zayooko (@zayooko) profile picture

zayooko

@zayooko
Joined December 2016
  • Tweets25
  • Following47
  • Followers36
KeePwn: automate KeePass discovery and secret extraction securityonline.info/keepwn-a…
2
61
1
182
25,686
New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets thehackernews.com/2023/04/ne…
New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets

New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets

Attention Apple users! A new information stealer for macOS has been discovered, called Atomic macOS Stealer (AMOS).

thehackernews.com
7
1
24
4,704
zayooko retweeted
Dennis (@DennisF) profile picture
Dennis@DennisF11 Apr 2023
"I'm the cybersecurity director at NSA and you could absolutely craft a phishing message that would get me to click a link. You’ve got to design your architecture to assume the humans are humans and bad things will happen." @RGB_Lights AMEN
7
223
23
749
143,334
5 CSRF exploitation techniques 🧵👇
CSRF techniques

ALT CSRF techniques

9
87
2
245
45,089
Needle (CVE-2023-0179) exploit This repository contains the exploit for my recently discovered vulnerability in the nftables subsystem that was assigned CVE-2023-0179 github.com/H4K6/CVE-2023-017…
GitHub - H4K6/CVE-2023-0179-PoC: 针对（CVE-2023-0179）漏洞利用 该漏洞被分配为CVE-2023-0179，影响了从5.5到6.2-rc3的所有Lin...

GitHub - H4K6/CVE-2023-0179-PoC: 针对（CVE-2023-0179）漏洞利用 该漏洞被分配为CVE-2023-0179，影响了从5.5到6.2-rc3的所有Lin...

针对（CVE-2023-0179）漏洞利用 该漏洞被分配为CVE-2023-0179，影响了从5.5到6.2-rc3的所有Linux版本，该漏洞在6.1.6上被测试。 漏洞的细节和文章可以在os-security上找到。 - H4K6/CVE-2023-0179-PoC

github.com
3
64
1
195
25,556
🚨This unauthorized RCE bug (CVE-2023-21554) in the "forgotten" MSMQ service may have big impact. If you’re a Windows admin, you need to check your environments ASAP (you may have unawarely enabled the service). xitter.cf/_CPResearch_/status/16…
Check Point Research (@_CPResearch_) profile pictureCheck Point Research
@_CPResearch_11 Apr 2023
🚨 We discovered 3 vulnerabilities in Microsoft Message Queuing (MSMQ) service, including #QueueJumper (CVE-2023-21554), a Critical vulnerability that could allow unauthorized attackers to remotely execute code. More details in our blog 👉 research.checkpoint.com/2023… #PatchNow
Image from Check Point Research (@_CPResearch_)
5
62
4
151
75,376
We found a new zero-day (CVE-2023-28252) in Microsoft Windows used in Nokoyawa ransomware attacks securelist.com/nokoyawa-rans…
Nokoyawa ransomware attacks with Windows zero-day

Nokoyawa ransomware attacks with Windows zero-day

In February 2023, we found a zero-day exploit, supporting different versions and builds of Windows, including Windows 11. This particular zero-day was used by a sophisticated cybercrime group that...

securelist.com
5
167
16
383
158,666
Attacking Kubernetes — Part 1 infosecwriteups.com/attackin…
Attacking Kubernetes — Part 1

