Re @cyb3rops @shad0wbits Problem is they didn’t test against APTs. But tested against a heat map.

Re @HackingLZ That’s what happens when vendor tries to hit the checkboxes and treats bad guys like a heat map.

Re @shantanukhande Might even be better for backdooring without having actual DPAPI / user creds.

Re @shantanukhande Probably not. If your plug-in just sends all credentials at given interval after installation.

Re @bishal0x01 @JoakimTauren Today is Friyay 💪

Re @NahamSec @JoakimTauren @securinti Shhht! 🤫 Don't give him ideas!

Re @hasan_zmzm @JoakimTauren Why always so evil? 😢

Re @JoakimTauren What's your next move?

Re @JoakimTauren 😯

🐮🐸

400 亿。

转发

转发微博

//@午后狂睡 :@上海发布 @上海徐汇发布 我想六院既然可以打赢新冠疫情下的洋人“丁丁保卫战”，应该也能打赢新冠疫情下的国人“伤腿保卫战”吧？

renew 查看图片

公司大部分情况下可以存在善意的谎言，但在关键问题上要勇于说真话。对于很多人而言，当面说出一句“我觉得你这件事做得不好，跟我预期的不一致”很难很难。大家愿意私底下跟别人抱怨，愿意埋在心底让这种不舒服的感觉持续发酵。我们应当首先就事论事表达自己的感受，其次说出预期，这样才能校准。

昨天看到六院公众号的这个文章，惊了

We are happy to announce we have received a complete copy of the @mal_share collection - courtesy of our friend @silascutler. We will make it availabl...

Re @jimmywalkers @TheHackersNews +1

CVE-2022-24803 Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used ...

CVE-2022-24802 deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Proto...

CVE-2022-27966 Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe f...

CVE-2022-27965 Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe fil...

CVE-2022-27964 Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe...

CVE-2022-27963 Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe fil...

CVE-2022-27052 FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with ele...

CVE-2022-27050 BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate pr...

CVE-2022-27049 Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive i...

CVE-2022-24758 The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can acc...

CVE-2022-24798 Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always fi...

CVE-2022-24791 Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when b...

CVE-2022-24796 RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardwar...

CVE-2022-24794 Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requir...

CVE-2022-24797 Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and promet...

CVE-2021-46439 The WinSEGAV AutoConfig service in EG Free Antivirus v2020 suffers from a local privilege escalation vulnerability, due to unquoted pat...

To think I grew up 2b bizniz magnet 🤩

RT SpaceX: Targeting Friday, April 1 for launch of our fourth dedicated smallsat rideshare mission; teams are keeping an eye on weather as the latest ...

Re @DriveTeslaca Yes, but we take a very cautious approach to safety. As we confirm functionality on Canadian roads, the beta will expand.

Re @HackingLZ Sexy af

Re @HackingLZ @shad0wbits @Dave_Maynor I wanted 3990, but typo’d.

RT sn🥶vvcr💥sh: Recently, I’ve had a need to run @harmj0y & @tifkin_’s great KeeTheft tool on a machine with EDR in place. Due to classic shell...

Its 2022 and default passwords are still one of the easiest high impact bugs you can find. 1. Locate Login Pannel(HTTP,SSH,Telnet,Etc) 2. Determine Te...

这种不听话应该喷点辣椒水什么的

Hacking C++，一份颇为全面的 C++ 速查表与信息图表。覆盖了算法、随机分布、序列、Lambda 表达式、设计指南等内容。地址：hackingcpp.com/cpp/cheat_sheets.html

转发微博 查看图片

这个形制还真不是哥萨克刀。胁差尺寸，直刃，十有八九是忍者刀。所以可能就是个俄罗斯中二青年……//@美人她爹: Bazuka

最近有一家车企在做类似尝试。猎头劝我去，我就劝猎头别劝我。这家公司也是好公司。不过技术日新月异，人性永远不会变  网页链接

Re @decoder_it @splinter_code How do we know this is a real and not a bunch of printf invocations? 🧐

Reflecting on Women's History Month for 2022: how far we've come; how far we still have to go. We're on board with @CISAJen 's push for "50% women in ...