@vaadata

Specialized in #pentest, we are passionate about #infosec #security

 LYON - FRANCE
vaadata.com
Joined November 2013
  • Tweets1.5K
  • Following273
  • Followers364
442Media
VAADATA retweeted
VAADATA@vaadata25 Oct 2022
XSS, a.k.a (Cross-site Scripting), une vulnérabilité particulièrement répandue sur les applications web : un thread 🧵 1/15 #devweb #websecurite
Cross-Site-Scripting

ALT Cross-Site-Scripting

1
3
6
VAADATA retweeted
VAADATA@vaadata22 Sep 2022
Contourner le login via une injection SQL Un thread  1/10 #SQLi #injectionSQL #websecurite
‘Injection SQL’ murmuré à l’oreille

ALT ‘Injection SQL’ murmuré à l’oreille

1
6
7
PayloadsAllTheThings is now available as a responsive website with a SEARCH bar🔎 Let me know if you like it ! Also big thanks to @TechBrunchFR for the tip and the help on deploying this major upgrade🤗 swisskyrepo.github.io/Payloa…
21
308
9
942
On Saturday, I sat in a crowded ballroom at Caesar's Forum in Vegas and watched @sickcodes jailbreak a John Deere tractor's control unit live, before an audience of cheering @Defcon 30 attendees (and, possibly, a few undercover Deere execs, who often attend Sickcodes's talks). 1/
A vintage John Deere tractor whose wheel hubs have been replaced with HAL 9000 eyes, matted over a background of the cyber-waterfall image from The Matrix. Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg CC BY 3.0: https://creativecommons.org/licenses/by/3.0/deed.en

ALT A vintage John Deere tractor whose wheel hubs have been replaced with HAL 9000 eyes, matted over a background of the cyber-waterfall image from The Matrix. Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg CC BY 3.0: https://creativecommons.org/licenses/by/3.0/deed.en

46
1,223
428
4,501
Great details on how Cisco got hacked. 1- Personal Google account of an employee gets compromised - it has password synced enabled. 2- Got all the employee's passwords, including their Cisco VPN credentials. 3- Phishing to accept 2FA 4- They are in blog.talosintelligence.com/2…

Cisco Talos shares insights related to recent cyber attack on Cisco

Update History Aug. 10, 2022 Adding clarifying details on activity involving active directory. Aug. 10, 2022 Update made to the Cisco Response and Recommendations section related to MFA.

blog.talosintelligence.com
23
786
91
2,409
Twitter confirms zero-day used to expose data of 5.4 million accounts - @LawrenceAbrams bleepingcomputer.com/news/se…

Twitter confirms zero-day used to expose data of 5.4 million accounts

Twitter has confirmed a recent data breach was caused by a now-patched zero-day vulnerability used to link email addresses and phone numbers to users' accounts, allowing a threat actor to compile a...

bleepingcomputer.com
5
157
24
214
Framing without iframes by @garethheyes portswigger.net/research/fra…

Framing without iframes

Whilst testing for XSS vectors, we found some new ways of framing a web site that don't use the iframe element. Naturally, we've updated our XSS cheat sheet to document them. We discovered that Chrome

portswigger.net
3
59
2
178
VAADATA retweeted
VentureBeat
@VentureBeat14 Jul 2022
The US Government's Cyber Safety Review Board warns that Log4j will remain an "endemic vulnerability" for years to come #Log4j #Log4shell #CSRB #vulnerabilitymanagement #databreach #cybersecurity venturebeat.com/2022/07/14/c…
8
4
9
DOM Invader can now make finding client-side prototype pollution as easy as a couple of clicks 🤯 Great walkthrough by @PortSwigger's @garethheyes 👇 youtube.com/watch?v=GeqVMOUu…

DOM Invader: Prototype Pollution

Last year we made it significantly easier to find DOM XSS, when we ...

youtube.com
14
61
VAADATA retweeted
CNIL
@CNIL28 Jun 2022
Le 27/06/22, le @Conseil_Etat a confirmé la sanction de 35 millions d’euros prononcée par la CNIL à l’encontre d’AMAZON EUROPE CORE pour avoir déposé des #cookies sur les ordinateurs des internautes sans consentement préalable ni information satisfaisante👉cnil.fr/fr/cookies-le-consei…
Communiqué Cookies : le Conseil d'État valide la sanction de 2020 prononcée par la CNIL contre AMAZON EUROPE CORE

ALT Communiqué Cookies : le Conseil d'État valide la sanction de 2020 prononcée par la CNIL contre AMAZON EUROPE CORE

42
2
42
In April, a team of cyberattackers attempted to breach an undersea cable off the coast of Hawaii. The cable is part of a network that carries over 95% of the world’s data. The attack is one of in a series of mysterious attacks on US infrastructure. Let's dig in.
380
7,092
945
29,269
I was able to access thousands of companies’ passwords on #Azure and run code on their VMs. This includes access to Microsoft’s own credentials… 💣 Here’s HOW I did it. This is the story of #SynLapse. (1/11)
50
888
113
3,164
Symantec: More malware operators moving in to exploit Follina reg.cx/44kc?utm_source=twitt…
2
2
1
HTTP/2 was also updated as the new RFC 9113 rfc-editor.org/rfc/rfc9113.h… mainly to remove the old prioritization system. Even HTTP/1.1 and general HTTP semantics + caching concepts were tightened up in RFCs 9110-9112. Big day for the arguably most used application layer protocol 😃
Diagram comparing http 1, 2 and 3

ALT Diagram comparing http 1, 2 and 3

8
233
27
776
The 2022 #DBIR is out! Join us in celebrating the 15th anniversary of the report with another edition full of data, insights and (mostly bad) jokes! verizon.com/dbir

Verizon Business

Read the complete 2026 Data Breach Investigations Report (DBIR) for an in-depth, authoritative analysis of the latest cyber threats, data breaches, and actionable cybersecurity risks.

verizon.com
1
77
23
134
VAADATA retweeted
Ed@EdOverflow27 Apr 2022
After 5 years of work, security.txt is officially an RFC. I am pleased to announce RFC 9116: rfc-editor.org/rfc/rfc9116. I would like to use this opportunity to thank those who made this possible. Thank you. ❤️
The security.txt specification has been published as RFC 9116

ALT The security.txt specification has been published as RFC 9116

43
935
107
2,706
VAADATA retweeted
gafnit@gafnitav11 Apr 2022
One of the things I really love is to write technical blog posts. so here is a NEW one - my AWS RDS Vulnerability blog.lightspin.io/aws-rds-cr… #AWS #cloudsecurity #Lightspin
18
279
14
942
VAADATA retweeted
MG
@_MG_22 Mar 2022
Oh man, if this it what it looks (Okta got popped)… Blue Team everywhere is gonna be crazy busy.
67
935
514
2,704
🚨 Rappel CFP 🚨 Notre CFP se clôture le 31 Mars, il vous reste donc moins de 2 semaines pour soumettre un ou plusieurs de vos talks ! Toutes les informations sont sur notre page Conference Hall : buff.ly/3KS6wUm !
Visuel pour annoncer le CFP du Devfest Lille

ALT Visuel pour annoncer le CFP du Devfest Lille

1
8
2
7
VAADATA retweeted
ANSSI
@ANSSI_FR9 Mar 2022
[Panorama de la menace informatique 2021] L’année passée fut marquée par une hausse continue du niveau de menace et une professionnalisation accrue des acteurs malveillants Découvrez toutes les tendances dans le panorama de la menace informatique #ANSSI 🔎cert.ssi.gouv.fr/cti/CERTFR-…
6
143
10
176
Load more