Attacking Kubernetes — Part 1

Kubernetes 101

infosecwriteups.com
3
88
2
322
42,538
zayooko retweeted
Geekboy (@emgeekboy) profile picture
Geekboy
@emgeekboy9 Apr 2023
OpenAI (LLM) Integration is coming to @pdnuclei using DSL that can be used in the template input/output context. Here is a basic example of analyzing the response header, but it could be anything! unknown patterns/secrets; it's a matter of how creative you can be with your query to explore the power of LLM. Used prompt with DSL extractor in the shared template - llm_prompt("what tech this server is using? return idk if you dont know" + header) Let me know what you think or have any other interesting use cases or ideas to utilize LLM / prompts for security? #hackwithautomation #openai #LLM
Image from Geekboy (@emgeekboy)
3
55
1
309
54,076
echo xxx.com | alterx | httpx -nc -t 300 -p 80,443,8080,8443,8090,9090 -silent | nuclei -rl 300 -bs 35 -c 30 -mhe 10 -ni -t /root/nuclei-templates/ -stats -silent -severity critical,medium,high,low -es info
Cyber Detective💙💛 (@cyb_detective) profile pictureCyber Detective💙💛@cyb_detective5 Apr 2023
ALERTX Very fast #go tool for search subdomains. For example, it fin 111 tesla.com subdomains in 0.003 seconds. github.com/projectdiscovery/… Creator @pdiscoveryio
Image from Cyber Detective💙💛 (@cyb_detective)
11
152
1
453
67,177
If you've ever had to deal with angry family members because you accidentally got blocked by a WAF then listen up! 🚨 ⚠️ Detect if a url is behind a WAF before testing it with the WAF-detect template! Find it here 👉 github.com/projectdiscovery/…
4
22
103
13,337
El grupo Ransom House responde y confirma el ataque #DDoS realizado por los Mossos. Amenaza con publicar mas datos en breve sobre pacientes con enfermedades infecciosas. Via @_bettercyber_
Image from Dormidera (@Dormidera)
5
16
4
36
24,112
The final results of the Blockchain Hacking Techniques of 2022 are in! After a year of increased participation, as well as novel attack vectors leading to over $3.7B in losses, this initiative aims to provide critical insights into the ongoing challenges facing blockchain security. Ultimately, the collective efforts of the community can help to ensure the safety and stability of Web3 projects in the future. Read the final results below 👇 blog.openzeppelin.com/final-…
Final Results - Blockchain Hacking Techniques of 2022

Final Results - Blockchain Hacking Techniques of 2022

OpenZeppelin, in collaboration with the community of Web3 security experts, have documented the top security research from 2022 to promote best practices and effective security measures across the...

openzeppelin.com
13
123
14
237
33,282
I made a writeup on #Magniber #ransomware (from 2022) demonstrating the capabilities of the latest #TinyTracer: hshrzd.wordpress.com/2023/03…
Image from hasherezade (@hasherezade)
12
119
2
367
73,915
Hackers Used Spyware Made In Spain To Target Users In The UAE packetstormsecurity.com/news…
7
2
10
3,685
What resource has helped you the most in learning bug bounties?
20
10
69
26,440
A list of lists for hackers 👇 📝 Nahamsec github.com/nahamsec/Resource… 📝 Codingo codingo.com/search 📝 InfosecWriteups infosecwriteups.com 📝 S0cm0nkey’s Security Reference Guide - s0cm0nkey.gitbook.io/s0cm0nk…
Image from haksec.io (@haksecio)
2
24
81
11,680
Sometimes when developers configure CORS origin whitelists, they accidentally allow connections from unwanted origins and potentially facilitate data transfer to malicious origins! Let's look at the most common mistakes developers make when setting up CORS policies 👇
CORS exploitation techniques

ALT CORS exploitation techniques

3
44
2
191
35,481
Nueva Vulnerabilidad en Azure Active Directory 😱: Ataque BingBang 💥 Compromete Bing y Datos Personales de Usuarios 👥 Wiz Research 🔍 @wiz_io han descubierto un nuevo vector de ataque en Azure Active Directory 😰 que deja expuestas aplicaciones mal configuradas a accesos no autorizados 🚫. Esta vulnerabilidad afecta aproximadamente al 25% de las aplicaciones multi-tenant 📊. Entre las aplicaciones vulnerables de Microsoft, se encuentra un sistema de gestión de contenidos (CMS) que controla Bing.com 🌐, lo que permite modificar resultados de búsqueda 🔍 y lanzar ataques XSS 💣 de alto impacto en los usuarios de Bing, poniendo en riesgo datos personales como correos electrónicos de Outlook 📧 y documentos de SharePoint 🧵👇
Image from DragonJAR - Seguridad Informática (@DragonJAR)
3
90
4
247
43,172
👋 I just released "JSpector" : a simple Burp Suite extension to passively crawl JS files and display the results (URLs & endpoints) in the "Issues" tab of each target. I needed something simple to do this, and now that it's done, I'm sharing i!🤗 ➡ You can download it here: github.com/hisxo/JSpector #BugBounty
Image from Hisxo (@adrien_jeanneau)
Image from Hisxo (@adrien_jeanneau)
Image from Hisxo (@adrien_jeanneau)
18
219
4
741
94,903
Load more