Tobi Weißhaar (@_kun_19) header
Tobi Weißhaar (@_kun_19) profile picture

Tobi Weißhaar

@_kun_19

MSc Advanced Computer Science | Pentester | OSCP | OSWE | CRTO | CRTP| Bug Bounty Hunter #kaeferjaeger

hackerone.com/kun_19
Joined April 2011
  • Tweets223
  • Following83
  • Followers1.3K
11Media
Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)Photo by Tobi Weißhaar (@_kun_19)
Tobi Weißhaar retweeted
PWN AI (@pwn_ai) profile picture
PWN AI
@pwn_aiMar 30
🚨 ZERODAY: ImageMagick 🚨 Our autonomous pentester pwn.ai just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯 💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰 pwn.ai/blog/imagemagick-from…
Image from PWN AI (@pwn_ai)
7
124
9
475
45,604
🪲 Bug bounty disclosure: account vulnerability Here's how @_kun_19 highlighted a security gap in Shopify Collabs 🧵
Image from Shopify Engineering (@ShopifyEng)
2
2
15
2,868
Shopify disclosed a bug submitted by @_kun_19: hackerone.com/reports/167973… - Bounty: $800 #hackerone #bugbounty
Image from publiclyDisclosed (@disclosedh1)
6
37
3,057
Tobi Weißhaar retweeted
daniel (@hackermondev) profile picture
daniel@hackermondev11 Oct 2024
1 Bug, $50K+ in bounties: how Zendesk left a backdoor in hundreds of companies #bugbountytips gist.github.com/hackermondev…
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500...

1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500...

1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies - zendesk.md

gist.github.com
71
334
60
1,319
2,023,421
#0day #research #bugbounty #informationsecurity blog.malicious.group/from-ak… How I *AM* able to abuse Akamai to abuse F5, to abuse all of their customers. This is a bug chain that doesn't require a bug on the target domain to exploit them. But what do I know, I am a freelance nobody.

Malicious Group - Offensive R & D

The security researcher d3d is the founder of Malicious Group Research, which is made up various Offensive Security Research and Development engineers and developers...

malicious.group
27
111
5
286
56,337
Tobi Weißhaar retweeted
Corben Leo (@hacker_) profile picture
Corben Leo
@hacker_24 Aug 2023
I've made $500k+ from SSRF vulnerabilities. Here are my tricks:
Image from Corben Leo (@hacker_)
84
1,199
19
4,382
443,914
Yelp disclosed a bug submitted by @lil_endian: hackerone.com/reports/201053… #hackerone #bugbounty
Image from publiclyDisclosed (@disclosedh1)
6
46
1
199
29,345
Tobi Weißhaar retweeted
Kubesploit (@kubesploit) profile picture
Kubesploit@kubesploit5 Aug 2023
OWASP Kubernetes is aimed at helping security practitioners, sysadmins, and software developers prioritize risks around the Kubernetes ecosystem In this article, you will find the top 10 risks you should consider and mitigations you could adopt ➤ sysdig.com/blog/top-owasp-ku…
Image from Kubesploit (@kubesploit)
25
90
10,644
Here is the technical details of MS Teams RCE I used in Pwn2Own Vancouver 2022! #shibuyaxss の資料公開しました！Pwn2Ownで賞金を獲得したTeamsの脆弱性について解説しています。 speakerdeck.com/masatokinuga… (English) speakerdeck.com/masatokinuga… (日本語) youtu.be/TMh_WbF9VnM (demo)
How I Hacked Microsoft Teams and got $150,000 in Pwn2Own

How I Hacked Microsoft Teams and got $150,000 in Pwn2Own

English version of my presentation at Shibuya.XSS techtalk #12. 日本語版はこちら: https://speakerdeck.com/masatokinugawa/shibuya-dot-xss-techtalk-number-12

