🇧🇷 Full-time Security Ninja since 2007. I have Shuriken throwing stars in my tool chain. 🇩🇪
Germany
Joined March 2011
- Tweets2.2K
- Following167
- Followers3.6K
- Likes4.5K
Pinned Tweet
In my web security training I often get asked for multi context payloads. This is the one I've created and learned to love in the past 10 years. Try yourself with @owasp_juiceshop by @bkimminich #bugbounty #hacking #juiceshop #owasp #hackerone #Security #WordPress #number23
Dave Vieira-Kurz retweeted
During a recent code review I noticed something in the VSCode Language Server JSONRPC implementation that made my brain tingle.
Why not investigate this on stream? Maybe we find nothing, maybe we find something useful.
twitch.tv/liveoverflow
Dave Vieira-Kurz retweeted
DroppedConnection - a fake VPN server that captures credentials and executes code via the Cisco AnyConnect client.
research.nccgroup.com/2023/0…
Dave Vieira-Kurz retweeted
A prototype @Burp_Suite extension for Enterprise/Pro using the new Montoya API. Leverages the Google Safe Browsing API to check that any URLs in the enumerated site map aren't known to be malicious.
Help detect those watering holes!
Code 👇
gist.github.com/olliewuk/c51…
[1/2]
Dave Vieira-Kurz retweeted
New blog post and updated #binaryninja plugin: "Statistical Analysis to Detect Uncommon Code" We use statistics to identify obfuscation in an #Anticheat, a mobile DRM, a #Windows kernel module & malware.
Link: synthesis.to/2023/01/26/unco…
Code: github.com/mrphrazer/obfusca…
I can highly recommend to work with @moritzj
Dave Vieira-Kurz retweeted
Wait... they never fixed that?? 🤣 httpd.apache.org/security/vu…
ALT moderate: mod_dav out of bounds read, or write of zero byte (CVE-2006-20001) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. Described in first edition of "The Art of Software Security Assessment" 2006-10-31 Reported to security team 2022-08-10 Update 2.4.55 released 2023-01-17 Affects <=2.4.54
Dave Vieira-Kurz retweeted
Someone criticized us for using "the LGBTQ flag" in this artwork (made by @Nico_n_art), and said they would not follow vx-underground if we supported "the homosexual agenda".
We have decided to make that our entire theme for the time being.
Dave Vieira-Kurz retweeted
tl;dr Threat Actors don't need malicious documents, they just need Google ads and a stolen credit card
xitter.cf/vxunderground/status/1…
As Microsoft tightens loose ends and macro-based malware droppers become more difficult for Threat Actors to leverage - data traffickers are increasingly abusing SEO poisoning and/or malvertising.
Intel via @malwrhunterteam & @wdormann
Dave Vieira-Kurz retweeted
"deepce: Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)"
#infosec #pentest #redteam
github.com/stealthcopter/dee…
The Mailchimp Security team identified an unauthorized actor accessing one of the tools used by Mailchimp customer-facing teams for customer support and account administration.
#hacking #infosec #Mailchimp
More:
mailchimp.com/january-2023-s…
Dave Vieira-Kurz retweeted
I'm happy to announce the first keynote speaker at CanSecWest in Vancouver on March 22-24 will be Dino Dai Zovi (@dinodaizovi) who is always amazingly insightful. secwest.net
Dave Vieira-Kurz retweeted
The Department of Justice has announced the arrest of Anatoly Legkodymov. Legkodymov, the Founder and Majority Owner of Bitzlato Ltd, is accused of laundering more than $700,000,000 in illicit funds from ransomware groups and Hydra Marketplace
More info: justice.gov/usao-edny/pr/fou…
Dave Vieira-Kurz retweeted
The Billion Dollar Vulnerability Forcing a Major Fork On The Ethereum Chain
youtu.be/9VRft_-JEuk
Dave Vieira-Kurz retweeted
Pleased to share that I'll be delivering the keynote at the 10th Information Security Conference in Greece on Feb 22, 2023. My talk: "The Future of Cyber Security: Preparing for the Unforeseen"
#cybersecurity #infosec #futureofsecurity
Dave Vieira-Kurz retweeted
github.com/vitoplantamura/Bu… => „BugChecker is a SoftICE-like kernel and user mode debugger, supporting Windows versions from XP to 11, both x86 and x64)“ #SoftIce #Debugging #Oldschool
Dave Vieira-Kurz retweeted
I hacked a large company (70k+ employees) through social engineering. Legally of course.
• I set up the infrastructure
• Scraped names & emails with LinkedIn
• Sent 200 phishing emails.
I had access to their AWS console within 2 minutes.
And much more: