Q5Ca
238 posts
Q5Ca
@_q5ca
Chief Remote Work Officer at @u0Kplusplus
Vietnam Katılım Kasım 2017
389 Takip Edilen958 Takipçiler
Microsoft isn’t paying a bounty because this related to “enterprise copilot” which apparently isn’t covered? I don’t even know what that means… I have an M365 copilot license and a P1 license lol. What are they talking about.
Zack Korman@ZackKorman
Microsoft isn’t disclosing this so: M365 Copilot allowed users to access files without producing an audit log. All you had to do was ask Copilot to not link to the file. You don’t even have to ask; it sometimes just happens. If your org uses Copilot your audit log is likely wrong
English
Hacking Windsurf: I asked the AI for the shell, it said yes.
new video’s out. I show how I could’ve hacked you… just by getting you to click my link.
Link posted below.
English
@haxor31337 @_q5ca Hi @haxor31337 it was a great talk loved it totally 🙌 also I have a question when you used ActivitySurrogateSelector gadget it prompted almost 16k+ characters payload and you mentioned that the querystring supports 2048 characters did you tried to use -minify option in ysoserial
English
From SSRF to RCE and transfer money in core banking.
It is really cool red team case. A perfect combination of external and internal vulnerabilities for each other to bypass the monitoring and detection of the blue team.
Present by my colleague @_q5ca
youtu.be/xBnMrNCuO_w?si…
YouTube
English
Burn out, platforms not always playing the right game , some programs scamming you.. it's not all beautiful in Bug Bounty. Find a backup plan ;) only the wise will start diversifying. The next years will become very hard.
English
YouTube
English
Happy to share that my colleague @vudq16 and I will be speaking at PHDays in Moscow 🇷🇺 next week, May 24th. I’ll share a story from one of our red team projects, with techniques to maximize stealth during the operation.
Hope to make new connections there:D
phdays.com/en/forum/progr…
English
English
Just a quick reminder: Copilot on microsoft365.com (m365.cloud.microsoft/chat) is not on scope for bounty 🥲
duongq5ca.substack.com/p/another-micr…
English
Congrats @_l0gg! You did the thing I thought was impossible. Hard work pays off 💪
TrendAI Zero Day Initiative@thezdi
Confirmed!! Dinh Ho Anh Khoa (@_l0gg) of Viettel Cyber Security combined an auth bypass and an insecure deserialization bug to exploit #Microsoft SharePoint. He earns $100,000 and 10 Master of Pwn points. #Pwn2Own #P2OBerlin
English
