security consultancy company providing offensive security services for unlimited scale of business.
Joined September 2018
- Tweets26
- Following19
- Followers916
- Likes52
RedForce retweeted
The video about blind SSRF in Google Cloud for which @david_nechuta got $31k is out!
Watch it to see how it's sometimes possible to exfiltrate data with blind SSRFs. You can also test your own skills with hands-on lab 😎
Enjoy!
youtu.be/ashSoc59z1Y
RedForce retweeted
Twig 3 SSTI RCE
{{['cat${IFS}/etc/passwd']|filter('system')}}
xitter.cf/Black2Fan/status/12442…
#VolgaCTF 2020 Writeups:
Newsletter, User Center, VolgaCTF Archive
#domclobbering #xss #ssti
blog.blackfan.ru/2020/03/vol…
RedForce retweeted
This will have huge impact!, another great example on how RCE can be achieved on OWA easily through ViewState deserialization attack. Red Teamers it's your chance now :)
thezdi.com/blog/2020/2/24/cv…
RedForce retweeted
Jenkins pentesting notes and scripts github.com/gquere/pwn_jenkin…
RedForce retweeted
"There is no pre-auth RCE in Jenkins since May 2017, but this is the one!"
Relase a more reliable and elegant exploit - "awesome-jenkins-rce-2019" from my #HITB2019AMS talk. Thanks @0ang3el and @webpentest join this party! github.com/orangetw/awesome-…
RedForce retweeted
Just released viewgen, a ViewState tool capable of generating both signed and encrypted payloads with leaked validation keys or web.config files. All algorithms supported.
TL;DR: Got a web.config file or LFI on ASP.NET? Pop a shell!
github.com/0xACB/viewgen
RedForce retweeted
Apache Local Root: CVE-2019-0211: Vulnerability description. Exploit will come later.
cfreal.github.io/carpe-diem-…
RedForce retweeted
Analysis for【CVE-2019-5418】File Content Disclosure on Rails chybeta.github.io/2019/03/16…
RedForce retweeted
Blog post: Top 10 web hacking techniques of 2018: The Final Verdict
portswigger.net/blog/top-10-…
RedForce retweeted
Here is the whole exploit chain of Jenkins Unauthenticated RCE(and PoC video youtu.be/abuH-j-6-s0)!
Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!
blog.orange.tw/2019/02/abusi…
