Nguyen The Duc

@ducnt_

Just another web warrior | Security Researcher | Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Sumali noong Pebrero 2017
11 Larawan o video Mga larawan at video

Mga Tweet

Binlock mo si @ducnt_

Sigurado ka bang gusto mong tingnan ang mga Tweet na ito? Hindi maa-unblock ng pagtingin ang mga Tweet ni @ducnt_

  1. Naka-pin na Tweet
    Ene 8

    My first `double kill` at : Kudos to WordPress security team with very quickly and awesome work 🥰

    1 sagot 15 gusto
    I-undo
  2. Ni-retweet ni
    Hul 10, 2018

    Neatly bypassing Content Security Policy. Why 'unsafe-inline' is almost always a full-fledged XSS.

    5 sagot 130 retweet 253 gusto
    Ipakita ang thread na ito
    Ipakita ang thread na ito
    I-undo
  3. Ni-retweet ni
    Peb 6

    DOM Clobbering strikes back by

    2 sagot 86 mga retweet 209 (na) gusto
    I-undo
  4. Ni-retweet ni
    Peb 6

    Thanks to research, new stuff are being released for soon - as for the features, payload minimization, raw cmd command, and auto command encoding within JSON/XML messages are being released after the PR review by

    1 sagot 33 retweet 110 gusto
    I-undo
  5. Ni-retweet ni
    Peb 6

    Nice by

    12 retweet 58 gusto
    I-undo
  6. Ni-retweet ni
    Peb 5

    Checkra1n for Windows first demo!!🔥🔥 Coming Soon!!

    85 sagot 310 retweet 1,678 gusto
    Ipakita ang thread na ito
    Ipakita ang thread na ito
    I-undo
  7. Ni-retweet ni
    Peb 3

    Here's my write-up for ’s CTF challenge!

    5 sagot 27 retweet 103 gusto
    I-undo
  8. Ni-retweet ni
    Peb 3

    CVE-2020-7471: SQLI in Django: django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. FIX:

    54 mga retweet 128 gusto
    I-undo
  9. Ni-retweet ni
    Ene 31

    , , and I are starting a new security blog. In our first write-up, we will discuss the impact of "SameSite by default" and how it affects web app sec. Feel free to request future topics you would like us to cover.

    9 mga sagot 203 retweet 404 (na) gusto
    I-undo
  10. Ni-retweet ni
    Ene 31

    Someone dropped a PHP zero-day on GitHub. Talked to the PHP team last night. Bug requires local foothold to exploit, so not usable for remote attacks. Also, this is the second exploit for this "disable_functions bypass" in the last few months.

    5 sagot 122 retweet 190 gusto
    I-undo
  11. Ni-retweet ni
    Ene 28

    .Net being open-source makes tracking these things cool. I just hope GitHub adds code navigation support for .net code soon as well. credit for the bug goes to of course.

    7 retweet 17 gusto
    I-undo
  12. Ni-retweet ni
    Ene 28

    Also for the iPhone 11 Pro Max, iOS 13.3.1 beta3 Jailbreak

    217 sagot 616 mga retweet 2,566 (na) gusto
    I-undo
  13. Ni-retweet ni
    Ene 24

    Here are my (updated) slides from for my talk "Owning The Cloud Through SSRF & PDF Generators" with Chris Holt from . Big thank you to , , , , , and !

    39 mga retweet 136 (na) gusto
    I-undo
  14. Ni-retweet ni
    Ene 24

    RDP Vuln CVE-2020-0609 & CVE-2020-0610 RD Gateway PoC (DoS) by Scanner by

    94 mga retweet 197 gusto
    I-undo
  15. Ni-retweet ni
    Ene 23

    The Bezos forensic report is not very good. The forensic analysis should be done by who at least have the relevant experience. The MP4 file should contain the exploit (if it is CVE-2019-11931). The exploit trigger should be visible with ffmpeg

    13 sagot 190 retweet 487 gusto
    Ipakita ang thread na ito
    Ipakita ang thread na ito
    I-undo
  16. Ni-retweet ni
    Ene 22

    This is a pretty good reminder that any invasive heuristics in the browser - be it XSS filters or privacy protections - often cause more problems than they address:

    3 sagot 38 retweet 107 gusto
    I-undo
  17. Ni-retweet ni
    Ene 21

    Learn how an authenticated RCE vulnerability in < 5.2.4 allows attackers to bypass hardening mechanisms. Read more ->

    21 retweet 39 (na) gusto
    I-undo
  18. Ni-retweet ni
    Ene 18

    Just published a blog post talking about some iOS kernel framebuffer research I’ve been looking at over the last couple weeks. Have a read if you’re interested :)

    4 mga sagot 131 retweet 416 (na) gusto
    Ipakita ang thread na ito
    Ipakita ang thread na ito
    I-undo
  19. Ni-retweet ni
    Ene 18

    RDP to RCE: When Fragmentation Goes Wrong AKA: What we know about CVE-2020-0609 and CVE-2020-0610.

    4 mga sagot 293 retweet 585 gusto
    I-undo
  20. Ni-retweet ni
    Ene 16

    "CVE-2020-0601: the ChainOfFools attack explained with PoC"

    5 retweet 17 gusto
    I-undo
  21. Ni-retweet ni
    Ene 15

    CVE-2020-5504 SQLI in phpMyAdmin: A malicious user could inject custom SQL in place of their own username when creating queries to this page fix:

    2 sagot 124 mga retweet 251 gusto
    I-undo

Hindi pa nagtu-Tweet si:@ducnt_.

Ang paglo-load ay mukhang natatagalan.

Maaaring lumagpas na sa kapasidad ang Twitter o nakakaranas ng panandaliang problema. Subukan muli o bisitahin ang Twitter Status para sa karagdagang impormasyon.

    Maaari mo ring magustuhan

    ·