security ninja wannabe Mastodon: @koto@infosec.exchange
- Tweets 5,736
- Following 388
- Followers 8,672
- Likes 3,530
koto retweeted
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥
The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇
gmsgadget.com/
1/4
12
172
456
43,577
koto retweeted
We're sending a HUGE thank you to our incredible community of bughunters ! 🙏 Your passion for finding vulnerabilities keeps our users safe 🔒 To show our appreciation, we awarded over $380,000 in bounties this week, including the largest reward ever given in Google VRP history!
5
35
386
23,958
Co do jasnej cholery żeby nie napisać dosadniej.
Co tu się dzieje? Poseł PiS Andrzej Adamczyk mówi w kontekście grupy Dragon sector, która ujawniła machinacje przy pociągach Newagu, o złodziejach i napadzie na dom. Potem posłowie PiS i PO nie chcą słuchać co ustalił Dragon sector i głosują za przerwaniem posiedzenia komisji. To po co ta komisja?
cc: @PolaMatysiak @Zaufana3Strona @niebezpiecznik @Sekurak
22
27
416
23,901
koto retweeted
Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspiration? Check the video below in which @kkotowicz and @SecurityMB talk about Google VRPs!
piped.video/watch?v=R2qMd4PZ…
11
62
5,473
Pretty cool exploit chain with the redirects. The writeup is also excellent, and the "screenshots" being actually interactive? 🤯
Thanks a lot for the research, @rebane2001!
Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
lyra.horse/blog/2024/09/usin…
4
11
3,647
koto retweeted
If anyone is following the NEWAG vs Dragon Sector case, this article (in PL, but, well, 2024, google translate) is a really good read about the actual lawsuit and the first day of trial.
Second day of trial will be on Jan 15, so there's some time for sides to file more stuff.
[PL] Świetny artykuł z aktualnego stanu sprawy, polecam :) (analiza pozwu przeciwko nam i trochę pierwszej rozprawy)
oko.press/newag-hakerzy-drag…
15
57
8,990
XSS in Gmail is now $20k (or 50% more for exceptional quality report). Good thing we don't have XSSes anymore.... Or do we? :)
🚨💰 Google VRP Reward Update 💰🚨 Good news, we are significantly increasing the reward amounts offered by the Google VRP! Look out for up to 5x higher payouts and a maximum reward of $151,515! Details here:
bughunters.google.com/blog/5…
1
6
57
8,478
koto retweeted
It's finally happened! NEWAG IP Management just sued us for copyright infringement and unfair competition.
Here's a symbolic picture of the lawsuit as a whole: Newag quoting q3k's own code as supposedly their IP :)
More: infosec.exchange/@q3k@hacker…
14
76
495
82,000
koto retweeted
So NEWAG (context: media.ccc.de/v/37c3-12142-br…) finally filed a lawsuit against members of @DragonSectorCTF / SPS. It took them a few months from when they said they'll do it, and apparently there were some snafus with addresses, but here we are.
1/n🧵
Pamiętacie sprawę Newagu i pociągów, których nie można było uruchomić z powodu zmienionego oprogramowania? 🚄
Sprawa się rozwija, choć w zaskakującym kierunku.
Firma Newag bowiem pozwała informatyków z @DragonSectorCTF (@dsredford ) i firmę SPS o naruszenie praw autorskich 🍿
Rozumiecie, z informatyków, którzy odkryli metodę działania producenta i wprowadzone zmiany oprogramowania (blokada symulująca awarię sprężarki, blokada zatrzymującą pociąg w określonych lokalizacjach itd.) firma próbuje zrobić winnych.
Myślę, że już najwyższa pora by tematem problemów z pociągami firmy @NewagSa zajęła się Komisja Infrastruktury. Zgłaszam temat do planu pracy komisji.
Chłopaki, trzymajcie się!
#dekompilacja
1
18
74
18,880
koto retweeted
@LinkedIn says no to DOM XSS by enforcing Trusted Types! Congratulations to @shafigullin for this achievement 🎉
4
11
1,148
koto retweeted
It took us a while but jQuery 4.0.0 beta is out now: blog.jquery.com/2024/02/06/j…
1
5
1,695
koto retweeted
Ever wondered how to increase your bug bounties 💸 ? Our latest blog post introduces our domain tiers security concept and how it is applied at Google, and includes a list of Google's highest sensitivity domains.
bughunters.google.com/blog/4…
1
28
103
11,277
See how Google's security engineering team handles rollouts at scale, so we can safely enforce Strict CSP, Trusted Types and other security features on 100s new services yearly.
bughunters.google.com/blog/5…
1
38
71
14,163
koto retweeted
Mozilla decides Trusted Types is a worthy security feature dlvr.it/T0QwgP
1
11
18
4,891
koto retweeted
Mozilla has changed their standards position on Trusted Types to positive 🎉
2024 will be a bad year for DOM-based XSS.
github.com/mozilla/standards…
1
34
80
21,241
koto retweeted
A few deprecations shipped in Chrome 120.
Data URLs in SVG <use> is now blocked.
chromestatus.com/feature/512…
CSP Embedded Enforcement's implicit opt-in for same-origin iframes is gone.
chromestatus.com/feature/509…
2
7
45
10,366
koto retweeted
So I'm starting a Youtube Channel 😄 Join me today at 19:00 CEST (in other words: in three hours) when I'll talk about 10 highlights from my bug hunting career:
piped.video/watch?v=utz3SHit…
5
23
88
25,360
koto retweeted
Mastodon、RCEとXSSのセキュリティ修正があります。
それに関連してRubyの「sanitize」というgemのHTMLサニタイザーのバイパスも修正されています。
github.com/rgrove/sanitize/s…
Mastodon fixes critical “TootRoot” vulnerability allowing node hijacking
arstechnica.com/?p=1951981&u…
14
56
19,975
