Soroush Dalili

@irsdl

Another ethical web appsec guy - breaker 〉builder - very limited BB hunter - delimiter characters fan - RT/LK can be an accident or not "'›|&;${3-1}\

World of Sec! 0xC0000005 Err
soroush.me
Bergabung Agustus 2009
140 Foto dan video Foto dan video

Tweet

Anda memblokir @irsdl

Yakin ingin melihat Tweet ini? Melihat Tweet tidak akan membuka blokir @irsdl

  1. Tweet Sematan
    25 Apr

    With the release of my ViewState plugin for , here is my blog post on Exploiting Deserialisation in ASPNET via ViewState:

    7 balasan 167 retweet 316 suka
    Tampilkan utas ini
    Tampilkan utas ini
    Batalkan
  2. me-Retweet
    31 Okt

    Did you know you can use the Connection header to delete other headers? Interesting research lead by :

    4 balasan 171 retweet 391 suka
    Tampilkan utas ini
    Tampilkan utas ini
    Batalkan
  3. 31 Okt

    Perhaps also join in even if you are a fan ;)

    Happy Halloween? If you're not a fan of horror stories, join the campaign to make the Computer Misuse Act fit for the 21st century:
    Batalkan
  4. 31 Okt

    Probably the last time I am doing this with this laptop - research continues! I am going to miss my stickers

    6 balasan 24 suka
    Batalkan
  5. me-Retweet
    27 Okt

    Oh shit there is a video that backs up the ‘don’t congratulate Obama’ .. Can’t wait for the announcement..

    443 balasan 6.103 retweet 8.654 suka
    Batalkan
  6. me-Retweet
    25 Okt

    As I'm currently missing and so can't troll in person here's a blog about the recent changes to my .NET Remoting Exploit tool to bypass Low Type Filtering .

    1 balasan 58 retweet 121 suka
    Batalkan
  7. me-Retweet
    25 Okt

    Advisory: OneDrive/SharePoint File Picker Access Token Hijacking - by Adam Roberts

    12 retweet 24 suka
    Batalkan
  8. me-Retweet
    24 Okt

    I know DoS attacks are deeply unsexy, and I'm still somewhat in shock that I ever wrote an entire post about them. The core aim of this post is to illustrate how in the right circumstances they can be fun, high-impact and profitable

    9 balasan 85 retweet 240 suka
    Tampilkan utas ini
    Tampilkan utas ini
    Batalkan
  9. me-Retweet
    21 Okt

    While not officially confirmed yet, this is very likely to be true. Also it’s worth remembering that some of the attacks results never see the light of public news because targets prefer to remain silent either for intel obervations or simply avoid empowering attackers by an ack.

    0:50
    : It is now confirmed that a Cyber attack resulted fire in 's Oil Refinery in Southwest of . Probably a Cyber attack in response to 's cruise missile attack at 's oil facilities in & , on 14 September 2019.
    Tampilkan utas ini
    2 retweet 2 suka
    Batalkan
  10. me-Retweet
    5 Okt

    Can’t stress enough the importance of patching affected VPN products. We’re seeing multiple groups exploiting these vulnerabilities.

    1 balasan 81 retweet 93 suka
    Batalkan
  11. me-Retweet
    17 Okt

    Filed under "you had one job."

    40 balasan 370 retweet 913 suka
    Batalkan
  12. 16 Okt

    1 balasan 1 retweet 4 suka
    Batalkan
  13. me-Retweet
    14 Okt

    OWASP Birmingham is pleased to announce it's hosting a Capture the Flag meetup in November supported by Kainos and Secure Code Warrior

    8 retweet 8 suka
    Batalkan
  14. me-Retweet
    14 Okt

    This is so insane. This was a straight-forward solution for Buggy .Net from

    1 balasan 10 retweet 35 suka
    Tampilkan utas ini
    Tampilkan utas ini
    Batalkan
  15. me-Retweet
    12 Okt

    HITCON CTF 2019 Quals is ongoing now! and I designed an XSS challenge this time and there are two solutions at least, could you find that? :D http://3.114.5.202/

    4 balasan 29 retweet 146 suka
    Batalkan
  16. me-Retweet
    11 Okt
    Membalas

    Can't we have the old school instant (bit broken) render AND the new shiny render button, if we need it?

    1 balasan 1 retweet 5 suka
    Batalkan
  17. 10 Okt

    Awesome

    + Added loads of charsets + Send to Hackvertor adds auto decode tag automatically + Read clipboard and see if there is anything to auto decode + Chunked dec2hex for help with request smuggling + Made autodecode & convert not use decryption to avoid incorrect decode
    2 retweet 4 suka
    Batalkan
  18. me-Retweet
    7 Okt

    Updated my tool to exploit .NET remoting services to use a new (unpatched) technique to bypass Low Type Filter to get full serialization exploitation. Abuses the lease feature present on all MBR objects. . Don't use .NET remoting in production code!

    4 balasan 240 retweet 442 suka
    Batalkan
  19. me-Retweet
    6 Okt
    Membalas

    78 balasan 2.071 retweet 7.071 suka
    Batalkan
  20. 3 Okt

    This is the command to activate all the bots from 3 years ago: WAKE UP AGAIN AND JOIN THE COLLECTIVE NOW! He should really be proud of himself to type these words correctly!

    ELECTION INTERFERENCE!
    1 balasan 1 suka
    Batalkan
  21. 3 Okt

    Just a friendly reminder that is still mine! 🤓 😇

    7 suka
    Batalkan

@irsdl masih belum menge-Tweet.

Pemuatan tampaknya berlangsung agak lama.

Twitter sedang kelebihan beban atau mengalami sedikit masalah. Coba lagi atau kunjungi Status Twitter untuk informasi lebih lanjut.

    Mungkin Anda juga suka

    ·