Offensive security research & building @OphionSecurity

Joined May 2019
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Replying to @S1r1u5_
This has been my experience with building out Ophion Security with the team. There is so much fun things happening in security
2
103
Rojan Rijal retweeted
donate.gov.np is now live. You can donate to the Government of Nepal Prime Minister’s Disaster Relief Fund from anywhere in the world via debit/credit card (Visa/Mastercard, 3D Secure), mobile banking, connectIPS, wallets, UPI-India, UnionPay, eSewa, or Alipay+. Choose USD or NPR. Large donations can also go via SWIFT. Official channel. Direct. Transparent. Support rescue, relief and rehabilitation operations. Donate: donate.gov.np #DonateToNepal #PMDRF #NepalRelief
11
61
1
117
6,197
If you are an on-site volunteer working on rescue effort, helping provide medicine and more in Nepal, please also consistently check nepaldisastersearch.com/. We are consistently uploading more photos and data on missing loved ones. If you identify anyone, contact information of their loved ones is also shared directly. #nepal #nepaldisaster #nepalflood #rasuwa
1
155
With the devastating situation going on in Nepal, we have built a website to share about your loved ones with ease allowing you to uploda their photos and information. We also correlate the data with NDRRMA website to identify rescued loved ones with the profile. nepaldisastersearch.com/ #nepal #nepaldisaster #nepalflood
202
Damn, I get it Claude it is critical.
1
447
Replying to @adnanthekhan
What has been your experience with Bedrock like specially around the cost? Have been thinking of doing something similar for a different use case but I am not sure what the cost would be like.
49
Replying to @disputifier
@disputifier let us know if we can help in any way! No expectations or selling anything.
1
3,261
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online. That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values. In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country. Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers. I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection. In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders. THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
2,337
7,005
1,354
33,567
9,499,660
If you are building a vibe coded app and launching a product out of it, hit us @OphionSecurity and we will do a security assessment and have actionable security measures ready within 72 hours. #vibecoding #security #cybersecurity
If you want free API keys just open the network tab on literally every vibe coded app. In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.
238
I just got access to an attacker's daily diary. Here is what I learned 👇 🕘 9:00 AM: Clock in. 🔎 9:12 AM: Google Dork says dev-login.company.com is still alive. 😎 9:30 AM: No rate limits, no auth. Just vibes. 🗃 10:00 AM: Dumped staging DB from test-api-v2.company.net. 😬 10:20 AM: Reused creds work on prod. Consistency is key. 🛡 10:45 AM: Oh no… a WAF! 😈 10:46 AM: JK, it’s only on www. Your 12 forgotten subdomains are unprotected. 🥪 12:00 PM: Lunch break. Your asset inventory is crying is forgottenland. 💀 2:00 PM: You schedule a pentest. 📅 2:01 PM: For next quarter. 🪄 3:00 PM: Still pivoting. Still no alert. 🎯 4:30 PM: Internal Jenkins on an old subdomain. Secrets everywhere. 💰 4:45 PM: Got user data, employee data, AWS keys. It’s a buffet. 🕔 5:00 PM: Clock out. Easy day. jk..... Attackers don’t follow your IR plan. They don’t wait for your quarterly pentest. They don’t work 9–5. They hunt exposed assets, old creds, shadow subdomains, public GitHub leaks, leaked data in SaaS that will give away more information or give PII etc. They’re hacking every minute. Are you? #attacksurfacemanagement #offensivesecurity #cybersecurity #hacking #continuousmonitoring #assetinventory #offensivemonitoring
1
1
569
I hacked UberEats in 2017. Here is the story. #ubereats #hacking #uber #cybersecurity #bugbounty
2
1
614
It was amazing to present at @_kernelcon_ today. Thank you for the gift KernelCon team! #kernelcon #offensivesecurity #researchontheroad
4
381
💥 Q1 Update from the Field: Real-World Hacking with Orion 💥 In Q1, we pointed Orion, our offensive Attack Surface Management platform, at a large enterprise to see what it could uncover. The results speak for themselves: 🔍 𝟵 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱 🚨 𝟴 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹, 𝟭 𝗛𝗶𝗴𝗵 🤖 The High severity finding was discovered entirely by Orion with no human involvement 💰 Approximately $𝟰𝟱,𝟬𝟬𝟬 in rewards from responsible disclosure 🌐 Orion also surfaced multiple vulnerabilities in widely-used open-source software such as a supply chain vulnerability in a Microsoft repository The 9 issues had the potential to expose millions of users’ sensitive data including 𝗦𝗦𝗡𝘀, 𝗗𝗼𝗕𝘀, 𝗲𝗺𝗮𝗶𝗹𝘀, 𝗮𝗻𝗱 𝗮𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀. If exploited, they could have led to major regulatory fines, incident costs, and increased insurance premiums. 𝗤𝟮 𝗴𝗼𝗮𝗹: 𝟱𝟬+ 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀. 𝗟𝗲𝘁’𝘀 𝗴𝗼 🔍⚔️ #OffensiveSecurity #AppSec #RedTeam #SecurityAutomation #BugBounty #ASM
2
332
We are doing #VibeSecurityForAI If you are an AI startup (pre-seed or seed ) we will test your application for free. We are doing this only for next two weeks. We are hackers who have hacked major companies like Zoom, AWS, Amazon, Google, banks and more. DM me or contact us @OphionSecurity. #AISecurity #vibecoding #pentest #securityassessment
1
3
247
Not yet a full multiplayer but doing some basic "Simon Says" style game with increasing difficulties. Will add leaderboard style system soon. Open to ideas to improve it further @levelsio taptastic.app
185
Replying to @aidenybai
Not even kidding, @aidenybai you should look into integrating this into a phishing platform that security teams can use. It is killer to deploy quick phishing exercises in pentests.
