Dominic White 👾

31.2K posts

Dominic White 👾 banner
Dominic White 👾

Dominic White 👾

@singe

Hacker @sensepost - minimally active here. Find me at https://t.co/j4QzFmubF1 || @singe.bsky.social

Katılım Ağustos 2007
585 Takip Edilen11.7K Takipçiler
Sabitlenmiş Tweet
Dominic White 👾
Dominic White 👾@singe·
Earlier this week I gave a talk to our internal hacking teams about the difference between good hackers and great ones that have been able to impact our field. I included three extended quotes - two from writers and one from Hamming that influenced my approach early on. Maybe some of it is useful for you.
Dominic White 👾 tweet mediaDominic White 👾 tweet mediaDominic White 👾 tweet media
English
6
31
103
19.3K
🥷🙇🏽 🇧🇷🇹🇬
🥷🙇🏽 🇧🇷🇹🇬@robertmida_k·
Mentionnes l’@ ou la première lettre du blaze de ta/ton crush sur Twitter, il/elle va venir te rep . Allez go !
Français
5
0
2
175
Paws on a Dime
Paws on a Dime@Crimeonadime·
@singe Will it only be accessible if you write an app?
English
1
0
0
16
Dominic White 👾 retweetledi
Dominic White 👾
Dominic White 👾@singe·
I'm impressed by how light weight the Apple on-device Foundation LLM is for Apple Intelligence, so I vibe'd a small macOS tool (26.0+) to interact with them. It supports GUI and CLI and tool calling. Even big responses fail to move the CPU/GPU by a single percentage. Link below.
Dominic White 👾 tweet media
English
2
1
2
501
Dominic White 👾
Dominic White 👾@singe·
@Crimeonadime The same. That’s what I’ll try next. Should be the same Swift calls just the UI that changes.
English
1
0
1
15
Dominic White 👾
Dominic White 👾@singe·
I don't know why this interview is in Moxie's boat sauna, but it's a fun way to remind non-security people not to use Telegram.
Sabrina Halper@SabrinaHalper

Founder of @signalapp, @moxie Marlinspike on Telegram:   "Telegrams not a private messenger. There's nothing private about it. It's the opposite. It's a cloud messenger where every message you've ever sent or received is in plain text in a database that telegram the organization controls and has access to it" "It's like 'Russian oligarch starts unencrypted version of WhatsApp', a pixel for pixel clone of WhatsApp. That should be kind of a difficult brand to operate. And somehow, they've done a really amazing job of convincing the whole world that this is an encrypted messaging app and that the founder is some kind of Russian dissident, even though he goes there once a month, the whole team lives there, and their families are there." " What happened in France is they just chose not to respond to the subpoena. And so that's in violation of the law. And, he gets arrested in France, right? And everyone's like, oh, France, but I think the key point is they have the data, like they can respond to the subpoenas where as Signal, for instance, doesn't have access to the data and couldn't respond to that same request.  To me it's very obvious that Russia would've had a much less polite version of that conversation with Pavel Durov and the telegram team before this moment. "

English
0
0
0
497
Dominic White 👾
Dominic White 👾@singe·
@infinitelogins Thanks for the shout out! The other unexpected use if for removing unnecessary cruft from responses for Burp AI to not truncate useful content later on. I mentioned this on LinkedIn too, but figure it's worth repeating here :)
English
0
0
2
143
Dominic White 👾 retweetledi
Harley Kimball
Harley Kimball@infinitelogins·
Dominic White's (@singe) Burp Global Match & Replace extension allows system-wide application of match & replace rules across all Burp Suite tools, not just the Proxy. This means your transformations work in Repeater, Intruder, Scanner, and other extensions, not just proxied requests. Practical Examples: IDOR Testing: Swap user IDs or session tokens globally to test authorization across all endpoints SSRF Hunting: Auto-inject your Burp Collaborator URL wherever internal URLs appear API Version Testing: Replace /api/v2/ with /api/v1/ system-wide to discover vulnerabilities in legacy endpoints WAF Bypassing: Automatically modify headers or content-types across all requests Check it out here 👇 github.com/singe/burp_glo… #BugBounty
English
1
9
74
3.6K
Dominic White 👾
Dominic White 👾@singe·
I updated that Burp Global Match & Replace plugin to use the Montoya API, be able to target specific Burp tools (or apply globally), extend the rule matching syntax, and give you a view per request and response of the changes.
Dominic White 👾 tweet media
English
1
1
1
338
Dominic White 👾 retweetledi
Aurélien Chalot
Aurélien Chalot@Defte_·
Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳
Aurélien Chalot tweet media
English
7
299
1.4K
70.3K
Dominic White 👾
Dominic White 👾@singe·
@tvmpt Can you explain the use case a bit more, why would you want to send two requests?
English
1
0
0
26
TvM
TvM@tvmpt·
@singe That sounds really useful. Would it be possible to add a feature where, instead of only modifying the request, Burp send the original request and then resend an additional modified request for each Match & Replace rule?
English
1
0
1
73
Dominic White 👾
Dominic White 👾@singe·
@_CryptoCat You can do it for a request, but not a response (one of my use cases was removing an overly long CSP so Burp AI wouldn't truncate the actual response data.
Dominic White 👾 tweet media
English
0
0
1
59
CryptoCat
CryptoCat@_CryptoCat·
@singe Can't you achieve the same with session handling rules? It let's you tick repeater, intruder, extensions etc
English
1
0
0
286
Dominic White 👾 retweetledi
_leon_jacobs(💥)
_leon_jacobs(💥)@leonjza·
Really excited to present this Frida training @1ns0mn1h4ck with @IPmegladon and myself! If you've dabbled with @fridadotre before, but want a practical learning opportunity to improve your usage and understanding, this one is for you!
Insomni'hack@1ns0mn1h4ck

Learn how to bypass security controls using Frida at #InsomniHack workshop. "Binary Instrumentation with Frida" is led by SensePost and it is made for reverse engineers & pentesters. Get your ticket: ow.ly/bPNA50XVBIx #Cybersecurity #INSO2026 #Cyberworkshops

English
0
3
6
1.8K
Dominic White 👾
Dominic White 👾@singe·
I know there’s a convenient & addictive algorithm here’s & I know you can still get relevant security news here. Maybe in the past you didn’t care about politics & Elon’s noise, but now X is generating nonconsensual sexual images of children. Take a fucking stand. Log off.
English
1
0
4
267
Dominic White 👾
Dominic White 👾@singe·
I know there’s a convenient & addictive algorithm here’s & I know you can still get relevant security news here. Maybe in the past you didn’t care about politics & Elon’s noise, but now X is generating nonconsensual sexual images of children. Take a fucking stand. Log off.
English
1
0
2
469