Tillson Galloway

Recently released my first iOS app in 10 years –– it's a social platform for sharing your airport lounge visits with friends and completing challenges (including the elusive ATL marathon, where you visit all seven sky clubs in one day) apps.apple.com/us/app/loungem…

This is super-interesting research: Actively Understanding the Dynamics and Risks of the Threat Intelligence Ecosystem ndss-symposium.org/wp-content/upl… [PDF]

How I discovered leaked Snowflake credentials for a Fortune 500 Manufacturing Company using… @tillson.galloway/how-i-discovered-leaked-snowflake-credentials-for-a-fortune-500-manufacturing-company-using-6adfdfcc3657?source=rss------bug_bounty-5" target="_blank" rel="nofollow noopener">medium.com/@tillson.gallo… #bugbounty #bugbountytips #bugbountytip

Why don’t they make elevator buttons so you can press them again to unselect a floor?

Can we eliminate the C2 server entirely and create truly autonomous malware? On the Dreadnode blog, Principal Security Researcher @0xdab0 details how we developed an entirely local, C2-less malware that can autonomously discover and exploit one type of privilege escalation vulnerability. A future where fully autonomous red team assessments are powered by nothing more than a pre-installed local model and a Lua interpreter may be closer than you’d imagine. Read about it here: dreadnode.io/blog/lolmil-li…

Want to make a crypto donation or become an official sponsor? Now you can with @ensdomains! 1. Send your crypto to vondebate.eth 2. Contact me to confirm and i'll issue you a receipt to deduct on your taxes! Here's a chance to use crypto to support your community!

BlackHat 2025 swag superlatives. Best emerging vendortainment technology award goes to t-shirt/sock hot presses and the escape room

Up and Running with GitHound for secret scanning in 5 minutes (github.com/tillson/git-ho…, 1.3K stars) @tillson.galloway/up-and-running-with-githound-for-secret-scanning-in-5-minutes-e644890e9e16" target="_blank" rel="nofollow noopener">medium.com/@tillson.gallo…

List of *free* sources for timely and reasonably vetted malicious threat feeds for domains, IPs, and files. Did I miss any? AlienVault OTX Pulses (otx.alienvault.com) Malware Bazaar (bazaar.abuse.ch) URLHaus/ThreatFox (abuse.ch) OpenPhish (openphish.com/feed.txt) EmergingThreats (rules.emergingthreats.net) Conversely, do you have experience with high false-positive rates from any of these?

@cyb3rops I wonder if the increase in detections is (even partially) due to these vendors using that specific YARA rule

If you’re tracking the AV detection rate for the web shells dropped in recent SharePoint attacks (CVE-2025-53770), here’s the current picture: Samples: 27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2 b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93 Detections: still very low or zero. But my colleague Arnim’s community YARA rule caught these immediately when first dropped: #L5078" target="_blank" rel="nofollow noopener">github.com/Neo23x0/signat… A solid reminder why layered detection approaches matter. #SharePoint #YARA #ThreatDetection #CVE202553770 Btw, this detection is already live in THOR Lite and THOR Cloud Lite. I’ll also add detection for the compiled ASPX soon. nextron-systems.com/thor-cloud/

GitHound Explore, the world's most powerful GitHub Recon platform, just got supercharged with AI-powered result filtering. Get started with 25 free scans at githoundexplore.com

maxread.substack.com/p/a-literary-h… Obligatory post for WWDC day - someone did a literary analysis of the fake texts/people in the Apple marketing assets

6 key techniques for GitHub recon: githoundexplore.com/blog/github-re… #BugBounty

My bug bounty triage pet peeve: reporting a vuln via a company’s external responsible disclosure policy as a Good Samaritan, only for their system to create a linked report on Bugcrowd that ends up getting marked NA, therefore negatively affecting your platform reputation. Companies typically define scope very generically on their own websites, but have more details on their private H1/BC pages. When you use external forms, you are forced to blindly submit reports. Not an issue with any particular triager — it’s a platform design flaw with managed triage integrations on @Hacker0x01 and @Bugcrowd.