@ticarpi

Pentester, Vulnerability Researcher, Hacker of things. My views are entirely my own.

 England, United Kingdom
ticarpi.com
Joined February 2015
  • Tweets543
  • Following366
  • Followers484
This month I found a new JWT zero-day vulnerability! An issue I've not seen before. I used some tests I built into the jwt_tool 'Playbook' scanner to find it. Great vendor response, patch being built, CVE assigned. More details when disclosure is allowed. #jwt #ZeroDay #CVE
2
1
14
Congrats @RadioTimes for getting someone to write a @OfficialBlueyTV article without ever seeing the show before, let alone the episode in question. 😅 That's an impressively inaccurate sentence.
124
Ten years ago I was waiting sooooo patiently as each of the beautiful 'Color Editions' of Scott Pilgrim were released. Still pride of place on my shelf. So perfect. So wild and yet so relatable. And now this, @bryanleeomalley?! Explain yourself! How are you so damn genius?
1
155
What an amazing day at @bsidesbristol Thanks so much to all the people who organised it, spoke at it, attended, and generally just made it great. See you next year! #BSidesBristol
3
181
It's been a while... Back at #bsidesbristol Hello everyone!
2
114
Did you ever see a technical tweet you didn't understand? No worries, I'm here for you! 🧑‍🏫 youtube.com/watch?v=3zShGLEq…
Hacker Tweets Explained

ALT Hacker Tweets Explained

6
56
4
287
44,917
Chipotle is the perfect seasoning for everything. #provemewrong
1
85
One day we might actually be able to report directly from @Burp_Suite... maybe. Good effort with this, keeping things tagged and organised sounds really useful.
James Kettle
@albinowax23 May 2023
You can now attach notes to requests via the new 'Organizer' tab, on @Burp_Suite's early-adopter release channel! More details here: portswigger.net/burp/release…
2
215
Calling #pentest and #BugBounty pros: how often do you find #SQLi? I'm trying to impress on a client how bad it is that I've found SQL Injection on EACH of the 3 apps I've tested for him in the last 6 months...
198
Watched it a hundred or more times and somehow only just realised that the opening credits of @OfficialBlueyTV is a game of musical statues. Oh man. #sleepdeprivation #dadlife
129
Great resources and flow. Thanks @Jhaddix
JS0N Haddix
@Jhaddix25 Jan 2023
🔍 My ultimate workflow for simple and easy JavaScript Analysis ⚡️ Comprehensive JavaScript analysis in offensive security, appsec testing, and red teaming wins. Often you can find juicy hidden endpoints, parameters, & domains buried JS! A thread 🧵 1/x 👇
2
479
Error messages reddit.com/r/programmerhumor…
35
510
46
5,096
The video recording of my Black Hat talk this summer "Backdooring and Hijacking Azure AD Accounts by Abusing External Identities" made it to YouTube: youtube.com/watch?v=uKDS2t9_…
1
111
2
263
JWT Attack Playbook: great resource for JWT attacks @ticarpi: github.com/ticarpi/jwt_tool/…

Home

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens - ticarpi/jwt_tool

github.com
3
58
220
ticarpi retweeted
MDSec@MDSecLabs19 Oct 2022
In our latest blog post, we publish a MS "won't fix" unauthenticated SSRF to RCE in Microsoft Office Online Server mdsec.co.uk/2022/10/microsof… by @IndiShell1046
5
237
9
563
Mind blown.
This Post is from an account that no longer exists. Learn more
Having a lovely time pumpkin-ing with my darling and the scampering ones at Orway #orwayporchfarm
Me: [Daughter], have you had enough lunch? Where's the rest of your sandwich? [Daughter]: Your mouth, Daddy. Me: ...oh. #guilty #nothungryanymore
ticarpi retweeted
BlackWasp@BlWasp_5 Oct 2022
Active Directory cheatsheets come back alive. Full refactor and some new cool tricks with WSUS, SCCM, Masky, Diamond & Sapphire tickets, Kerberoast w/o preauth, and so on. - AD from Windows: hideandsec.sh/books/cheatshe… - AD with Python : hideandsec.sh/books/cheatshe…
18
341
4
981
Who needs to learn app/inf fundamentals when the tools are so good? Oh yeah...
This Post is from an account that no longer exists. Learn more
2
This is a superb article for pentesting Cisco networks medium.com/@in9uz/cisco-nigh…
15
325
10
926
Load more