speakerdeck.com
1
227
7
571
82,188
Tobi Weißhaar retweeted
Justin Gardner (@Rhynorater) profile picture
Justin Gardner
@Rhynorater16 Jul 2023
Re-learned this one from @ryotkak at a recent LHE: In Safari, "new URL('javascript://test.com/%0aalert(1)').hostname" will be "test[.]com" (no [] obvi). This can be used to bypass hostname checks and execute valid JS. Just popped an XSS with this on Friday. Good trick.
6
55
4
335
43,628
Today at KubeCon EU we released "mkat", the Managed Kubernetes Auditing Toolkit. Check it out! github.com/DataDog/managed-k… See also our talk on common attacker tactics to pivot from Kubernetes clusters to cloud environments (with 2 demos): docs.google.com/presentation… #KubeCon
Image from Christophe Tafani-Dereeper (@christophetd)
Image from Christophe Tafani-Dereeper (@christophetd)
Image from Christophe Tafani-Dereeper (@christophetd)
2
21
77
11,154
Tobi Weißhaar retweeted
Ronen Shustin (@ronenshh) profile picture
Ronen Shustin
@ronenshh19 Apr 2023
Today we share our Alibaba Cloud research for the first time, where we gained unauthorized access to other customers' databases in two different services 🚨 This complex research involved RCE, PE, Container escape, K8s lateral movement, and supply chain attack. Check it out 🧵
Image from Ronen Shustin (@ronenshh)
12
392
31
1,266
195,602
Tobi Weißhaar retweeted
Hillai Ben-Sasson (@hillai) profile picture
Hillai Ben-Sasson
@hillai29 Mar 2023
I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts. How did I do it? Well, it all started with a simple click in @Azure… 👀 This is the story of #BingBang 🧵⬇️
Image from Hillai Ben-Sasson (@hillai)
253
3,125
567
14,512
3,210,432
Tobi Weißhaar retweeted
kmkz (@kmkz_security) profile picture
kmkz
@kmkz_security5 Mar 2023
Remote Code Execution via Prototype Pollution in Blitz.js (CVE-2022-23631) sonarsource.com/blog/blitzjs…
Remote Code Execution via Prototype Pollution in Blitz.js

Remote Code Execution via Prototype Pollution in Blitz.js

We recently discovered a Prototype Pollution vulnerability in Blitz.js leading to Remote Code Execution. Learn about this bug class and how to avoid it in your code!

sonarsource.com
24
1
70
9,877
Tobi Weißhaar retweeted
Sam Curry (@samwcyo) profile picture
Sam Curry
@samwcyo3 Jan 2023
Super excited to release our car hacking research discussing vulnerabilities affecting hundreds of millions of vehicles, dozens of different car companies: samcurry.net/web-hackers-vs-… Contributors: @_specters_ @bbuerhaus @xEHLE_ @iangcarroll, @sshell_ @infosec_au @NahamSec @rez0__
Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche,...

Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche,...

While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn't resist poking at the scooter's mobile app. To our surprise, our...

samcurry.net
58
715
84
1,934
342,310
Tobi Weißhaar retweeted
shubs (@infosec_au) profile picture
shubs
@infosec_au21 Sep 2022
My colleague @TheGrandPew discovered a pre-authentication remote command execution vulnerability in Atlassian Bitbucket. You can read his writeup here: blog.assetnote.io/2022/09/14… -- this blog post goes into the root cause analysis for why this was possible.

Breaking Bitbucket: Pre Auth Remote Command Execution (CVE-2022-36804)

Pre-auth RCE in Bitbucket Server (CVE-2022-36804) via command injection in the repository archive download endpoint.

slcyber.io
4
86
3
285
Tobi Weißhaar retweeted
Sam Curry (@samwcyo) profile picture
Sam Curry
@samwcyo21 Sep 2022
New blog post detailing some findings from auditing the Next.js ecosystem: "Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library" Huge thanks to @infosec_au and @bbuerhaus for helping explore this! samcurry.net/universal-xss-o…
Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library

Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library

On August 24th, 2022, we reported a vulnerability to Netlify affecting their Next.js "netlify-ipx" repository which would allow an attacker to achieve persistent cross-site scripting and full-respo...

samcurry.net
10
182
2
529
Oauth account takeovers are as old as Oauth itself. However, with time, websites got secured to typical attacks. In 2022, we see a new wave of attacks. @samm0uda found such an account takeover on Facebook and he got $45k. Enjoy my explanation! youtu.be/pk7oYuz4x0Q
1
59
1
186
Tobi Weißhaar retweeted
PT SWARM (@ptswarm) profile picture
PT SWARM@ptswarm14 Jul 2022
💥 New attack! Our researcher Arseniy Sharoglazov discovered a PHP's Arbitrary Object Instantiation with no user-defined classes. It was turned to RCE! Read the research: swarm.ptsecurity.com/exploit…
Image from PT SWARM (@ptswarm)
5
241
7
615
Tobi Weißhaar retweeted
shubs (@infosec_au) profile picture
shubs
@infosec_au6 Jul 2022
Really well written post by @fransrosen on breaking OAuth implementations through postMessage gadgets that leak URLs. Awesome research, I loved following the journey. Totally worth the time it took you to do this. @avlidienbrunn is a great sounding board. labs.detectify.com/2022/07/0…
Account hijacking using "dirty dancing" in sign-in OAuth-flows

Account hijacking using "dirty dancing" in sign-in OAuth-flows

Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens...

labs.detectify.com
2
61
232
Load more