- Tweets 80
- Following 436
- Followers 17
- Likes 1,146
Do you still stand by this, now that we have CVEs, kernel 0days dropping left, right and center these days?
@mitchellh
Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
3
2
52
41,832
Ujjwal retweeted
Most common failure: not starting.
2nd most common failure: not persisting.
3
24
155
"Think about what you want today and you'll spend your time.
Think about what you want in 5 years and you'll invest your time."
–@JamesClear
1
Ujjwal retweeted
If you want a good podcast about #hacking stories, listen to @DarknetDiaries.
30
190
888
Ujjwal retweeted
I don't normally RT my own tweets, but this scam is off the hook right now. Just had a good friend and security expert fall for the Zelle fraud scam. The phishers initiated 2 unauthorized purchases on his credit card, then spoofed an SMS from his bank about fraudulent charges.
The Zelle fraud scam is rampant. You get an SMS about a suspicious Zelle transfer from "your bank." If you respond you get callerID spoofed scam call. To "verify your ID" they ask for your username. Then they password reset & ask you to read back the code krebsonsecurity.com/2021/11/…
18
423
543
Ujjwal retweeted
Don’t make the mistake of confusing productivity with busyness. Doing lots of stuff in a visible manner does not mean you’re being productive.
High-Quality Work Produced = (Time Spent) x (Intensity of Focus)
azeria-labs.com/the-importan…
7
47
282
Ujjwal retweeted
🎉🎉🎉Giving away one
@PentesterLab subscription valid for
🔥🔥 3 months 🔥🔥
Will select a random person from the retweets .
Thanks to the person who gave it to me to share with the community 🙏
77
363
269
"If what you do can be automated you've already lost" 👌🏻
I'm sure there are exceptions to this though
Dupe or can’t find any bugs? Be ready to experiment, fail & try again. if you do the same thing / follow the same methodology use the same tools, as everyone else, you will end up with the same result as everyone else. If what you do can be automated then you have already lost.
1
4
Ujjwal retweeted
My fuzzer for the iOS kernel networking stack is now open source! You can read the implementation details here: googleprojectzero.blogspot.c…
11
304
999
Ujjwal retweeted
I think this video is the most comprehensive coverage of the sudo Heap Buffer Overflow CVE-2021-3156.
We talk about discovery through fuzzing and code review, the bug analysis and finally exploitation.
piped.video/watch?v=TLa2VqcG…
7
59
235
Ujjwal retweeted
Every time I feel imposter syndrome creeping up on me, I look at this pic and try to change my mindset to the one this dude has. Pretty healthy mindset in my opinion.
12
52
381
Ujjwal retweeted
I am planning to mentor (not spoon-feed) Five folks who are new into Application Security/Penetration Testing/Bug Bounty, etc.
Cost: Pay it Forward [Free]
Comment in this thread about the following:
- Why you need mentorship?
- Your Career Goals
(1/2)
#bugbounty #infosec
154
139
353
Ujjwal retweeted
I’m giving out 40 PentesterLab PRO licenses. I hope you all have a great Christmas. Just comment why you think you should have one and I’ll pick some people. Stay frosty.
647
163
855
Ujjwal retweeted
@PentesterLab wants to give back to the community by helping a few people, if you know someone who could benefit from access to PRO, please share:
forms.gle/ppSHZcHvZCNRxVRXA
I will pick a few people next week. There is no right or wrong answers, just be honest.
6
40
76
Ujjwal retweeted
I didn't get here alone. I found these bugs because I have spent my life surrounded by amazing people willing to help me get where I am. As such, I want to give back. I'm putting up 10 3-month subs for @PentesterLab and they've graciously offered to match me! Reply below to enter
Yay, I was awarded a $33,000+$8,250 bounty on @Hacker0x01! hackerone.com/daeken #TogetherWeHitHarder
200
26
231
Ujjwal retweeted
📢 ASPIRING HACKERS! Want to learn to hack? Since it's virtual anyways, we're opening our Fall 2020 ASU Computer Systems Security / CTF course to the WHOLE WORLD! More info, including lecture times, youtube/twitch/presentation links, and practice problems: pwn.college
9
305
738
Ujjwal retweeted
📢ASPIRING HACKERS! A bit lost in the first pwn.college challenge set? We've pushed some more context (and an additional video) here: pwn.college/modules/suid
4
25
Hey @snyff
Is there a forum where I can get help for one of the challenges in pentesterlab. I can't figure out what I might be doing wrong even though my soultion is very similar to the one in video
1
1