Founder/CEO/Trainer/Researcher/CVE archeologist @PentesterLab. Security engineer. Bugs are my own, not of my employer...
☁
- Tweets 12,224
- Following 603
- Followers 20,648
- Likes 22,897
Pinned Tweet
As an engineer, I ❤️ clever engineering.
Ruby on Rails relies on signed sessions (AES GCM). They are secure, but there is a catch: you cannot invalidate them early. You have to wait for expiry. Workarounds exist, like caching sessions you want to kill, but nothing universal.
2
8
54
12,921
By age 30, You Should Have a Drawer with a Raspberry PI you don't use and a dozen USB cables.
479
976
14,056
I saw a guy reporting a vulnerability today.
No logo.
No website.
No drama.
He just emailed a write-up.
Providing all the details needed to reproduce and fix the issue.
Like a psychopath.
53
833
5,030
Get the latest Windows security enhancements on Linux with this one simple trick:
# chmod 755 /etc/shadow
21
236
1,226
This book has a lot of typos, a few sections that have definitely been written using AI but this takes the cake...
24
51
1,241
51,507
ALT Fake SMS someone spending 15k, "babe" thinks it's a ring (wedding). THen SANS logo
9
108
791
107,238
A lot of people working in infosec often forget how lucky they were that their passion became a job in high demand...
33
85
766
I know sex is great but have you ever shell'd a company after they insisted the pentest was a waste of time...
24
52
723
Metasploit is written in Ruby.
#infosec: we should all learn Python.
40
49
709
162,510
Just popped a shell?
Run this command to increase the impact of your finding:
export PS1="# "
#bugbountytips
7
78
596
Charlie Light
Cyber security students be like:
"If I win the lottery, I’m not telling anyone. But there will be signs."
11
45
450
42,761
The world needs an old-school CTF...
So far the challenges are:
- Read this 5.25" floppy
- Read this 3.5" floppy
- Burn a CD
- Crimp your own ethernet cable
- Deploy a Peg DHCP server (tools.ietf.org/html/rfc2322)
- Connect to this token ring network
Anything else?
200
74
432
Unpopular opinion:
No one will be work as a "pentester" in a few years.
People will perform pentest as part of their job as a security engineer, appsec engineer or redteamer.
It has already started.
55
52
413
$20K/mo is where your hacker life changes the most.
•Stop beg bounty.
•Buy one of the VPNs advertised by your favorite influencer.
•Start hacking from an iPad Pro.
•Go to BlackHat and RSA without speaking there.
•Buy SANS courses
19
11
377
41,251
Infosec: "People sucks at threat modelling"
Also infosec: "An attacker spends millions for a Super Bowl ad to get me to scan a QR code"
15
34
316
Too many people fall into the traps of gamification or certification, focusing on the wrong objectives.
Your goal should be to learn, not to be at the top of the leaderboard or merely to pass an exam.
[1/2]
9
67
331
100,888
9 years ago, between Christmas and New Year, I started what will become @PentesterLab
25
8
346
Blackhat swag as seen by people outside of infosec:
"This person is definitely a badass hacker".
Blackhat swag as seen by people in infosec:
"This person is most likely not doing any hacking".
15
26
312
TIL: How to exploit directory traversal in file upload with #curl using curl -F "file=@PentesterLab.jsp;filename=../../../../../../../../hacker.jsp"
2
112
339
Hackers: 25 years later.
Zero Cool manages a team of pre-sales engineers solving APT.
Acid Burn and Lord Nikon are both CISO.
Cereal Killer works for the government.
Joey Pardella is trying to cover up a security breach.
They are all #infosec thought leaders on twitter.
9
79
317
If you're looking for a job, try to blog regularly about CVEs (one you didn't find):
📚 You will learn so much
✍️ You will have something to show for it
🆓 It is completely free (unlike certifications🤔)
🎲 It removes the randomness out of your study/content (finding the bug)
7
37
280
59,956
Junior pentesters when a bunch of internal pentests gets allocated to the team
Stan Price
5
36
278
30,534
I’ve spent 2 solid hours doing bug bounty and I still haven’t made $200k.
Can someone tell me what I’m doing wrong?
#bugbountytips
32
15
285
27,097
Metasploit: $0
Exploiting known unpatched vulnerabilities: $0
Leveraging public security research: $0
Deploying 0-dayz to compromise random phones using public USB power charging stations: $3000000
Someone who is good at the economy help me budget this my APT group is dying.
