Nguyen The Duc

@ducnt_

Just another web warrior ⚔️ | Security Researcher | Sr. Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Geregistreerd in februari 2017
12 foto's en video's Foto's en video's

Tweets

Je hebt @ducnt_ geblokkeerd

Weet je zeker dat je deze Tweets wilt bekijken? @ducnt_ wordt niet gedeblokkeerd door Tweets te bekijken.

  1. Vastgemaakte Tweet
    8 jan.

    My first `double kill` at : Kudos to WordPress security team with very quickly and awesome work 🥰

    1 antwoord 14 vind-ik-leuks
    Ongedaan maken
  2. 1 uur geleden

    I really happy to share an article that bypass Akamai web application firewall and exploit a SQL Injection vulnerability. Hope this article will help someone in the same situation :).

    2 retweets 6 vind-ik-leuks
    Ongedaan maken
  3. heeft geretweet
    30 mrt.

    昼に「WindowsのSMBの脆弱性の実用的な検証コードがもうすぐ公開されるかも」みたいなことを投稿しましたが、つい先ほど公開されました。まだセキュリティ更新プログラムを適用していない人は、速やかに適用しましょう。

    109 retweets 156 vind-ik-leuks
    Ongedaan maken
  4. heeft geretweet
    29 mrt.

    My last article: Bypass Content-Security-Policy by hiding JavaScript in a PNG image.

    9 antwoorden 82 retweets 214 vind-ik-leuks
    Ongedaan maken
  5. heeft geretweet
    29 mrt.

    Did you know that / CVE-2020-0796 can be used for a Local Privilege Escalation? We'll post the details + POC in the next few days and in the meantime:

    5 antwoorden 336 retweets 692 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  6. heeft geretweet
    28 feb.

    it took me two days to finish the analysis of cve-2020-6418, amazing vuln, learned a lot from this bug. thanks to here is the github repo: and here is the writeup:

    4 antwoorden 128 retweets 321 vind-ik-leuks
    Ongedaan maken
  7. heeft geretweet
    20 mrt.

    Had fun today writing a .NET exploit for 's CVE-2020-0787 BITS LPE and UsoLoader technique. Check out his blog posts and research if you haven't already. They are all brilliant 👏🙏

    3 antwoorden 85 retweets 187 vind-ik-leuks
    Ongedaan maken
  8. heeft geretweet
    19 mrt.

    Confirmed! combined an info leak & an uninitialized variable in to pop calc on the host OS. He earned himself $40,000 and 4 points towards Master of Pwn.

    29 retweets 96 vind-ik-leuks
    Ongedaan maken
  9. heeft geretweet
    18 mrt.

    "XXE-scape through the front door: circumventing the firewall with HTTP request smuggling" - read my write-up about a pretty cool way in which I bypassed a firewall stopping me from exploiting an XXE vulnerability.

    18 antwoorden 250 retweets 504 vind-ik-leuks
    Ongedaan maken
  10. heeft geretweet
    18 mrt.

    New blog post by on bypassing .NET ETW for red teams

    2 antwoorden 91 retweets 167 vind-ik-leuks
    Ongedaan maken
  11. heeft geretweet
    16 mrt.

    The December update to HTTP Request Smuggler added a new desync technique by - he's just blogged the full details here:

    2 antwoorden 130 retweets 344 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  12. heeft geretweet
    16 mrt.

    "CVE-2020-0796 Pre-Auth POC" Tl;Dr: Only DoS by BSOD so far. No RCE proof-of-concept out yet.

    3 retweets 7 vind-ik-leuks
    Ongedaan maken
  13. heeft geretweet
    12 mrt.
    Als antwoord op

    we really out here and aren't lackin

    4 antwoorden 10 retweets 141 vind-ik-leuks
    Ongedaan maken
  14. heeft geretweet
    9 mrt.

    I have something fun for you, I pulled the javascript interpreter out of Avast and ported it to Linux 😆 This runs unsandboxed as SYSTEM, any vulns are wormable pre-auth RCE on 400M endpoints  ¯\_(ツ)_/¯ 🐧

    83 antwoorden 1.217 retweets 3.207 vind-ik-leuks
    Ongedaan maken
  15. heeft geretweet
    4 mrt.

    Interesting new vulnerability in pppd, nice find Ilja Van Sprundel of Fix:

    2 retweets 1 vind-ik-leuk
    Ongedaan maken
  16. heeft geretweet
    2 mrt.

    This blog post should be useful for those who also know how SharePoint works: - I've shown how code injection can aid to bypass some misconfigs in .NET + some thoughts for actual bypasses if you've research time!

    I have had this question of why we cannot get a shell when we can create files in our directory. I thought it is a well-known thing, but do you know why? (I like to see if it can be a blog worthy topic in 2020) 🍻
    Deze collectie tonen
    1 antwoord 46 retweets 84 vind-ik-leuks
    Deze collectie tonen
    Deze collectie tonen
    Ongedaan maken
  17. 27 feb.

    Filed a duplicate with gr8 bug was found by but can reopen it with a triaged issue. Really a excited moment.

    1 antwoord 1 retweet 10 vind-ik-leuks
    Ongedaan maken
  18. heeft geretweet
    25 feb.

    New blog post! Here is how you can use MSBuild’s UnregisterAssembly task to execute arbitrary code in a .NET assembly. ⤵️

    1 antwoord 115 retweets 213 vind-ik-leuks
    Ongedaan maken
  19. heeft geretweet
    21 feb.

    Just wrote a new article about how I found a Remote Command Execution 0-day (CVE-2020-8813) via static analysis in Cacti v1.2.8 the popular infrastructure graphing solution. I also explained how to exploit it without authentication in some cases.

    14 antwoorden 239 retweets 614 vind-ik-leuks
    Ongedaan maken
  20. heeft geretweet
    18 feb.

    Slides from my talk on iMessage exploitation: More technical details in the blog post: Great conference again, thanks team! :)

    2 antwoorden 114 retweets 313 vind-ik-leuks
    Ongedaan maken
  21. heeft geretweet
    18 feb.

    [PoC] CVE-2020-0618 Microsoft SQL Server Reporting Services RCE Vulnerability POST /ReportServer/pages/ReportViewer.aspx HTTP/1.1 Host: target ... ... NavigationCorrector$PageState=NeedsCorrection&NavigationCorrector$ViewState=[PayloadHere]&__VIEWSTATE=

    Deze media bevatten mogelijk gevoelig materiaal. Meer informatie
    4 antwoorden 186 retweets 349 vind-ik-leuks
    Ongedaan maken

@ducnt_ heeft nog niet getweet.

Het laden lijkt wat langer te duren.

Twitter is mogelijk overbelast of ondervindt een tijdelijke onderbreking. Probeer het opnieuw of bekijk de Twitter-status voor meer informatie.

    Je bent misschien ook geïnteresseerd in

    ·