https://xitter.cf/t.co/K6fgdC8lWu Security Researcher
Joined October 2016
- Tweets639
- Following179
- Followers121
- Likes467
Pinned Tweet
I’ve identified that it was possible to obtain full control of the 𝗙𝗶𝗯𝗲𝗿𝗚𝗮𝘁𝗲𝘄𝗮𝘆 𝗚𝗥𝟮𝟰𝟭𝗔𝗚 router (root access), provided by a Portuguese ISP (MEO), via the public WiFi network “𝗠𝗘𝗢 𝗪𝗶𝗙𝗶” which comes enables by default.
r0ny.net/FiberGateway-GR241A…
João Domingos retweeted
I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)
- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉
Try it here: github.com/jprx/darwin-vm
João Domingos retweeted
MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB
- unauthenticated memory disclosure
- public POC, trivial to exploit
- leaks creds, tokens, cloud keys straight from RAM
- huge exposed surface on the internet
Good writeups and technical details here:
doublepulsar.com/merry-chris…
ox.security/blog/attackers-c…
blog.ecapuano.com/p/hunting-…
Patch fast, rotate secrets, and assume exposed instances were scanned(!)
João Domingos retweeted
Dear friends and enemies:
I have just open sourced my auditing approach (pt 1)
xitter.cf/philbugcatcher/status/…
João Domingos retweeted
Here are the slides from my @TumpiConIT talk: Teaching LLMs how to XSS - An introduction to fine-tuning and reinforcement learning (using your own GPU)
docs.google.com/presentation…
João Domingos retweeted
Router RCE via the public WLAN interface *which cannot be disabled on your own router without calling the ISP* w/ bonus fault injection via HDD vibrations 🤠
👑King showing by @_r0ny and a shit show by @MEOpt
r0ny.net/FiberGateway-GR241A…
João Domingos retweeted
I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.
This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.
flatt.tech/research/posts/be…
João Domingos retweeted
Android greybox fuzzing with AFL++ Frida mode blog.quarkslab.com/android-g…
João Domingos retweeted
Excellent LPE write-up by @gabe_k , where he details how suspected compiler changes lead to the introduction of double fetch vulnerabilities. Also discusses a KASLR side channel bypass. PoCs included. Definitely check it out exploits.forsale/24h2-nt-exp…
João Domingos retweeted
If you never used the Piper extension, I recommend to watch the 4-minute demo I gave last year during my talk at @NorthSec_io 🛠️
youtube.com/watch?v=N7BN--CM…
Basically allows you to execute **any** tool/command on **any** part of an HTTP request/réponse. It can pipe tools together as well as automatically execute pipelines. You can even launch GUI tools such as meld for easy diffing @Agarri_FR mentioned it a while ago and it's awesome
João Domingos retweeted
We posted our third writeup of N-day full chain series:
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System medium.com/theori-blog/chain…
João Domingos retweeted
It took 3 years but finally I feel ready to release my Pwn2Own 2021 exploit code. 💖 Video talk covers my full research workflow, from attack surface modeling and reverse engineering, to vulnerability discovery and systematic exploit engineering, enjoy! #Pwn2Own
Release: VM Escape Exploit for Parallels Desktop Hypervisor (Pwn2Own 2021) zerodayengineering.com/resea…
A virtual machine escape exploit will typically require kernel privileges in the guest OS. In this exploit I chose to offload the reverse-engineered toolgate protocol implementation to a Python module, while keeping my low-level kernel code minimal, just enough to implement the attack interface - a nod to the principle of least privilege in systematic software engineering, which we miss a lot in non-trivial exploit development. -- @alisaesage
There's a new version of this post
João Domingos retweeted
connormcgarr.github.io/hvci/ Amazing how people found my preferred chapter (9) super-useful... Happy to read these articles @33y0re !!!
João Domingos retweeted
This is cool!
🔥Multiple XSS vulnerabilities in popular CMS Joomla! (CVE-2024-21726) 🔥
PHP bug could be used to bypass sanitization - We just disclosed the technical details behind the recent Joomla vulnerability:
sonarsource.com/blog/joomla-…
João Domingos retweeted
Many have asked about the process of doing security research. Mostly it's a lot of troubleshooting and getting bullied online. Join me for my new blog post which details the process of exploring an attack surface, finding 0day, and exploit dev. PoC inside
securityintelligence.com/pos…
João Domingos retweeted
💥BOOM!💥 Another privilege escalation blog, this time showcasing how to convert arbitrary file deletions 🗑️ to SYSTEM command prompt🌈 CVE-2023-27470. Learn about TOCTOU, pseudo-symlinks, MSI rollback exploits, and, of course, how to protect yourselves!
mandiant.com/resources/blog/…
João Domingos retweeted
I note theres a few people without practical real world RT experience wondering how you can know if an app like vscode is installed on a target in advance... well, with good targeting its actually pretty easy and historically there's been a bunch of ways to do this. For example, using a JS timeout event when accessing the URI on Edge will give you what you need...
João Domingos retweeted
No More Speculation: Exploiting CPU Side-Channels for Real by @akrasuski1
bughunters.google.com/blog/4…
