FoxGlove Security

@DylanOwendylan @robertgraham looks familiar...

@robertgraham My kid got one of these …

Ok, parents, after tonight's trickortreat haul, what poisonous substance did you find in your children's candy?

HP has released the security bulletin which addresses the vulnerability described in our blogpost support.hp.com/nz-en/document…

@juhasaarinen @breenmachine Everything was known in August.

We think HP should be more concerned with foxes than wolves - "A Sheep in Wolf's Clothing - Finding RCE in HP's Printer Fleet" by @breenmachine - foxglovesecurity.com/2017/11/20/a-s…

Dropping @breenmachine and @dronesec latest Windows privilege escalation project - For exploit devs and pentesters - foxglovesecurity.com/2017/08/25/abu…

New blogpost by @jstnkndy on abusing Type Juggling and PHP Object Injection to gain SQLi foxglovesecurity.com/2017/02/07/typ…

New blogpost from @breenmachine on abusing JasperReports servers to get shells on a pentest foxglovesecurity.com/2016/10/14/hac…

New blog post about @breenmachine's Derby talk - Privilege Escalation from Service Accounts to SYSTEM in Windows foxglovesecurity.com/2016/09/26/rot…

Our first PWNSchool event was a success! Anyone interested in hacking more bounties with us, sign up for round 2! pwnschool.wordpress.com

@breenmachine and @jstnkndy are hosting free training in Montreal pwnschool.wordpress.com - come hack on @Bugcrowd bounties with us!

@campbellstevend We're working on it ;)

New blog post by @BrandonPrry - Finding pearls; fuzzing ClamAV foxglovesecurity.com/2016/06/13/fin…

Why DoS isn't compromise - 5 Years of Real Penetration Test Data to Stand Behind (foxglovesecurity.com/2016/05/10/why…)

New blog post, we hope it gives you the warm and fuzzies: foxglovesecurity.com/2016/03/15/fuz…

New blog post, because who doesn't like getting cleartext credentials using wireless attacks? foxglovesecurity.com/2016/02/24/whe…

Potato for Win10 updated, no more waiting for shells to pop! Shout out to @vvalien1 for the trigger! Now on Github.

New blog post and tool, codename "Potato", that will get you SYSTEM on Windows, get it while it's hot: foxglovesecurity.com/2016/01/16/hot…

Welcome to the newest version of the @foxglovesec team @BrandonPrry !

Deserializing arbitrary user controlled content? IT'S UNIVERSALLY STUPID, MAN twitter.com/foxglovesec/st…

@daveaitel @jstnkndy @breenmachine Glad you liked it. I'll be sure to submit to Infiltrate if I find any more cool unserialize bugs