Pinned Tweet
Here is my RCE exploit code and writeup for (CVE-2021-21974) VMware ESXi OpenSLP heap-overflow discovered by @_wmliang_. Thank you again for your write-up.
[PoC] github.com/straightblast/My-…
[writeup] straightblast.medium.com/my-…
My good friend @darkfloyd1014 and his crew will be hosting the VXcon security conference vxcon.hk in Hong Kong 🇭🇰 this year. It will be packed with great talks. Security enthusiasts in the Asia Pacific area should go check it out.
straightblast retweeted
I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.
This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.
flatt.tech/research/posts/be…
straightblast retweeted
🔥 XSS on any website with missing charset information? 😳
Attackers may leverage the ISO-2022-JP character encoding to inject arbitrary JavaScript code into a website. Read more in our latest blog post:
sonarsource.com/blog/encodin…
#appsec #security #vulnerability
The Delinea Secret Server auth bypass vulnerability I discovered earlier this year, that can net access to all stored secrets, has just been assigned CVE-2024-33891. Relive the story - straightblast.medium.com/all…
CVE-2024-33891 Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to … cve.org/CVERecord?id=CVE-202…
straightblast retweeted
Last year, Brandon and Ali went looking for new attack surface area in Microsoft Exchange. Ultimately, they were able to crash the Exchange file scanner by simply sending an email. Read more on our blog: bit.ly/3xVt4Ch
straightblast retweeted
Unfortunately I have to reshare this as I'm still looking for a position.
Had several good initial opportunities but in a lot of cases they were looking for someone less senior and not a web app SME.
If your company are hiring specifically web app testers, please DM me. 😁
I am currently looking for a remote, US-based, webapp-focused pentesting position. Though I'm not in a hurry, I understand how long interview processes can be.
If you're looking for a candidate with over 12 years experience in the industry, plus the ability to effectively communicate with customers in different roles, develop testing tools on the fly, and spread brand awareness on social media / at conferences, let's talk.
Here is my writeup and PoC for the AuthN/AuthZ bypass vulnerability in Delinea Secret Server I found some time ago. The patch is available, go update.
[Write up/PoC] - straightblast.medium.com/all…
[Patch Information] - docs.delinea.com/online-help…
[Vendor Update] - trust.delinea.com/?tcuUid=17…
straightblast retweeted
Here are the slides from the "Attacking JavaScript Engines in 2022" talk by @itszn13 and myself @offensive_con. It's a high-level talk about JS, JIT, various bug classes, and typical exploitation flows but with lots of references for further digging! saelo.github.io/presentation…
straightblast retweeted
- Use-after-frees from JIT
- CodeQL for variant analysis
- Never-before-seen exploit primitives
- Tenured heap tomfoolery
I’ve packed just about everything in this post!
🦊New on #SentinelLabs! Learn how to dive into JIT compilers in #JavaScript engines and follow along as we find a new set of exploit primitives in this previously patched bug. By @maxpl0it.
Read the blog: sentinelone.com/labs/firefox…
#firefox #cybersecurity #infosec
One of my Zoom Client finding CVE-2021-34425 that I discovered when I was still with Walmart Global Tech got announced.
CVE-2021-34425 The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat’s “link preview” functionality. In versions prior to 5.7.3, if a user we... cve.mitre.org/cgi-bin/cvenam…
straightblast retweeted
Today we're publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world. googleprojectzero.blogspot.c…
straightblast retweeted
Just watched "Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond" - must-read research by @intruder_io's Daniel Thatcher
intruder.io/research/practic…
straightblast retweeted
✨ New Workshop! Android Exploits 101 🔥📱
I put together an introductory overview of the "shape" of modern 0-day exploit chains for Android. Hope it's helpful 😊
youtu.be/squuwVQiPgg
ALT Flow chart of targeted component options for an Android full-chain. Slide 8 in the slides which are linked in the Youtube description.
straightblast retweeted
Here's a cool project I've been working on during my boring intro CS classes! It's heaptrace, a heap debugger that replaces addresses with symbols to help you understand a program's heap operations.
github.com/arinerron/heaptra…
straightblast retweeted
Slides and code from my Extra Better Program Finagling (eBPF) Attack and Defense talk at @toorcon 2021 have been uploaded to GitHub. Code needs some refactoring from PoC to useful tooling but wanted to get it up.
github.com/richinseattle/ebp…
straightblast retweeted
New Project Zero blog post: Fuzzing Closed-Source JavaScript Engines with Coverage Feedback, googleprojectzero.blogspot.c…
straightblast retweeted
A deep-dive into the SolarWinds Serv-U SSH vulnerability -- microsoft.com/security/blog/…
straightblast retweeted
Ok, so don't be alarmed but this is an iPhone connected remotely to a Docker container of macOS VM running on Linux using @pimskeks's usbfluxd...
Yes, I'm adding it to Docker-OSX... not sure how to feel, but this is too powerful...
Can literally install apps OTA worldwide...
straightblast retweeted
We have published the details of our Zoom exploit in this quite long writeup: sector7.computest.nl/post/20… tl;dr: heap buffer overflow when handling key exchange messages for chat encryption.
