. The report is now public, check the details here: shielder.com/blog/2024/05/b…

@mebeim suggested fix: gnu.org/software/emacs…

Anyone else getting a sudden urge to punch the monitor every time this thing appears in VSCode or is it just me?

Exciting news! We've just released a new blog post on mobile app security, where @suidpit and @Th3Zer0 used their intent-fu to discover vulnerabilities (CVE-2024-26131, CVE-2024-26132) in @element_hq, a @matrixdotorg client for Android. #writeup #CVE shielder.com/blog/2024/04/e…

We recently partnered with @OSTIFofficial to perform a security audit sponsored by @awscloud on @brefphp. The audit resulted in 5 findings promptly addresses by @matthieunapoli. The report is now public, check the details here: shielder.com/blog/2024/03/b…

Excellent writeup showing how to track down vulnerabilities in firmwares starting from CVEs through patch diffing Credits @suidpit and @Th3Zer0 shielder.com/blog/2024/01/h… #embedded #infosec #asus

And that's a wrap! Exceptional reports from exceptional #hackers 🥳 More content from @nullcon and #bugbountytips coming up ⏭️. Cheers to the amazing exploits 🎉 and to many more like these events to come. #HackWithIntigriti @Nestle

Hey hackers - attending @nullcon? Pop to say hi and talk about AppSec and VR! You can find @smaury92 @Th3Zer0 @suidpit @not4nhacker around 🖖🏿

We're announcing our second flagship "Hunting Zero-Days in Embedded Devices" training this year at @cybersaiyanIT, in Rome, 24-27th September!! 4 days of PWNING 💻 romhack.io/training/2024/… Contact us for limited offer discount codes, only 4 u, as our Valentine's gift ❤️❤️❤️

OMG, our "Cookie Crumbles" paper got into the Top-10 Web Hacking Techniques of 2023 by @PortSwiggerRes! Have a look at the paper if you haven't yet usenix.org/conference/use… and check the other outstanding finalists! Thank you ❤️

Hip, hip, hooray! It's been 10 years of AppSec Ezine! Big shoutout to all who have been supportive along the journey and to the security community that made this project possible. Cheers 🥂 520th Edition: #t2ZtjVuY69l95mCkKoscQ6gsWvNiD+j/Fqo0daNDO/k=" target="_blank" rel="nofollow noopener">pathonproject.com/zb/?6ba3505270… Repo: github.com/Simpsonpt/AppS… #AppSec #Security

Ever wondered how to binary diff router firmwares to write n-day exploits? Learn how @Th3Zer0 and @suidpit combined unblob, binexport, ghidra, Qiling, and an Asus router to write an exploit for CVE-2023-39238. The outcome was unexpected ... 1/7 shielder.com/blog/2024/01/h…