@suidpit

human, chaotic good | master-of-none expert | security researcher @ Shielder

 Spira
deda.lol
Joined May 2018
  • Tweets97
  • Following887
  • Followers313
9Media
🚨 New Open Source Audit Alert! 🚨 Shielder, with @OSTIFofficial & @CloudNativeFdn, audited @karmada_io: 🔍 6 issues found (1 high, 1 medium, 2 low, 2 info) ✔️ Most fixed, others planned. 🗣️ to @suidpit and @Th3Zer0 Full details in the blog post! shielder.com/blog/2025/01/ka…

Shielder - Karmada Security Audit

Karmada Security Audit, sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

shielder.com
6
2
18
2,503
Cheers -- here in beautiful Bali 🏖️ for #theSAS2024 conference! If you happen to be here, please reach out and let's have a chat 🍻
2
8
577
🛡️
1
8
656
sudo iptables -A ESCALATION -s shielder -j ACCEPT
Shielder@ShielderSec20 Sep 2024
For the weekend, we gift you with not one, but TWO ways to escalate `sudo iptables` (+ a couple other boring preconditions) into a r00t shell - read how @smaury92 and @suidpit managed to climb your friendly neighborhood 🔥wall! shielder.com/blog/2024/09/a-…

Shielder - A Journey From `sudo iptables` To Local Privilege Escalation

In this post, we demonstrate two techniques allowing a low privileged user to escalate their privileges to root in case they can run iptables and/or iptables-save as

shielder.com
4
388
lua interpreters something something fakeobj addrof something something wasm something deda.lol/posts/2024-09-12-es…
3
8
753
🍎 With many #macOS security mechanisms at work, one might wonder how malware manages to bypass them. Get ready for a deep dive into macOS security architecture and novel evasion techniques during Pietro Tirenna's (@suidpit) talk at #TheSAS2024. 🚀 Secure your seat: kas.pr/6pyu
7
1
19
3,411
During a recent engagement @Mindlaess_ hacked his way through @vtigercrm which led to discover a privilege escalation and a SQL injection. Learn more in the dedicated advisories: - CVE-2024-42994 #sqli shielder.com/advisories/vtig… - CVE-2024-42995 #privesc shielder.com/advisories/vtig…
9
1
18
2,175
dojo-yeswehack.com/challenge… not all strings are made equal

YesWeHack Dojo

Improve your hacking skills with the free CTF training platform by YesWeHack!

dojo-yeswehack.com
185
Back in December 2023 our researchers @Th3Zer0 @suidpit and @Mindlaess_ performed an audit sponsored by @awscloud and facilitated by @OSTIFofficial on boost. It resulted in 7 findings and 15 new fuzzers. The report is now public, check the details here: shielder.com/blog/2024/05/bo…

Shielder - Boost Security Audit

Boost Security Audit, sponsored by Amazon Web Services (AWS), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

shielder.com
13
17
1,217
Exciting news! We've just released a new blog post on mobile app security, where @suidpit and @Th3Zer0 used their intent-fu to discover vulnerabilities (CVE-2024-26131, CVE-2024-26132) in @element_hq, a @matrixdotorg client for Android. #writeup #CVE shielder.com/blog/2024/04/el…

Shielder - Element Android CVE-2024-26131, CVE-2024-26132 - Never Take Intents From Strangers

A writeup about two intent-based Android vulnerabilities CVE-2024-26131 and CVE-2024-26132 in Element (Matrix).

shielder.com
2
10
32
2,814
We recently partnered with @OSTIFofficial to perform a security audit sponsored by @awscloud on @brefphp. The audit resulted in 5 findings promptly addresses by @matthieunapoli. The report is now public, check the details here: shielder.com/blog/2024/03/br…

Shielder - Bref Security Audit

Bref Security Audit, sponsored by Amazon Web Services (AWS), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

shielder.com
12
1
23
5,224
Excellent writeup showing how to track down vulnerabilities in firmwares starting from CVEs through patch diffing Credits @suidpit and @Th3Zer0 shielder.com/blog/2024/01/hu… #embedded #infosec #asus
4
143
483
23,019
And that's a wrap! Exceptional reports from exceptional #hackers 🥳 More content from @nullcon and #bugbountytips coming up ⏭️. Cheers to the amazing exploits 🎉 and to many more like these events to come. #HackWithIntigriti @Nestle
1
4
13
3,365
Hey hackers - attending @nullcon? Pop to say hi and talk about AppSec and VR! You can find @smaury92 @Th3Zer0 @suidpit @not4nhacker around 🖖🏿
2
13
706
We're announcing our second flagship "Hunting Zero-Days in Embedded Devices" training this year at @cybersaiyanIT, in Rome, 24-27th September!! 4 days of PWNING 💻 romhack.io/training/2024/hun… Contact us for limited offer discount codes, only 4 u, as our Valentine's gift ❤️❤️❤️
4
13
1
50
7,981
OMG, our "Cookie Crumbles" paper got into the Top-10 Web Hacking Techniques of 2023 by @PortSwiggerRes! Have a look at the paper if you haven't yet usenix.org/conference/usenix… and check the other outstanding finalists! Thank you ❤️
PortSwigger Research@PortSwiggerRes19 Feb 2024
The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2023! portswigger.net/research/top…

Top 10 web hacking techniques of 2023

Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

portswigger.net
1
9
58
6,338
Hip, hip, hooray! It's been 10 years of AppSec Ezine! Big shoutout to all who have been supportive along the journey and to the security community that made this project possible. Cheers 🥂 520th Edition: pathonproject.com/zb/?6ba350… Repo: github.com/Simpsonpt/AppSecE… #AppSec #Security
5
28
75
7,499
Ever wondered how to binary diff router firmwares to write n-day exploits? Learn how @Th3Zer0 and @suidpit combined unblob, binexport, ghidra, Qiling, and an Asus router to write an exploit for CVE-2023-39238. The outcome was unexpected ... 1/7 shielder.com/blog/2024/01/hu…

Shielder - Hunting for ~~Un~~authenticated n-days in Asus Routers

Notes on patch diffing, reverse engineering and exploiting CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240.

shielder.com
1
15
57
4,037
🎉 Cheers hackers! 🎊 As we bid farewell to 2023, let's celebrate together! 🎁 Like, follow, and retweet for a chance to WIN a €30 coupon for swag.shielder.com! 🏆 3 winners will be selected by EOY! #giveaways #swag

Shielder's Swag Shop

Elevate your style with exclusive cybersecurity swag from Shielder, a top-notch firm specialized in security assessments and research. Unleash your hacking spirit with tees, mugs, baby suits, and...

swag.shielder.com
3
17
3
27
4,128
Medusa 2.0.0 is here! Now with iOS support, 🍎 Mango reports on static evasion tactics. Plus, tons of module enhancements. Full list below: github.com/Ch0pin/medusa/rel…

Release Medusa Version 2.0.0 · Ch0pin/medusa

Release Notes for Version 2.0.0 Excited to announce the release of Medusa version 2.0.0, which includes several important updates, improvements, and bug fixes. Here's what's new: Added iO...

github.com
16
48
4,743
Load more