🫡🫡

Some good insight from @DidierStevens youtu.be/eh3BD7v8cZQ?si=7Thg… could be useful to make life harder where it fails (as a benifit) in databouncing

Approved 🫡

Hmmm Databouncing + Fastflux, hmmmm

Too huh ? 😂

If you want to databounce via email gist.github.com/yosignals/dc… This is crude but functional It will use the hostname space as you’d expect, 500 recipients per send

Ubi looks great but, looks locked in, synology has a good balance of flexibility and integration (just doesnt have that slick ubi UX)

we feel that the only reason Databouncing hasn’t gotten the attention it deserves is because the PoCs have mostly been fun demonstrations of its capability - if you could share for reach 🙌❤️ 4/4

I’d be happy putting a reward out for whoever authors something stable first, you’d get support from myself @DeathsPirate and @N1ckDunn where we have time 3/4

While databouncing is a solid egress, it might be a good time to introduce SSRF as a means to pull data in to close the loop for data in data out leaning on trusted and ‘useful idiots’ online, keeping infrastructure heavily fragmented and awful to track 2/4

A little bit of positive downtime, and we’re back at it We’re looking for some assistance in building databouncing integration into C2 frameworks (Sliver, Tuoni, Merlin, others ?) 1/4

checkcybersecurity.service.n… great for businesses, and databouncing aficionados ?

While databouncing is pretty unstoppable in most cases it’s always nice if you’re gifted even more: PAN-234015 The X-Forwarded-For (XFF) value is not displayed in traffic logs.

Narrowcasting is the term, and it’s made things very ugly 🫠

Oh my

Seeing lots of databouncing candidates on Chinese infrastructure 🥸

Ayo #bugbounty hunters, you want to squeeze some money out of those lame host header poisonings ? Check out CWE-441 - then check out #databouncing - all you have to do is argue with triage until you are a millionaire 😁🫡

@teamcymru_S2 do you fancy a run at countermeasures ?

without actually putting any data on any services of those domains, this is industrialized exfiltration and no one seems to have an answer.