3
42
256
“Hacking cannot be taught. Hacking can only be learned.”
(based on a quote from Mikhail Botvinnik about Chess)
8
53
257
For people being surprised to see so many security tools in the twitch leak...
This is what a modern security team looks like.
Less buying off-the-shelf tools, more building tools based on your actual needs.
🛠🧰💰
12
30
260
Do you want to find new vulnerabilities?
1. Look at the patch for a recent CVE (for example: CVE-2021-43350)
2. Write a @semgrep rule for them (tune your rule using the CVE you picked)
3. Scan a lot of code repository with this rule.
4. Manually confirm the matches.
4
64
255
When people subscribe to @PentesterLab, they give me two things... Their $ and their time, I can't refund the latter and that's why I try to provide a lot of value...
8
11
226
Between me and the @RedTeamVillage_ there should be around 2000 of those at defcon!
19
16
213
24,485
Pentesters: “Bug bounties involve too much grinding for unpredictable outcomes.”
Also pentesters: “I want to become a vulnerability researcher.”
8
20
196
19,269
You shout "Hack the planet"
but your behaviour screams
"Run a vulnerability scanner against Earth".
4
28
190
Unpopular opinion:
A lot of people stick to CTF instead of Bug Bounty or Vulnerability Research because it is a lot more comfortable.
Not easier, more comfortable, you know there is something to be found.
23
29
197
33,802
Give a man an open redirect, and you feed him for a day. Teach a man to chain open redirects with other bugs, and you feed him for a lifetime.
7
25
198
I remember trying to learn Linux by printing pages and pages of Mandrake/RedHat manuals and trying to read them...
THAT DID NOT WORK.
What worked?
Using Linux as my daily driver for months. It was hard, it was annoying, it was frustrating but this was the way.
16
11
179
Not that it matters but since I saw another tweet on this:
I have 0 CVE, 0 certification.
People judging others on CVE or certs are at best lazy, at worst downright stupid...
13
21
178
It's important to remember that some infosec influencers are not achieving much and that a few infosec people with < 100 followers are killing it.
10
17
172
If you have trouble keeping up with security research, security news, new technical content, make sure you check out: talkback.sh/ by @elttam
2
51
174
18,581
This one seems very relevant to security/hacking:
"It doesn’t matter if you’re a beginner or an expert as long as you’re on the path.
If a beginner is on the path, all they need is time.
If an expert is off the path, they won’t be an expert for long."
–@JamesClear
2
32
163
I'm lucky to be working on some of the hardest Computer Science problems of our time...
Like aligning text in CSS...
8
13
162
One of the cheapest and most efficient way to improve your infosec skills is to read code.
Literally, linux+vim+git on a raspberry pi with a 12” display is enough...
Read the code of opensource projects, tools you use, diff from advisories.
You don’t even need a browser!
5
22
156
"Do you need to learn to write code to get a job in infosec?"
Absolutely not! You need to learn to write code because that is one of the coolest things you can do with a computer.
8
21
146
I make a living teaching how to hack JWT, I will even run a workshop at Defcon on hacking JWT.
If you are a developer and your application uses JWT spend 5 minutes and watch this video!
Level up your #AppSec skills with our new video on JSON Web Tokens (JWT)!
Join us as we share six practical tips to enhance your security practices. Arm yourself with these insights today! Watch, learn, apply! 🔒🎥💡 piped.video/f6c0TeQSHDg
27
147
34,535
You can find the slides for my 2 workshops at DEFCON here: github.com/snyff/Talks
SAML_DEFCON_2023.pdf and JWT_DEFCON_2023
57
143
16,279
1. Take screenshot of desktop.
2. Use screenshot as screensaver/lock screen.
3. Leave laptop "unlocked" in public places.
4. Wait for outrage or LinkedIn thoughtleadership
3
7
136
I cooked a beef bourguignon today. After a few hours cooking, the meat is falling appart like a pentest boutique that just got acquired.
11
9
133
Slides from my talk at @Ruxmon on the insecurity of JSON Web Tokens slideshare.net/snyff/jwt-ins…
1
79
140
My kids think I have the best job:
My job is to send stickers to people all around the world.
15
4
133
