@nicoSWD

InfoSec at @seat_code

 Barcelona, Spain
nico.es
Joined February 2009
  • Tweets4K
  • Following761
  • Followers523
145Media
Attacking UNIX Systems via CUPS, Part I evilsocket.net/2024/09/26/At…

Attacking UNIX Systems via CUPS, Part I | evilsocket

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…

evilsocket.net
168
1,108
291
3,583
1,061,284
New Linux CVE with score or 9.9 of 10, regarding unauthenticated remote code execution (RCE) vulnerability expected to be revealed on 30th September 2024, with more details on 6th October. Watch @evilsocket for updates.
1
1
1
504
medium.com/@bobbyrsec/the-da…
127
It's... beautiful. The PlayStation 5 has been jailbroken.
682
6,562
1,673
53,142
🛑 [NEWS] @RevolutApp has suffered a serious #DataBreach which may have led to the compromise of over 50,000 customers’ personal information > @philmuncaster reports bit.ly/3C8YlR1

Revolut Breach May Have Hit 50,000+ Customers

Major phishing risk as personal details are compromised

infosecurity-magazine.com
5
4
LastPass Hackers Stole Source Code infosecurity-magazine.com/ne…

LastPass Hackers Stole Source Code

Password management firm reveals incident in early August

infosecurity-magazine.com
7
7
Clever portswigger.net/daily-swig/w…

PortSwigger — Web security tools, training and research

We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.

portswigger.net
2
6
2
38
Holy shit
William Fleshman@willcfleshman25 Apr 2022
Replying to @notdan
"this was a faux vulnerability for credibility nobody questioned" Time lapse of output as a super resolution resnet trains on the task:
6
13
63
We found a way to spoof ENS domains and were awarded a $15k bug bounty by @ensdomains 👇Check out the write-up medium.com/@hacxyk/how-we-sp…

How we spoofed ENS domains for $15k

TL;DR: We found a flaw that allowed us to spoof Ethereum domain names and received a $15k bounty.

medium.com
4
22
7
118
#Nginx 1.18 exploit in the wild! #infosec #0day #exploit @campuscodi
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
7
206
12
506
A 15-year-old developer account hijacking #vulnerability has been disclosed in the PEAR #PHP repository that could've allowed attackers to launch supply-chain attacks by releasing new malicious versions of existing packages. Details: thehackernews.com/2022/04/15… #infosec #hackernews

15-Year-Old Bug in PEAR PHP Repository Could've Enabled Supply Chain Attacks

A 15-year-old account hijacking vulnerability has been disclosed in the PEAR PHP repository that could allow attackers to launch supply chain attacks.

thehackernews.com
1
3
1
LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof. The photos we are sharing has been edited so no sensitive information or user identities are displayed. Image 1 - 4 attached below.
21
259
110
668
NEW: Ukraine is asking its hacker underground to defend the country from Russia @Bing_Chris reuters.com/world/exclusive-…

EXCLUSIVE: EXCLUSIVE Ukraine calls on hacker underground to defend against Russia

The government of Ukraine is asking for volunteers from the country's hacker underground to help protect critical infrastructure and conduct cyber spying missions against Russian troops, according...

reuters.com
24
336
50
1,067
How to test your apps for #log4shell vulnerability 1. Generate a DNS token canarytokens.org/generate# 2. Wrap that token in Prefix: ${jndi:ldap:// Suffix: /a} 3. Use that value in search forms, profile data, settings etc. of your apps 4. Get notified when you triggered a reaction
37
1,213
56
3,150
"This model enables 0day devs to generate substantial earnings by renting the 0day out while waiting for a definitive buyer...renting parties could test proposed 0day & later decide whether to purchase the exploit on an exclusive or non-exclusive basis" zdnet.com/article/ransomware…

Ransomware gangs are now rich enough to buy zero-day flaws, say researchers - ZDNET

Zero-day cybersecurity vulnerabilities have traditionally been the preserve of nation states - but now criminal gangs have the funds to buy their own.

zdnet.com
4
1
1
it looks like Twitch has been hacked in a massive breach. A 125GB file reportedly includes Twitch source code, details on creator $$$ payouts, and even a Steam competitor. Full details here: theverge.com/2021/10/6/22712…
53
727
393
2,082
ouch. bleepingcomputer.com/news/se…
2
25
4
37
And early bird tickets are out: eventbrite.es/e/bsides-barce… Grab them while they are hot!

BSides Barcelona 2021, Virtual Edition

Virtual edition of the information security conferece created by and for the community happening on September 30th and October 1st.

eventbrite.es
2
14
14
🎉 SORTEACO 100% GRATIS Monitor curvo Dell 34" U3421WE de +900€ y 1 mes de CodelyTV Pro 😳 Cómo participar bit.ly/monitor-codely-infojo… 📆 Hasta Jueves que viene 18:30h 👀 Más info en twitch.tv/codelytv 🤔 Gracias a @InfoJobs
22
677
9
172
xn--promfarma-8x3d.com/ seems legit 👌
Load more