Nguyen The Duc

@ducnt_

Just another web warrior | Security Researcher | Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Şubat 2017 tarihinde katıldı
11 Fotoğraf ve video Fotoğraflar ve videolar

Tweetler

@ducnt_ adlı kişiyi engelledin

Bu Tweetleri görüntülemek istediğinden emin misin? Tweetleri görüntülemek @ducnt_ adlı kişinin engelini kaldırmaz.

  1. Sabitlenmiş Tweet
    8 Oca

    My first `double kill` at : Kudos to WordPress security team with very quickly and awesome work 🥰

    15 beğenme
    Geri al
  2. Retweetledi
    10 Tem 2018

    Neatly bypassing Content Security Policy. Why 'unsafe-inline' is almost always a full-fledged XSS.

    5 yanıt 130 retweet 253 beğenme
    Bu Tweet dizisini göster
    Bu Tweet dizisini göster
    Geri al
  3. Retweetledi
    6 Şub

    DOM Clobbering strikes back by

    2 yanıt 86 retweet 209 beğenme
    Geri al
  4. Retweetledi
    6 Şub

    Thanks to research, new stuff are being released for soon - as for the features, payload minimization, raw cmd command, and auto command encoding within JSON/XML messages are being released after the PR review by

    33 retweet 110 beğenme
    Geri al
  5. Retweetledi
    6 Şub

    Nice by

    12 retweet 58 beğenme
    Geri al
  6. Retweetledi
    5 Şub

    Checkra1n for Windows first demo!!🔥🔥 Coming Soon!!

    85 yanıt 311 retweet 1.678 beğenme
    Bu Tweet dizisini göster
    Bu Tweet dizisini göster
    Geri al
  7. Retweetledi
    3 Şub

    Here's my write-up for ’s CTF challenge!

    5 yanıt 27 retweet 103 beğenme
    Geri al
  8. Retweetledi
    3 Şub

    CVE-2020-7471: SQLI in Django: django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. FIX:

    54 retweet 128 beğenme
    Geri al
  9. Retweetledi
    31 Oca

    , , and I are starting a new security blog. In our first write-up, we will discuss the impact of "SameSite by default" and how it affects web app sec. Feel free to request future topics you would like us to cover.

    9 yanıt 203 retweet 404 beğenme
    Geri al
  10. Retweetledi
    31 Oca

    Someone dropped a PHP zero-day on GitHub. Talked to the PHP team last night. Bug requires local foothold to exploit, so not usable for remote attacks. Also, this is the second exploit for this "disable_functions bypass" in the last few months.

    5 yanıt 122 retweet 190 beğenme
    Geri al
  11. Retweetledi
    28 Oca

    .Net being open-source makes tracking these things cool. I just hope GitHub adds code navigation support for .net code soon as well. credit for the bug goes to of course.

    7 retweet 17 beğenme
    Geri al
  12. Retweetledi
    28 Oca

    Also for the iPhone 11 Pro Max, iOS 13.3.1 beta3 Jailbreak

    217 yanıt 616 retweet 2.566 beğenme
    Geri al
  13. Retweetledi
    24 Oca

    Here are my (updated) slides from for my talk "Owning The Cloud Through SSRF & PDF Generators" with Chris Holt from . Big thank you to , , , , , and !

    39 retweet 136 beğenme
    Geri al
  14. Retweetledi
    24 Oca

    RDP Vuln CVE-2020-0609 & CVE-2020-0610 RD Gateway PoC (DoS) by Scanner by

    94 retweet 197 beğenme
    Geri al
  15. Retweetledi
    23 Oca

    The Bezos forensic report is not very good. The forensic analysis should be done by who at least have the relevant experience. The MP4 file should contain the exploit (if it is CVE-2019-11931). The exploit trigger should be visible with ffmpeg

    13 yanıt 190 retweet 487 beğenme
    Bu Tweet dizisini göster
    Bu Tweet dizisini göster
    Geri al
  16. Retweetledi
    22 Oca

    This is a pretty good reminder that any invasive heuristics in the browser - be it XSS filters or privacy protections - often cause more problems than they address:

    3 yanıt 38 retweet 107 beğenme
    Geri al
  17. Retweetledi
    21 Oca

    Learn how an authenticated RCE vulnerability in < 5.2.4 allows attackers to bypass hardening mechanisms. Read more ->

    21 retweet 39 beğenme
    Geri al
  18. Retweetledi
    18 Oca

    Just published a blog post talking about some iOS kernel framebuffer research I’ve been looking at over the last couple weeks. Have a read if you’re interested :)

    4 yanıt 131 retweet 416 beğenme
    Bu Tweet dizisini göster
    Bu Tweet dizisini göster
    Geri al
  19. Retweetledi
    18 Oca

    RDP to RCE: When Fragmentation Goes Wrong AKA: What we know about CVE-2020-0609 and CVE-2020-0610.

    4 yanıt 293 retweet 585 beğenme
    Geri al
  20. Retweetledi
    16 Oca

    "CVE-2020-0601: the ChainOfFools attack explained with PoC"

    5 retweet 17 beğenme
    Geri al
  21. Retweetledi
    15 Oca

    CVE-2020-5504 SQLI in phpMyAdmin: A malicious user could inject custom SQL in place of their own username when creating queries to this page fix:

    2 yanıt 124 retweet 251 beğenme
    Geri al

@ducnt_ henüz hiç Tweetlemedi.

Yükleme biraz zaman alacak gibi görünüyor.

Twitter aşırı kapasiteyle çalışıyor ya da anlık sorunlar yaşıyor olabilir. Yeniden dene ya da daha fazla bilgi almak için Twitter Durumu sayfasını ziyaret et.

    Şunları da beğenebilirsin

    ·