Independet Security Researcher. Former @Immunityinc @AppgateSecurity
Joined December 2009
- Tweets377
- Following852
- Followers283
- Likes2.7K
Pinned Tweet
I wrote a blogpost about Misconfigurations in Java XML parsers that can lead to security vulnerabilities.😀 #xxe #ssrf #infosec #pentesting Check out here:
Check out Immunity's blog post:
Misconfigurations in Java XML Parsers by Anibal Irrera
immunityservices.blogspot.co…
Aníbal Irrera retweeted
XBOW autonomously discovered CVE-2024-50334, a critical authentication bypass in Scoold, an open-source Q&A webapp used by major companies like Cisco and IBM. Our latest blog post details how it found the flaw: xbow.com/blog/xbow-scoold-vu…
Aníbal Irrera retweeted
This is an experiment we did with all the benchmarks, removing descriptions showed us that XBOW performs just as well as with descriptions.
This is one of my favorite examples, it is fully capable of understanding how GraphQL works and exploit an IDOR creating custom queries
Real vulnerabilities don’t come with hints—so we asked XBOW to solve this task without giving it even a description of the benchmark. It performed just as well, finding exploiting an GraphQL-based IDOR vulnerability entirely autonomously: bit.ly/3XYPTQJ
Aníbal Irrera retweeted
Se viene la World Cup de @Hacker0x01 de nuevo🚨🚨
- Queres participar de scopes copados?
- Queres ganarte entradas a los LHE?
- Queres ser parte de la comunidad?
Comenta este tweet o manda DM. Tambien podes unirte a h1.community/argentina-hacke…
Se agradecen los retweet 🙏
Aníbal Irrera retweeted
Latest Anvil blogpost on how @Alex91dotar and I found two new CVEs in GOG Galaxy 2.0 is right out of the oven! I can stress enough how much I enjoy merging my passion for gaming with my passion for security!
Give it a read and tell us what you think!
anvilsecure.com/blog/galacti…
Aníbal Irrera retweeted
Gente se viene la World Cup de nuevo! Con premios que todavia no puedo contar pero que estan 🔥🔥
Tenes ganas de participar y conocer mas gente de la comunidad? Comenta asi te agrego al discord de @Hacker0x01.
Mas info pronto, stay tuned! #BugBounty
Se agradecen los retweet 🙏
The #AmbassadorWorldCup is back! 🙌 March marks the beginning of 9 months of epic competition. Are you up for the challenge?
Ambassadors all over the world are recruiting teams now. Contact your regional leader to join in. More details coming soon. 👀 bit.ly/3lMs6lO
Aníbal Irrera retweeted
¿Queres aprender sobre hardware hacking? ¿Tu empresa o productos utiliza hardware de terceros y no sabes cómo auditarlos? ¿Tenes dispositivos IoT en tu red y queres hacer un pentest? Anótate en mi training de la @ekoparty y aprende de forma práctica.
ekoparty.org/en_US/eko2022/t…
Aníbal Irrera retweeted
Just opened 8 bugs I found in Windows Credential Guard. Ranged from arbitrary code exec in VSM to Kerberos key disclosure attacks. Probably my favorite was abusing the NTLMv1 API to leak an AES128 key which is what I was cracking in the quoted tweet😁 bugs.chromium.org/p/project-…
I must say, crack.sh is pretty impressive. 45 seconds for a NTLMv1 hash :) Of course if anyone can tell me what the password was I'd appreciate it, seems I've forgotten😂
ALT Results of a crack.sh job for a NTLMv1 hash.
Aníbal Irrera retweeted
Querés aprender sobre sistemas embebidos para arrancar un research o aplicarlo a tu laburo? Confía tranquilo que @6e726d te puede dar todas esa sabiduría en este curso de la Eko! Puro 🔥, no te vas a arrepentir!
EKOPARTY TRAININGS 2022 ⚡¡Formate con los mejores referentes de la industria!
📌INTRODUCCIÓN PRÁCTICA A LA AUDITORÍA DE SISTEMAS EMBEBIDOS
by Andrés Blanco (@6e726d)
+info en: ekoparty.org/r/raM
Reservá tu lugar➡️ ekoparty.org/r/64N
Aníbal Irrera retweeted
Unsafe .Net Deserialization in Windows Event Viewer! This is a by-product of my research. Has confirmed with MSRC that this didn't cross any security boundary, but I guess it could still be another fun #LOLbas or Defender Bypass.😆
Aníbal Irrera retweeted
#Spring4Shell details are now public, It is an old ClassLoader Manipulation. Actually, CVE-2022-22965 is just a bypass of the 12 years old CVE-2010-1622 (exchange.xforce.ibmcloud.com…)
Aníbal Irrera retweeted
Dejamos la slides de las charlas que se dieron en @securityjam
@airrera - Analizando XXE
@MrNox_ - How not to win Pwn20wn
@pastaCLS - Gif2png Memory Corruption
@SecSignal - Escalating Firmware Vulnerabilities
🔗Link: drive.protonmail.com/urls/XV…
#securityjam
Muchas gracias a la organización de la @securityjam y en especial a @intthree por el regalo para los speakers! Gracias Albert! Hermoso! 😊
Aníbal Irrera retweeted
🚨Cerramos el Line-Up de JAM 🚨
⚡️T-R-E-M-E-N-D-O⚡️
⚠️SOLD OUT⚠️
Speakers🗣️
@airrera
@MrNox_
@pastaCLS
@SecSignal
ArtistX🎤
@luvitorres
Streaming Twitch📽️
@Age_Of_Entropy
Sponsors🦾
@pucara @faradaysec @Immunityinc @hackmetrix
Aníbal Irrera retweeted
Gracias @Immunityinc por ser parte historica y por apoyar nuevamente a la JAM . 🙏
Aníbal Irrera retweeted
📢Abrimos los CFP 💌
👋Veni y contanos que estas haciendo. Como intentas innovar o como fallaste intentando. Como buscaste un bug o simplemente algún tema que interese dar. Mientras este levemente relacionado con la seguridad informática ,todo vale.
Aníbal Irrera retweeted
🚨🚨🚨18 de Marzo , 18.30HS🚨🚨🚨
🤖Security Jam 2022 - Edición Marzo 👾
Mini-charlas levemente relacionadas con seguridad.
De gente 🧠y con much@ ❤️🔥 para dar.
🙏No te olvides de tu entrada para la para las consumiciónes, se acaban rápido. 👇
eventbrite.com.ar/e/security…
ALT https://www.eventbrite.com.ar/e/security-jam-edicion-2022-marzo-tickets-289732145647