102
tj-actions compromise is a great reminder that pinning the action/dependency to a commit SHA instead of a version tag is safer and securer. We monitor repositories of some public organizations, and most of them are safe because they use a SHA like tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf. However, if an organization is pinning the malicious commit they are still vulnerable: 0e58ed8671d6b60d0890c21b07f8835ace038e67 stepsecurity.io/blog/harden-… #github #supplychain
Oh wow, a popular GitHub Action (tj-actions/changed-files) was fully compromised. Someone committed a base64-encoded payload that runs a script that in turn prints out encoded secrets… Stay safe out there!
4
1,479
🚨 Continuous Monitoring Prevents Million-Dollar Breaches 🚨 In cybersecurity, threats evolve but so should our defenses. At Ophion Security, we continuously monitor Fortune 500 companies’ public assets not just domains and IPs, but also SaaS services, cloud assets, and web applications that often slip under the radar. In October, we identified a vulnerability in a Fortune 500 subdomain that exposed highly sensitive PII (DoB, SSN, Addresses, Phone Numbers) to unauthenticated users. Fast forward a few months: Our continuous monitoring flagged a new but similar asset: a different domain, but familiar API patterns in its JavaScript. Recognizing the fingerprint of a shared infrastructure, we re-tested the vulnerability from October. It was still exploitable. We immediately reported it. 💡 Key takeaway? Cyber risks don’t end when you fix a single issue. Without continuous monitoring, this vulnerability could have gone unnoticed until an attacker found it first. 🛡️ Proactive security isn’t just an option it’s a necessity. If you’re not continuously monitoring your entire attack surface, someone else is. And they may not have your best interests in mind. #CyberSecurity #ContinuousMonitoring #BreachPrevention #AttackSurfaceManagement #CTEM #Pentest
2
266
I reached level 11 in Taptastic! 🎮 Final speed: Super Fast Tiles: 9 The pattern that defeated me: 🟩 🟨 🟨 🟨 🟦 🟦 🟦 🟨 🟦 🟩 🟩 🟨 Can you beat my score? #Taptastic #memorygame #challenge taptastic.app/?score=11
1
155
🧵 Securing Your @DecagonAI Chat Bot 🧵 We've seen a growing number of organizations using Decagon.ai's chat bot to enhance customer support with AI. A quick post on how to make sure you deploy it securely based on a recent issue we saw. 🚨 The issue? If X-Decagon-Auth-Signature isn't required, chat history can be accessed solely using X-Decagon-Auth-User-Id—which is often just a User ID from the core application. 🔍 Example scenario we tested: 1️⃣ Log into the company's core app. 2️⃣ Extract our User ID from the application. 3️⃣ Use it in Decagon's SDK to authenticate and load past chat history. 4️⃣ Identified ways to disclose User ID of other users in the company's core app. 5️⃣ Used other user's User ID to get their chat history. 💡 Why does this matter? User IDs, even if UUID-based, are often not private and can be exposed in various parts of an application. If the same User ID is used for Decagon authentication without a secure signature mechanism, an attacker could extract and replay it to access someone else's chat history. 🔐 Solution: Ensure your Decagon integration requires X-Decagon-Auth-Signature for proper authentication and does not rely solely on User IDs. ⚠️ Important: This is NOT a Decagon vulnerability, it's a misconfiguration that security teams should be aware of as companies rapidly integrate AI-powered tools. #genai #aisecurity #attacksurfacemanagement
186