pentester/infosec/ infosec researcher of nothing
Inisde opcodes, between 0x's
Joined August 2019
- Tweets141
- Following582
- Followers420
- Likes914
Pinned Tweet
Every day, I remind myself that the security community's obsession with rockstars and their narrow definition of what is considered 'technical' can be toxic. Instead of seeking validation from others, what truly matters is working on the things I am passionate about.
In this post, I dive into how Flutter apps generally encrypt requests using RSA, how to analyze the compiled binaries, and how I reverse using frida, blutter
Check it out here: incogbyte.github.io/posts/fl… thanks @fridadotre @enovella_ @sleepya_ #infosec
丨几匚ㄖᎶ乃ㄚㄒ乇! retweeted
It's been a while – here's a brand new reversing short on how to interpret log messages in Apple's binaries!
youtu.be/-uIeRISQaiI #reversingshorts
丨几匚ㄖᎶ乃ㄚㄒ乇! retweeted
Our #r2Frida trainees put their knowledge in practice and it publicly!
n0psn0ps.github.io/2024/06/0…
If you have lost the opportunity, you have another chance to learn from it in our next @_ringzer0 Training in Las Vegas with @Hexploitable and me.
ringzer0.training/doubledown…
Shosubgo now accepts a wordlist of subdomains. Checkout GitHub.com/incogbyte/shosubg… v3.0 thanks 🙏
Thanks @Jhaddix mentioned shosubgo github.com/incogbyte/shosubg… at @SANSOffensive . Awesome talk, and good tips for cloud recon 👾👾👾
I just completed the #burpchallenge. I found a logic bug where after requesting a password reset, the link sent to the email had a token that did not expire and had a predictable pattern, after understand the pattern, it was possible to account takeover of any user
With the arrival of @palera1n, I made a script, using frida, to bypass jb checks based on relative paths and also include some bypass for more common antitampers like ptrace, geppid. codeshare.frida.re/@incogbyt… @fridadotre and thans to @ios_euphoria for the GUI♥️
I'm sharing a script using frida, to bypass sslpinning more common (Android).
gist.github.com/incogbyte/1e…
codeshare.frida.re/@incogbyt… #BugBounty #bugbountytips #fridadotre @fridadotre
small write up about PHPIPAM CVE-2022-23046 with exploit, incogbyte.github.io/post/202… #bugbounty #bugbountytips #infosec #beginner
丨几匚ㄖᎶ乃ㄚㄒ乇! retweeted
📲 We are pleased to present the utility developed by our researcher @lmpact_l for Flutter apps traffic monitoring.
Just make app trust installed certificates by repacking it with reFlutter and hunt bugs using Burp Suite. No root, no VPN, no more hassle!
github.com/ptswarm/reFlutter
I added a template, for nuclei to identify a XSS without authentication in Lucee check.
github.com/projectdiscovery/…
#bugbountytips #nuclei
Those who haven't seen my tool on h@cktivitycon, this one [github.com/incogbyte/shosubg…] and the conference also so you didn't see [youtube.com/watch?v=qLTe6Z10… ] thanks to @Jhaddix @0x0g @Hacker0x01
#bugbountytips #BugBounty
I wrote a small tool to grab subdomains from Shodan
github.com/incogbyte/shosubg…
yeah.. i know that this already exist but.. i made another ;) #peace #golang
丨几匚ㄖᎶ乃ㄚㄒ乇! retweeted
Check this out if you want to learn about a lesser known IDOR variant, how to leverage markdown for hacking, what Jason Haddix & Frans Rosén are up to these days & more!
#hacking #websec #InfoSec #bugbountynews #T5HN #pentesting #bugbounty #pentest
pentester.land/newsletter/20…
I wrote a little bit about a pentest that I did, and I got domain admin
incogbyte.github.io/domain-a…
#BugBounty #PenTest
how to detect if someone is using burp suite? it's possible ? incogbyte.github.io/detectin…
I wrote a small guide with some common techniques to bypass WAF, focus on SQL injection..
incogbyte.github.io/sqli_waf…
#bugbountytips #bugbountytip