Pinned Tweet
I started a blog series about container breakouts. Here is the first about how-to escape out of a container with access to the root directory of the host.
Follow-up posts are in the pipeline
blog.nody.cc/posts/container…
jan harrie retweeted
Yet another pitfall when extracting archives, this time from @NodyTweet
blog.nody.cc/posts/link-writ…
Thank you @bunq for not helping me. 3 month of waiting and still no money back. Do you not care about freelancers?
jan harrie retweeted
Wave hello to the #LABScon23 program committee:
Julia Knecht (@JuliaaMarieee) is an Application Security Engineering Manager at Netflix, working on a team takes an engineering-first approach to securing applications and services at scale and speed.
@bunq dear team, I have closed accidentally 1 of 2 Accounts/Profiles. The sub-acc with money is gone from the overview. Re-Activating from Archived accounts was also not possible. Now the Archived accounts button is also gone.
It looks like the support has no idea.
Do you write blog article during the working hours? Not? Maybe this great article from @leifdreizler from @segment // @twilio will help you to get it on the radar of you manager :)
I just released a follow-up to my recent blog. It's all about creating a culture of community involvement at your company!
It has a focus on getting new folks involved with blogging and conference speaking and helping them promote their work.
leif.substack.com/p/share-th…
jan harrie retweeted
This is the first part of a series of blogs I've been wanting to write for a while on #Container #security
This one looks at container security and explore a bit how they're built and how you can use in-built Linux tooling to interact with containers.
securitylabs.datadoghq.com/a…
jan harrie retweeted
Security assessment rule of thumb: the more „interesting“ or „obscure“ a feature is the more vulns it has!
jan harrie retweeted
Patch you Gits!
End of last year I had the big pleasure to work with @marver and Eric from @X41Sec in a code review of Git.
Here's what we got for you:
openwall.com/lists/oss-secur…
x41-dsec.de/security/researc…
jan harrie retweeted
How I got two pre-auth RCEs on PandoraFMS. 3sjay.github.io/2023/01/06/p… Thanks @frycos for the proof reading ;)
jan harrie retweeted
🚰 Released a taint analysis package and demo CLI tool (sqli) to find SQL injections in Go programs:
github.com/picatz/taint
📓Also wrote a blog post to explain how it works:
picatz.github.io/#blog/taint
jan harrie retweeted
Another SAML bug to wrap up the year: bugs.chromium.org/p/project-….
jan harrie retweeted
#Skype for Business Audit by @frycos
Part 1 - SKYPErsistence
frycos.github.io/vulns4free/…
Part 2 - SKYPErimeterleak
frycos.github.io/vulns4free/…
jan harrie retweeted
wrote a chip8 emulator in #rustlang that compiles to #webassembly a few months ago and it was fun so I wrote an article about how it works: bernsteining.github.io/chiph… merry x-mas everyone :)
Quote of the day from Alan Kay:
"If most computer people lack understanding and knowledge, then what they will select will also be lacking"
jan harrie retweeted
📓 An introduction to using SSA to analyze Go programs: picatz.github.io/#blog/gossa
jan harrie retweeted
CVE-2022-40127 : Apache Airflow < 2.4.0 DAG example_bash_operator Remote Code Execution.
PoC
github.com/Mr-xn/CVE-2022-40…
jan harrie retweeted
HashiCorp #Consul 1.14 -- now generally available -- introduces the Consul dataplane, service mesh traffic management across cluster peers, and service failover enhancements. hashi.co/3ArycwH
jan harrie retweeted
#Azure Bastion may be abused by an adversary to bypass network boundaries and access internal Azure VMs on arbitrary ports.
Writeup: codyburkard.com/blog/bastion…
🧵
