Nguyen The Duc

@ducnt_

Just another web warrior ⚔️ | Security Researcher | Sr. Security Engineer | CTF player && | Bug bounty hunter

Hồ Chí Minh, Việt Nam  
ducnt.net
Gått med februari 2017
14 Foton och videor Foton och videor

Tweets

Du blockerade @ducnt_

Är du säker på att du vill visa dessa Tweets? Visning av Tweets kommer inte att häva blockeringen av @ducnt_

  1. Fastnålad Tweet
    31 mars

    I really happy to share an article that bypass Akamai web application firewall and exploit a SQL Injection vulnerability. Hope this article will help someone in the same situation :).

    8 svar 56 retweets 151 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra
  2. Retweetade
    för 19 timmar sedan

    Detailing CVE-2020-0932 - a now patched RCE bug in reported to us by an anonymous researcher. The blog lays out how code exec is possible using TypeConverters and provides video demonstration and PoC. Read the post at

    1 svara 108 retweets 193 gillanden
    Ångra
  3. Retweetade
    27 apr.

    Releasing another side-project: CursedChrome. A Chrome-extension implant that turns victim Chrome browsers into HTTP proxies. Using these proxies you can browse the web authenticated as your victims for all of their websites. Setup takes only 5-10 mins 👍

    21 svar 372 retweets 969 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra
  4. Retweetade
    27 apr.

    We’ve just published SitRep, our host triage tool developed by . It brings extensibility and OpSec considerations to the triage process:

    4 svar 89 retweets 187 gillanden
    Ångra
  5. Retweetade
    27 apr.

    Check out my write-up about an account takeover vulnerability I found in Microsoft Teams. By sending a GIF, you could get access to the user's data and "ultimately take over an organization's entire roster of Teams accounts".

    17 svar 235 retweets 494 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra
  6. Retweetade
    25 apr.

    Exploit Proof-of-Concept for CVE-2020-12138, Privilege Escalation in ATI Technologies Inc. driver 'atillk64.sys'. Thanks to all those cited for helping me along the way.

    10 svar 298 retweets 603 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra
  7. Retweetade
    24 apr.

    support added and pushed to master, go and automate all the takeovers and DNS related detections and vulnerabilities. We also updated guide document with DNS request template information

    2 svar 44 retweets 159 gillanden
    Ångra
  8. Retweetade
    28 mars

    Slides for "Attacking Secondary Contexts in Web Applications" -

    15 svar 330 retweets 765 gillanden
    Ångra
  9. Retweetade
    24 apr.

    v1.33 released with a ton of new features. Thanks to for the great PRs! You can see whats new here

    69 retweets 144 gillanden
    Ångra
  10. Retweetade
    22 apr.

    New blog post: CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag

    3 svar 283 retweets 496 gillanden
    Ångra
  11. Retweetade
    22 apr.

    In his first blog post, explains how to abuse in enterprise environments

    1 svara 65 retweets 113 gillanden
    Ångra
  12. Retweetade
    16 apr.

    CVE-2020-7066 is a pretty neat SSRF vector in PHP; URL parsing differences strike yet again.

    2 svar 217 retweets 661 gillanden
    Ångra
  13. Retweetade
    21 apr.

    My writeup for the haproxy http2 bug (CVE-2020-11100) is now public: . Includes a PoC exploit to demonstrate RCE against Ubuntu 19.10.

    4 svar 274 retweets 647 gillanden
    Ångra
  14. Retweetade
    21 apr.

    😂

    12 svar 132 retweets 537 gillanden
    Ångra
  15. Retweetade
    21 apr.

    This is a simple story about how to control back to web app from SQL with SessionState deserialization (article only in Traditional Chinese)

    2 svar 14 retweets 32 gillanden
    Ångra
  16. Retweetade
    20 apr.

    It's here! Details on how we achieved RCE are available. Enjoy! "I'll ask your body": SMBGhost pre-auth RCE abusing Direct Memory Access structs by ()

    6 svar 278 retweets 465 gillanden
    Ångra
  17. Retweetade
    19 apr.

    🤣🤣🤣🤣

    5 svar 14 retweets 123 gillanden
    Ångra
  18. Retweetade
    19 apr.

    New write up - "Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts"

    13 svar 235 retweets 645 gillanden
    Ångra
  19. Retweetade
    23 mars

    POC: http://localhost:8000/test/?q=20) = 1 OR (select utl_inaddr.get_host_name((SELECT version FROM v%24instance)) from dual) is null%20 OR (1%2B1 analysis:

    106 retweets 178 gillanden
    Ångra
  20. Retweetade
    6 apr.

    So, it turns out was counting on the Content-Disposition header somehow disabling HTTP caching. 🤨 Excellent writeup from Moz's Martin Thomson.

    3 svar 46 retweets 137 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra
  21. Retweetade
    6 apr.

    Just pushed some fairly big changes to , many of which based on 's awesome new blog post. This should decrease false positives with heuristics based testing. Also added the ability to add additional parameters, for better fuzzing.

    1 svara 26 retweets 101 gillanden
    Visa denna tråd
    Visa denna tråd
    Ångra

@ducnt_ har inte Tweetat än.

Hämtningen verkar ta ett tag

Twitter kan vara överbelastat eller ha tillfälliga problem. Försök igen eller besök Twitter Status om du vill ha mer information.

    Du kanske också gillar

    ·