Soroush Dalili

@irsdl

Another ethical web appsec guy - breaker 〉builder - very limited BB hunter - delimiter characters fan - RT/LK can be an accident or not "'›|&;${3-1}\

World of Sec! 0xC0000005 Err
soroush.me
Geregistreerd in augustus 2009
140 foto's en video's Foto's en video's

Tweets

Je hebt @irsdl geblokkeerd

Weet je zeker dat je deze Tweets wilt bekijken? @irsdl wordt niet gedeblokkeerd door Tweets te bekijken.

  1. Vastgemaakte Tweet
    25 apr.

    With the release of my ViewState plugin for , here is my blog post on Exploiting Deserialisation in ASPNET via ViewState:

    7 antwoorden 167 retweets 316 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  2. heeft geretweet
    31 okt.

    Did you know you can use the Connection header to delete other headers? Interesting research lead by :

    4 antwoorden 172 retweets 392 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  3. 31 okt.

    Perhaps also join in even if you are a fan ;)

    Happy Halloween? If you're not a fan of horror stories, join the campaign to make the Computer Misuse Act fit for the 21st century:
    Ongedaan maken
  4. 31 okt.

    Probably the last time I am doing this with this laptop - research continues! I am going to miss my stickers

    6 antwoorden 24 vind-ik-leuks
    Ongedaan maken
  5. heeft geretweet
    27 okt.

    Oh shit there is a video that backs up the ‘don’t congratulate Obama’ .. Can’t wait for the announcement..

    443 antwoorden 6.103 retweets 8.654 vind-ik-leuks
    Ongedaan maken
  6. heeft geretweet
    25 okt.

    As I'm currently missing and so can't troll in person here's a blog about the recent changes to my .NET Remoting Exploit tool to bypass Low Type Filtering .

    1 antwoord 58 retweets 121 vind-ik-leuks
    Ongedaan maken
  7. heeft geretweet
    25 okt.

    Advisory: OneDrive/SharePoint File Picker Access Token Hijacking - by Adam Roberts

    12 retweets 24 vind-ik-leuks
    Ongedaan maken
  8. heeft geretweet
    24 okt.

    I know DoS attacks are deeply unsexy, and I'm still somewhat in shock that I ever wrote an entire post about them. The core aim of this post is to illustrate how in the right circumstances they can be fun, high-impact and profitable

    9 antwoorden 85 retweets 240 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  9. heeft geretweet
    21 okt.

    While not officially confirmed yet, this is very likely to be true. Also it’s worth remembering that some of the attacks results never see the light of public news because targets prefer to remain silent either for intel obervations or simply avoid empowering attackers by an ack.

    0:50
    : It is now confirmed that a Cyber attack resulted fire in 's Oil Refinery in Southwest of . Probably a Cyber attack in response to 's cruise missile attack at 's oil facilities in & , on 14 September 2019.
    Deze collectie tonen
    2 retweets 2 vind-ik-leuks
    Ongedaan maken
  10. heeft geretweet
    5 okt.

    Can’t stress enough the importance of patching affected VPN products. We’re seeing multiple groups exploiting these vulnerabilities.

    1 antwoord 81 retweets 93 vind-ik-leuks
    Ongedaan maken
  11. heeft geretweet
    17 okt.

    Filed under "you had one job."

    40 antwoorden 370 retweets 913 vind-ik-leuks
    Ongedaan maken
  12. 16 okt.

    1 antwoord 1 retweet 4 vind-ik-leuks
    Ongedaan maken
  13. heeft geretweet
    14 okt.

    OWASP Birmingham is pleased to announce it's hosting a Capture the Flag meetup in November supported by Kainos and Secure Code Warrior

    8 retweets 8 vind-ik-leuks
    Ongedaan maken
  14. heeft geretweet
    14 okt.

    This is so insane. This was a straight-forward solution for Buggy .Net from

    1 antwoord 10 retweets 35 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  15. heeft geretweet
    12 okt.

    HITCON CTF 2019 Quals is ongoing now! and I designed an XSS challenge this time and there are two solutions at least, could you find that? :D http://3.114.5.202/

    4 antwoorden 29 retweets 146 vind-ik-leuks
    Ongedaan maken
  16. heeft geretweet
    11 okt.
    Als antwoord op

    Can't we have the old school instant (bit broken) render AND the new shiny render button, if we need it?

    1 antwoord 1 retweet 5 vind-ik-leuks
    Ongedaan maken
  17. 10 okt.

    Awesome

    + Added loads of charsets + Send to Hackvertor adds auto decode tag automatically + Read clipboard and see if there is anything to auto decode + Chunked dec2hex for help with request smuggling + Made autodecode & convert not use decryption to avoid incorrect decode
    2 retweets 4 vind-ik-leuks
    Ongedaan maken
  18. heeft geretweet
    7 okt.

    Updated my tool to exploit .NET remoting services to use a new (unpatched) technique to bypass Low Type Filter to get full serialization exploitation. Abuses the lease feature present on all MBR objects. . Don't use .NET remoting in production code!

    4 antwoorden 240 retweets 442 vind-ik-leuks
    Ongedaan maken
  19. heeft geretweet
    6 okt.
    Als antwoord op

    78 antwoorden 2.071 retweets 7.072 vind-ik-leuks
    Ongedaan maken
  20. 3 okt.

    This is the command to activate all the bots from 3 years ago: WAKE UP AGAIN AND JOIN THE COLLECTIVE NOW! He should really be proud of himself to type these words correctly!

    ELECTION INTERFERENCE!
    1 antwoord 1 vind-ik-leuk
    Ongedaan maken
  21. 3 okt.

    Just a friendly reminder that is still mine! 🤓 😇

    7 vind-ik-leuks
    Ongedaan maken

@irsdl heeft nog niet getweet.

Het laden lijkt wat langer te duren.

Twitter is mogelijk overbelast of ondervindt een tijdelijke onderbreking. Probeer het opnieuw of bekijk de Twitter-status voor meer informatie.

    Je bent misschien ook geïnteresseerd in

    ·