gelo (@gelosecurity) 's Twitter Profile
gelo

@gelosecurity

offensive security // I ❤️ mobile apps.

ID: 991805547857887232

calendar_today02-05-2018 22:24:04

103 Tweet

84 Followers

79 Following

spidersec (@spidersec) 's Twitter Profile Photo
spidersec
@spidersec

6 years ago

HTTP Request Smuggling in one Screenshot. 🙂

HTTP Request Smuggling in one Screenshot. 🙂
Brute Logic (@brutelogic) 's Twitter Profile Photo
Brute Logic
@brutelogic

6 years ago

Know how to look for #XSS step by step! brutelogic.com.br/blog/testing-f…

gelo (@gelosecurity) 's Twitter Profile Photo
gelo
@gelosecurity

6 years ago

In preparation of the OSCP, here’s a write up I made on how to exploit “Optimum” on Hack The Box without Metasploit usage: gelosecurity.com/hackthebox-osc… #hackthebox #optimum #oscp

@1njection@infosec.exchange (@1njection) 's Twitter Profile Photo
@[email protected]
@1njection

6 years ago

Some thoughts on the Collegiate Penetration Testing Competition finals last weekend: lockboxx.blogspot.com/2019/11/cptc-2…

gelo (@gelosecurity) 's Twitter Profile Photo
gelo
@gelosecurity

6 years ago

Currently practicing BOF for #OSCP. I take my exam this Sunday, right after my University Finance final on Saturday 😅. VulnServer, SLMail, and brainpan down. Hopefully I pass it so I can start my journey into appsec and bug bounties :D

Clément Notin (@cnotin) 's Twitter Profile Photo
Clément Notin
@cnotin

6 years ago

Let's say that during a pentest you discover requests to <name>.azure-api.net 🤔 🎉 Congratulations it means that you found an API hosted by Azure API Management! The root doesn't reveal anything but you can go to <name>.portal.azure-api.net to see its documentation (& more!) 🕵️

Let's say that during a pentest you discover requests to &lt;name&gt;.azure-api.net 🤔 🎉 Congratulations it means that you found an API hosted by Azure API Management! The root doesn't reveal anything but you can go to &lt;name&gt;.portal.azure-api.net to see its documentation (&amp; more!) 🕵️
🇵🇸 1nclud3 🇵🇸 (@1nclud3) 's Twitter Profile Photo
🇵🇸 1nclud3 🇵🇸
@1nclud3

6 years ago

- Execute bash commands without spaces with two methods: 1- {ping,-c,1,127.0.0.1} 2- ping${IFS}-c${IFS}1${IFS}127.0.0.1 - terminal will translate ${IFS} into a space Thanks ippsec

gelo (@gelosecurity) 's Twitter Profile Photo
gelo
@gelosecurity

6 years ago

Just got news that I passed my OSCP! And in my final week as a uni student! Thank you OffSec for an amazing course and exam. The labs and exam have humbled me and made me realize I have so much more to learn. This is just the beginning! #OSCP #PWK #student

Mohammed Aldoub م.محمد الدوب (@voulnet) 's Twitter Profile Photo
Mohammed Aldoub م.محمد الدوب
@voulnet

6 years ago

Here's a command injection WAF bypass that works: using empty shell variables, like ${something} and ${thisdoesntexist}. example: cat /e${hahaha}tc/${heywaf}pas${catchthis}swd It works, currently bypasses Cloudflare and probably others. I don't want a bounty. Enjoy! Proof:

Here's a command injection WAF bypass that works: using empty shell variables, like ${something} and ${thisdoesntexist}. example: cat /e${hahaha}tc/${heywaf}pas${catchthis}swd It works, currently bypasses Cloudflare and probably others. I don't want a bounty. Enjoy! Proof:
xxux11 ᯲ ̸ (@11xuxx) 's Twitter Profile Photo
xxux11 ᯲ ̸
@11xuxx

