Nguyen The Duc

@ducnt_

Just another web warrior | Security Researcher | Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Participa desde fevereiro de 2017
11 Fotos e vídeos Fotos e vídeos

Tweets

Você bloqueou @ducnt_

Tem certeza de que deseja ver estes Tweets? Visualizar os Tweets não desbloqueará @ducnt_

  1. Tweet Fixado
    8 de jan

    My first `double kill` at : Kudos to WordPress security team with very quickly and awesome work 🥰

    1 resposta 15 curtiram
    Desfazer
  2. retweetou
    10 de jul de 2018

    Neatly bypassing Content Security Policy. Why 'unsafe-inline' is almost always a full-fledged XSS.

    5 respostas 130 retweets 253 curtiram
    Mostrar esta sequência
    Mostrar esta sequência
    Desfazer
  3. retweetou
    6 de fev

    DOM Clobbering strikes back by

    2 respostas 86 retweets 209 curtiram
    Desfazer
  4. retweetou
    6 de fev

    Thanks to research, new stuff are being released for soon - as for the features, payload minimization, raw cmd command, and auto command encoding within JSON/XML messages are being released after the PR review by

    1 resposta 33 retweets 110 curtiram
    Desfazer
  5. retweetou
    6 de fev

    Nice by

    12 retweets 58 curtiram
    Desfazer
  6. retweetou
    5 de fev

    Checkra1n for Windows first demo!!🔥🔥 Coming Soon!!

    85 respostas 311 retweets 1.678 curtiram
    Mostrar esta sequência
    Mostrar esta sequência
    Desfazer
  7. retweetou
    3 de fev

    Here's my write-up for ’s CTF challenge!

    5 respostas 27 retweets 103 curtiram
    Desfazer
  8. retweetou
    3 de fev

    CVE-2020-7471: SQLI in Django: django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. FIX:

    54 retweets 128 curtiram
    Desfazer
  9. retweetou
    31 de jan

    , , and I are starting a new security blog. In our first write-up, we will discuss the impact of "SameSite by default" and how it affects web app sec. Feel free to request future topics you would like us to cover.

    9 respostas 203 retweets 404 curtiram
    Desfazer
  10. retweetou
    31 de jan

    Someone dropped a PHP zero-day on GitHub. Talked to the PHP team last night. Bug requires local foothold to exploit, so not usable for remote attacks. Also, this is the second exploit for this "disable_functions bypass" in the last few months.

    5 respostas 122 retweets 190 curtiram
    Desfazer
  11. retweetou
    28 de jan

    .Net being open-source makes tracking these things cool. I just hope GitHub adds code navigation support for .net code soon as well. credit for the bug goes to of course.

    7 retweets 17 curtiram
    Desfazer
  12. retweetou
    28 de jan

    Also for the iPhone 11 Pro Max, iOS 13.3.1 beta3 Jailbreak

    217 respostas 616 retweets 2.566 curtiram
    Desfazer
  13. retweetou
    24 de jan

    Here are my (updated) slides from for my talk "Owning The Cloud Through SSRF & PDF Generators" with Chris Holt from . Big thank you to , , , , , and !

    39 retweets 136 curtiram
    Desfazer
  14. retweetou
    24 de jan

    RDP Vuln CVE-2020-0609 & CVE-2020-0610 RD Gateway PoC (DoS) by Scanner by

    94 retweets 197 curtiram
    Desfazer
  15. retweetou
    23 de jan

    The Bezos forensic report is not very good. The forensic analysis should be done by who at least have the relevant experience. The MP4 file should contain the exploit (if it is CVE-2019-11931). The exploit trigger should be visible with ffmpeg

    13 respostas 190 retweets 487 curtiram
    Mostrar esta sequência
    Mostrar esta sequência
    Desfazer
  16. retweetou
    22 de jan

    This is a pretty good reminder that any invasive heuristics in the browser - be it XSS filters or privacy protections - often cause more problems than they address:

    3 respostas 38 retweets 107 curtiram
    Desfazer
  17. retweetou
    21 de jan

    Learn how an authenticated RCE vulnerability in < 5.2.4 allows attackers to bypass hardening mechanisms. Read more ->

    21 retweets 39 curtiram
    Desfazer
  18. retweetou
    18 de jan

    Just published a blog post talking about some iOS kernel framebuffer research I’ve been looking at over the last couple weeks. Have a read if you’re interested :)

    4 respostas 131 retweets 416 curtiram
    Mostrar esta sequência
    Mostrar esta sequência
    Desfazer
  19. retweetou
    18 de jan

    RDP to RCE: When Fragmentation Goes Wrong AKA: What we know about CVE-2020-0609 and CVE-2020-0610.

    4 respostas 293 retweets 585 curtiram
    Desfazer
  20. retweetou
    16 de jan

    "CVE-2020-0601: the ChainOfFools attack explained with PoC"

    5 retweets 17 curtiram
    Desfazer
  21. retweetou
    15 de jan

    CVE-2020-5504 SQLI in phpMyAdmin: A malicious user could inject custom SQL in place of their own username when creating queries to this page fix:

    2 respostas 124 retweets 251 curtiram
    Desfazer

@ducnt_ ainda não tweetou.

O carregamento parece estar demorando.

O Twitter deve estar sobrecarregado ou passando por algum problema momentâneo. Tente novamente ou acesse o Status do Twitterpara obter mais informações.

    Você também pode gostar

    ·