Nguyen The Duc

@ducnt_

Just another web warrior ⚔️ | Security Researcher | Sr. Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
Gått med februari 2017

Tweets

Du blockerade @ducnt_

Är du säker på att du vill visa dessa Tweets? Visning av Tweets kommer inte att häva blockeringen av @ducnt_

  1. Fastnålad Tweet
    8 jan.
    Ångra
  2. Retweetade

    Confirmed! combined an info leak & an uninitialized variable in to pop calc on the host OS. He earned himself $40,000 and 4 points towards Master of Pwn.

    Ångra
  3. Retweetade
    18 mars

    "XXE-scape through the front door: circumventing the firewall with HTTP request smuggling" - read my write-up about a pretty cool way in which I bypassed a firewall stopping me from exploiting an XXE vulnerability.

    Ångra
  4. Retweetade
    18 mars
    Ångra
  5. Retweetade
    16 mars

    The December update to HTTP Request Smuggler added a new desync technique by - he's just blogged the full details here:

    Visa denna tråd
    Ångra
  6. Retweetade
    16 mars

    "CVE-2020-0796 Pre-Auth POC" Tl;Dr: Only DoS by BSOD so far. No RCE proof-of-concept out yet.

    Ångra
  7. Retweetade
    12 mars
    Svar till

    we really out here and aren't lackin

    Ångra
  8. Retweetade
    9 mars

    I have something fun for you, I pulled the javascript interpreter out of Avast and ported it to Linux 😆 This runs unsandboxed as SYSTEM, any vulns are wormable pre-auth RCE on 400M endpoints  ¯\_(ツ)_/¯ 🐧

    Ångra
  9. Retweetade
    4 mars
    Ångra
  10. Retweetade
    2 mars

    This blog post should be useful for those who also know how SharePoint works: - I've shown how code injection can aid to bypass some misconfigs in .NET + some thoughts for actual bypasses if you've research time!

    Visa denna tråd
    Ångra
  11. 27 feb.

    Filed a duplicate with gr8 bug was found by but can reopen it with a triaged issue. Really a excited moment.

    Ångra
  12. Retweetade
    25 feb.

    New blog post! Here is how you can use MSBuild’s UnregisterAssembly task to execute arbitrary code in a .NET assembly. ⤵️

    Ångra
  13. Retweetade
    21 feb.

    Just wrote a new article about how I found a Remote Command Execution 0-day (CVE-2020-8813) via static analysis in Cacti v1.2.8 the popular infrastructure graphing solution. I also explained how to exploit it without authentication in some cases.

    Ångra
  14. Retweetade
    18 feb.

    Slides from my talk on iMessage exploitation: More technical details in the blog post: Great conference again, thanks team! :)

    Ångra
  15. Retweetade
    18 feb.

    [PoC] CVE-2020-0618 Microsoft SQL Server Reporting Services RCE Vulnerability POST /ReportServer/pages/ReportViewer.aspx HTTP/1.1 Host: target ... ... NavigationCorrector$PageState=NeedsCorrection&NavigationCorrector$ViewState=[PayloadHere]&__VIEWSTATE=

    Det här mediet kan ha stötande innehåll Läs mer
    Ångra
  16. Retweetade
    18 feb.

    Just published another remote code execution chain I exploited recently. I also wrote about how organizations can stop these attacks at the development stage - the key is convention over configuration.

    Ångra
  17. Retweetade
    11 feb.

    さんとSpectreやXS-LeaksやCross-Origin-*ヘッダーについて話しました! / ep63 Cross Origin Info Leaks

    Visa denna tråd
    Ångra
  18. Retweetade
    17 feb.
    Ångra
  19. Retweetade
    13 feb.
    Ångra
  20. Retweetade
    11 feb.

    Blind SSRF exploitation En: Ru: What about port scanning using DNS-requests?

    Ångra
  21. Retweetade
    11 feb.
    Ångra

Hämtningen verkar ta ett tag

Twitter kan vara överbelastat eller ha tillfälliga problem. Försök igen eller besök Twitter Status om du vill ha mer information.

    Du kanske också gillar

    ·