Nguyen The Duc

@ducnt_

Just another web warrior ⚔️ | Security Researcher | Sr. Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Joined February 2017
14 Photos and videos Photos and videos

Tweets

You blocked @ducnt_

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @ducnt_

  1. Pinned Tweet
    Mar 31

    I really happy to share an article that bypass Akamai web application firewall and exploit a SQL Injection vulnerability. Hope this article will help someone in the same situation :).

    8 replies . 56 retweets 151 likes
    Show this thread
    Show this thread
    Undo
  2. Retweeted
    48 minutes ago

    No Thanks , We need Bounties only 🤣🤣🤣🤣🤣🤣🤣

    1 retweet 6 likes
    Undo
  3. Retweeted
    Apr 30

    The fuzzing team has been developing a new fuzzer to help identify security vulnerabilities in the implementation of WebAPIs in Firefox. This fuzzer, which we’re calling Domino, leverages the WebAPIs’ own WebIDL definitions as a fuzzing grammar.

    2 replies . 54 retweets 108 likes
    Show this thread
    Show this thread
    Undo
  4. Retweeted
    Apr 29

    Detailing CVE-2020-0932 - a now patched RCE bug in reported to us by an anonymous researcher. The blog lays out how code exec is possible using TypeConverters and provides video demonstration and PoC. Read the post at

    1 reply . 131 retweets 235 likes
    Undo
  5. Retweeted
    Apr 27

    Releasing another side-project: CursedChrome. A Chrome-extension implant that turns victim Chrome browsers into HTTP proxies. Using these proxies you can browse the web authenticated as your victims for all of their websites. Setup takes only 5-10 mins 👍

    21 replies . 386 retweets 992 likes
    Show this thread
    Show this thread
    Undo
  6. Retweeted
    Apr 27

    We’ve just published SitRep, our host triage tool developed by . It brings extensibility and OpSec considerations to the triage process:

    4 replies . 92 retweets 189 likes
    Undo
  7. Retweeted
    Apr 27

    Check out my write-up about an account takeover vulnerability I found in Microsoft Teams. By sending a GIF, you could get access to the user's data and "ultimately take over an organization's entire roster of Teams accounts".

    17 replies . 236 retweets 498 likes
    Show this thread
    Show this thread
    Undo
  8. Retweeted
    Apr 25

    Exploit Proof-of-Concept for CVE-2020-12138, Privilege Escalation in ATI Technologies Inc. driver 'atillk64.sys'. Thanks to all those cited for helping me along the way.

    9 replies . 300 retweets 606 likes
    Show this thread
    Show this thread
    Undo
  9. Retweeted
    Apr 24

    support added and pushed to master, go and automate all the takeovers and DNS related detections and vulnerabilities. We also updated guide document with DNS request template information

    2 replies . 44 retweets 160 likes
    Undo
  10. Retweeted
    Mar 28

    Slides for "Attacking Secondary Contexts in Web Applications" -

    15 replies . 332 retweets 764 likes
    Undo
  11. Retweeted
    Apr 24

    v1.33 released with a ton of new features. Thanks to for the great PRs! You can see whats new here

    69 retweets 145 likes
    Undo
  12. Retweeted
    Apr 22

    New blog post: CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag

    3 replies . 284 retweets 497 likes
    Undo
  13. Retweeted
    Apr 22

    In his first blog post, explains how to abuse in enterprise environments

    1 reply . 65 retweets 113 likes
    Undo
  14. Retweeted
    Apr 15

    CVE-2020-7066 is a pretty neat SSRF vector in PHP; URL parsing differences strike yet again.

    2 replies . 218 retweets 662 likes
    Undo
  15. Retweeted
    Apr 21

    My writeup for the haproxy http2 bug (CVE-2020-11100) is now public: . Includes a PoC exploit to demonstrate RCE against Ubuntu 19.10.

    4 replies . 273 retweets 650 likes
    Undo
  16. Retweeted
    Apr 21

    😂

    12 replies . 133 retweets 538 likes
    Undo
  17. Retweeted
    Apr 21

    This is a simple story about how to control back to web app from SQL with SessionState deserialization (article only in Traditional Chinese)

    2 replies . 14 retweets 32 likes
    Undo
  18. Retweeted
    Apr 20

    It's here! Details on how we achieved RCE are available. Enjoy! "I'll ask your body": SMBGhost pre-auth RCE abusing Direct Memory Access structs by ()

    6 replies . 278 retweets 466 likes
    Undo
  19. Retweeted
    Apr 19

    🤣🤣🤣🤣

    5 replies . 14 retweets 123 likes
    Undo
  20. Retweeted
    Apr 19

    New write up - "Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts"

    13 replies . 236 retweets 649 likes
    Undo
  21. Retweeted
    Mar 22

    POC: http://localhost:8000/test/?q=20) = 1 OR (select utl_inaddr.get_host_name((SELECT version FROM v%24instance)) from dual) is null%20 OR (1%2B1 analysis:

    106 retweets 178 likes
    Undo

@ducnt_ hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·