Security & IT guy|CC|CPSA|CRT|OSCP|PAM-CDE|OWASP Lifetime Member| Goal for 2024, OSEP,CRTP
Joined January 2022
- Tweets160
- Following325
- Followers81
- Likes7.2K
AndyLiao retweeted
That's my chain ā a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all š
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
AndyLiao retweeted
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confuā¦
Highlights include:
ā” Escaping from DocumentRoot to System Root
ā” Bypassing built-in ACL/Auth with just a '?'
ā” Turning XSS into RCE with legacy code from 1996
Before I start CRTP by Altered Security, I thought I know some AD. After first chapter, ok I know a little about AD.
Itās interesting that my office implemented new policy after a security audit. Hide our wifi SSID.
Just found out how to automate things using netmiko. Shorten my work from 40 minutes to 5 minutes. I should have know this earlier.
AndyLiao retweeted
Made some more updates to my list of VM's for those who are preparing for the PWK/OSCP. The new list includes an active directory section for those that want to go through certain AD boxes to prepare for the course.
Here is the link: docs.google.com/spreadsheetsā¦
Health is the most important thing, no exceptions. Iām currently on a health issue leave, hopefully Iāll get well on schedule by the doctor.
Dunning-Kruger effect is so true, for specific products Iām in stage āknow I donāt knowā. However, I also have some skills that are in āknow I knowā or ādonāt know I knowā. Try hard to fill the gap for things I donāt know in that product.
If your installation means that you could ātry and errorā in customerās environment. Then I am able to install the product. But it seems that Iām not allowed to make any errors when Iām in charge of the installation.
AndyLiao retweeted
CVE-2024-31497: Critical PuTTY Vulnerability Exposes Private Keys securityonline.info/cve-2024ā¦
Email is an old technology but it still play an important role in most businesses.
Google now blocks spoofed emails for better phishing protection - @serghei
bleepingcomputer.com/news/goā¦
bleepingcomputer.com/news/goā¦
It still amazed me that many employers want almighty in IT or security field. Nobody can literally know everything.
Doing lab is fun, especially when you break things and fix it by yourself. Experience is what nobody can teach you. However, some people consider lab time useless.(Not having profitable output)
Procedures are meant to be followed. If no one really cares about procedures, why bother making one.
AndyLiao retweeted
After a few months of reviewing the latest PWK course, I have decided to refactor my list to create a new list of VM's for those who are preparing for the PWK/OSCP.
Here is the link to see the new list: docs.google.com/spreadsheetsā¦
Itās horrifying when your colleagues are testing WAF with random pick google results payloads without knowing what the payloads actually doing. Even if the target is an internal site, as a engineer you should always know what you are doing.
