Anis_Boss

Check out my article on Bash: bypassing command restrictions with obfuscated commands in the latest issue of PagedOut, and all the other cool articles while you are at it.

I'm very excited to finally share the first part of the research I did into Ghostscript. This post details the exploitation of CVE-2024-29510, a classic format string bug, which we abuse to bypass the SAFER sandbox and gain RCE. codeanlabs.com/blog/research/…

If you have a Pico and an old Gameboy, try hooking its PWM output up to the GB's crystal input. Turns out this just works! (at your own risk, this might not be good for the GB's CPU long term..) th0mas.nl/2023/12/28/ove…

The most common mobile app attack vectors include: Rooted or jailbroken devices; Network attacks; & Malicious apps. This & more takeaways from our recent webinar w/ @Riscure's @AnisBoss_ and Zimperium's Tim Hartog & @bdogd: bit.ly/3K6Q0SQ #WeSecureMobile #MobileSecurity

Glad to share with you my recently discovered CVE in zone minder product (CVE-2023-26039). The vulnerability has been discovered during pb ctf 2023, thanks to @Unblvr1 for the great challenge. Link: github.com/ZoneMinder/zon…

Last year, @krvalk and I uncovered a series of vulnerabilities in Feathers.js, Sequelize and SocketIO that lead to critical issues for our client. Now that everything is fixed, here's our write-up of this journey into Javascript madness. codean.io/blog/vulnerabi…

The slides for the @offensive_con talk “Bug Hunting S21's 10ADAB1E FW” of @ffmenarini and myself can be found here: dropbox.com/s/2f14ga52jguu… Enjoy! We are still around at the conference so stop by and say hi.

Exploiting NFS server via SSRF #HITCON CTF 2021 Metamon-Verse Writeup r0.haxors.org/posts?id=27

Moodle Stored XSS and Blind SSRF i've found earlier this year with @holme_sec r0.haxors.org/posts?id=20

......WHAT?

A small writeup about HelloWorld challenge in CTF 3k2021. #font #truetype #stack-based-vm #assembly github.com/kaftejiman/ctf…

#3kCTF-21 exploits to echo and klibrary, two kernel challenges that I created for this CTF: github.com/MaherAzzouzi/L… and here exploits for the user-land challenges iterrun - stdout and masterc : github.com/MaherAzzouzi/L…

#3kCTF-2021 my pwn challenges exploits telnet github.com/rekter0/ctf/bl… babyrtos github.com/rekter0/ctf/bl…

#3kCTF-2021 - ppaste writeup r0.haxors.org/posts?id=15

#3kCTF-2021 is over, Thank you for playing ! Final scoreboard: 1- Never Stop Exploiting 2- Black Bauhinia - @BlackB6a 3- zer0pts - @zer0pts 4- greunion - @greunion_ctf 5- zh3r0

#3kCTF-2021 ~12 hours left 8 challenges remain unsolved Current standing 1- Black Bauhinia - @BlackB6a 2- Never Stop Exploiting 3- greunion - @greunion_ctf

#3kCTF-2021 10 hours later, current standing 1- Black Bauhinia 2- Never Stop Exploiting 3- ISITDTU

We're excited to partner with @1Password for #3kCTF There'll be 1 Free Year of 1Password Families for all participants 2021.ctf.the3000.org

about 3 days to go, registration is open at: 2021.ctf.the3000.org/home We're Happy to have @SpyseHQ as a sponsor #3kCTF

@ITSecurityguard #BEGBOUNTY -_-

#bugbountytip #bugbounty #pii #critical #bugbountytips GET /api/users/1 (where I'm user 1) -> HTTP 200 GET /api/users/;/2 -> HTTP 100 GET /api/users/;;/2 -> HTTP 200 GET /api/users/;;;/2 -> HTTP 300 GET /api/users/;;;;/2 -> HTTP 400 GET /api/users/;;;;;/2 -> HTTP 500