Open Source Software Engineer 👨💻 and Security. Mostly post at 🐘 https://xitter.cf/t.co/RkvderXArs
🇦🇺
Joined April 2008
- Tweets132
- Following400
- Followers319
- Likes130
You have a bash command line of "exec program ..." and you control "..." can you make it do something different? What if it is somewhat sanitised for shell metacharacters? If you can inject $[+] it will make bash error on that line and run the next. 👀 dgl.cx/2025/10/bash-a-newlin…
I'll be speaking at BSides Canberra: cfp.bsidescbr.com.au/bsides-… -- this will cover my recent find of an RCE in Git (dgl.cx/2025/07/git-clone-sub…) and how that and some other vulnerabilities could be used against developers.
New blog post: Ghostty 1.0.0 terminal security; dgl.cx/2024/12/ghostty-termi… (CVE-2024-56803)
David Leadbeater retweeted
Latest write up from @davidgl detailing his research into terminal escapes and the 10 ‼️ @NISTcyber CVEs that had potential for remote code execution.
@defcon @MSFTBlueHat @_everythingopen @linuxaustralia @linuxfoundation
#opensource #cybersecurity
gresearch.com/blog/article/g…
For once a non-security terminal thing. I'm sure someone else has written this but I couldn't find it; here's a simple script that makes commit IDs in "git log" clickable (in many terminals): gist.github.com/dgl/ef848e75…
Thank you to everyone who attended my @_everythingopen talk, with more of my terminal research. I've published the Docker image PoC that I demoed, see infosec.exchange/@dgl/110019…
David Leadbeater retweeted
📣 Speaker Announcement 📣
David Leadbeater @davidgl, software engineer at G-Research, will be speaking at #BlueHat this week. David’s talk will explore over 20 years of terminal vulnerabilities, from attacks via Apache's log files to attacking via Kubernetes. 👏
ALT BlueHat 2023: Meet Our Speakers Houdini of the Terminal: From Kubernetes to RCE David Leadbeater Software Engineer | G-Research Microsoft BlueHat: February 8-9, 2023
David Leadbeater retweeted
Security tip for those about to appear on TV goo.gl/7YT1f