@_lely___

Manager, Product Security @Okta

Joined August 2014
  • Tweets82
  • Following307
  • Followers816
11Media
The comprehensive list of today's emerging threats, nOtWASP bottom 10: vulnerabilities that make you cry by @albinowax, @artsploit and @garethheyes portswigger.net/research/not…

nOtWASP bottom 10: vulnerabilities that make you cry

Everyone's heard of the OWASP Top 10 - the often-cited list of major threats that every web developer should be conscious of. But if you cast your gaze across pentest reports and bug bounty findings,

portswigger.net
4
122
8
247
New attacks on OAuth: SSRF by design and Session Poisoning by @artsploit portswigger.net/research/hid…

Hidden OAuth attack vectors

Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an

portswigger.net
8
421
16
882
The top 10 web hacking techniques of 2020, by @albinowax with help from @filedescriptor, @irsdl, @Agarri_FR and the entire community portswigger.net/research/top…

Top 10 web hacking techniques of 2020

Welcome to the Top 10 (novel) Web Hacking Techniques of 2020, our annual community-powered effort to identify the must-read web security research released in the previous year. Over the past few weeks

portswigger.net
4
233
10
494
Power up the Burp Suite and get stuck into our latest Web Security Academy topic! We've designed a whole new set of labs on OAuth Authentication for your password-avoiding pleasure. portswigger.net/web-security… #websecurityacademy #burpsuite #OAuth2
6
70
5
280
Can you spot a critical vulnerability in this innocent code? Learn about Spring View Manipulation in our latest article github.com/veracode-research… #java @springframework
16
247
14
658
Jolokia enhances JMX remoting with unique features like pre-auth RCE 🤔
publiclyDisclosed@disclosedh118 Feb 2020
Mail.ru disclosed a bug submitted by johndoe1492: hackerone.com/reports/703910 - Bounty: $2,000 #hackerone #bugbounty
2
10
30
We have confirmed the successful demonstration from @artsploit used a previously reported bug. This counts as a partial win, but does earn him 12.5 Master of Pwn points. #P2OMiami #S4x20
2
2
12
Up next and making his #Pwn2Own debut, Michael Stepankin (@artsploit) of Veracode will be targeting a remote code execution with continuation against the Inductive Automation Ignition in the Control Server category. #P2OMiami #S4x20
3
16
Just posted Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2. Using a payload containing three different programming languages :) spaceraccoon.dev/remote-code…

Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring...

The Spring Boot framework is one of the most popular Java-based microservice frameworks that helps developers quickly and easily deploy Java applications. With its focus on developer-friendly tools...

spaceraccoon.dev
9
280
3
549
Olga Barinova retweeted
ϻг_ϻε@steventseeley14 Jan 2020
I'm excited to share my post about discovering & exploiting multiple critical vulnerabilities in Cisco's DCNM. Busting Cisco's Beans :: Hardcoding Your Way to Hell srcincite.io/blog/2020/01/14… PoC exploit code: srcincite.io/pocs/cve-2019-1… srcincite.io/pocs/cve-2019-1… srcincite.io/pocs/cve-2019-1…
15
290
6
562
Olga Barinova retweeted
Securitum@securitum_com16 Oct 2019
Our guy, @SecurityMB, had a presentation at OWASP Poland Day about exploiting prototype pollution to RCE on the example of Kibana, by abusing environmental variables in node. The slides are here: slides.com/securitymb/protot… We will also release a writeup soon so stay in touch!

Prototype Pollution in Kibana

Presentation I did for OWASP Poland Day, 14th October 2019

slides.com
4
117
5
253
Here are my slides from XSS magic tricks slideshare.net/GarethHeyes/x…
6
223
5
495
On the volunteering side this time at #GlobalAppSec #Amsterdam @AppSecEU
1
15
Apache Solr Injection whitepaper is now available at github.com/artsploit/solr-in… Thanks everyone who attended my #defcon talk!

GitHub - veracode-research/solr-injection: Apache Solr Injection Research

Apache Solr Injection Research. Contribute to veracode-research/solr-injection development by creating an account on GitHub.

github.com
5
234
3
449
Short story about blind HQL Injection (MySQL case) #hqlinjection #hibernate #spiderlabs trustwave.com/en-us/resource…
3
75
1
158
Apache Solr research is completed and I'm happy to present some ways to RCE in this innocent looking search engine. See you @ #defcon27 @defcon defcon.org/html/defcon-27/dc… …
2
67
4
223
In our latest blog post we show you various ways how to attack RMI based JMX services. We also release our fork of sJET, which is called MJET (obviously). mogwailabs.de/blog/2019/04/a…
29
46
Expression Injection in Qlik Products (CVE-2019-11628). The fresh advisory has been published just now. trustwave.com/en-us/resource…
1
9
1
26
Blog post about attacking Java RMI services, a extension to the talk from Hans-Martin Münch at this years Bsides Munich mogwailabs.de/blog/2019/03/a…. You can also find the slides/material on our GitHub account #BSidesMUC19
2
54
3
76
heh :D
Michael Stepankin@artsploit18 Mar 2019
What a neat 'Function.prototype.toString()' implementation in modern javascript! If you can control the key of a class object to be returned, 'constructor'.toString() returns the whole class Source code.
1
Load more