6 years ago

LFI to RCE 1. ffuf on "/" -> "redacted-api" -> 302 2. ffuf on "redacted-api/" -> "application.wadl" -> 200 3. all operations were auth protected 4. didn't give up and tested ~200 operations 5. fount LFI, no auth 6. admin creds in plaintext, logged in and got RCE #bugbountytips

LFI to RCE 1. ffuf on "/" -&gt; "redacted-api" -&gt; 302 2. ffuf on "redacted-api/" -&gt; "application.wadl" -&gt; 200 3. all operations were auth protected 4. didn't give up and tested ~200 operations 5. fount LFI, no auth 6. admin creds in plaintext, logged in and got RCE #bugbountytips
rez0 (@rez0__) 's Twitter Profile Photo
rez0
@rez0__

6 years ago

Use ffuf for vhosting on every new domain to find hidden servers/admin panels: ffuf -c -u https://target .com -H “Host: FUZZ” -w vhost_wordlist.txt #BugBountyTips #BugBountyTip #BugBounty

Jason Lang (@curi0usjack) 's Twitter Profile Photo
Jason Lang
@curi0usjack

6 years ago

I'm addicted to even the smallest methodology improvements. Grep out a list of IPs from unstructured data with this alias. alias grepip='grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"'

I'm addicted to even the smallest methodology improvements. Grep out a list of IPs from unstructured data with this alias. alias grepip='grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"'
Dominic Chell 👻 (@domchell) 's Twitter Profile Photo
Dominic Chell 👻
@domchell

6 years ago

I've just uploaded my slides from /ˈziːf-kɒn/ for anyone who's interested github.com/mdsecresearch/…

I've just uploaded my slides from <a href="/x33fcon/">/ˈziːf-kɒn/</a> for anyone who's interested github.com/mdsecresearch/…
helloworld (@0xhelloworld_) 's Twitter Profile Photo
helloworld
@0xhelloworld_

5 years ago

i would develop my own vulnerable web application w vulnerabilities from OWASP Top 10. if you're new and trying to break into application pentesting/bounty hunting this is one project i overlooked and wish i did a lot sooner.

Corben Leo (@hacker_) 's Twitter Profile Photo
Corben Leo
@hacker_

4 years ago

I hacked a gaming company this year. Here's how I did it:

m0z (@loosesecurity) 's Twitter Profile Photo
m0z
@loosesecurity

4 years ago

Posting this so I don't forget a great XSS polyglot javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//> Anyone got anymore interesting polyglots?

Chris Thompson (@_mayyhem) 's Twitter Profile Photo
Chris Thompson
@_mayyhem

3 years ago

SCCM takeover by abusing automatic client push installation has less requirements than I thought. Check this post out for a detailed walkthrough and recommendations. Install KB15599094 and disable NTLM for client push installation to prevent this attack. posts.specterops.io/sccm-site-take…

Sam Curry (@samwcyo) 's Twitter Profile Photo
Sam Curry
@samwcyo

3 years ago

New writeup: Between March, 2023 and May, 2023 we found multiple critical vulnerabilities in points[.]com the global provider for major airline and hotel rewards programs. Full post is available here: samcurry.net/Points-com/ Work from: shubs Ian Carroll

publiclyDisclosed (@disclosedh1) 's Twitter Profile Photo
publiclyDisclosed
@disclosedh1

3 years ago

Yelp disclosed a bug submitted by Lil Endian: hackerone.com/reports/2010530 #hackerone #bugbounty

Yelp disclosed a bug submitted by <a href="/lil_endian/">Lil Endian</a>: hackerone.com/reports/2010530 #hackerone #bugbounty
Eduardo Novella (@enovella_) 's Twitter Profile Photo
Eduardo Novella
@enovella_

a year ago

After 2 years from the last release, APKiD v3.0.0 is out !🔥 - "Black Hawk edition" 📃 Changelog: github.com/rednaga/APKiD/… 🐍 Pypi package: `$ pip install --upgrade apkid` Thanks to Abhi for the stunning work 🙌