0xad

6 ms·

1.
by 0xad 22d ago
Binvisio from cortesi and cantordust from domas being already mentioned, I’m surprised I haven’t seen this yet: https://lcamtuf.coredump.cx/newtcp/
2.
by 0xad 2mo ago
Yes, but (always but !) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed inciden
3.
Show HN: Comparing stock returns after cyber incidents(incidentimpact.com)
5 points by 0xad 2mo ago|3 comments
4.
by 0xad 5y ago
If you don't see the difference between proprietatory format like docx and you argue that just because I add double-asterisk with a word in-between then suddenly it's not plain-text file (since it's markdown markup at this po
5.
by 0xad 5y ago
I think it does. By transforming file Foo.docx into file Bar.b64 you get a plain-text file (Bar.b64) but Foo.docx still isn't plain-text. That's actually how email attachments work (transforming any file into b64 plain-text file
6.
by 0xad 5y ago
No. Open up a word document (.docx) in hex editor (head -80 foo.docx | xxd) and you'll see it's not a plain file on a binary level. Now do the same with any python, php, html, and js files and you'll see that they're pla
7.
by 0xad 5y ago
Here's one: If you want your operations to be as easy as they can be (LAMP), go with PHP.
8.
by 0xad 5y ago
By original do you mean Hovav's? Then no, it's 2008. But I'd argue that Borrowed Code Chunks exploitation technique paper by stealth from 2005 is the original. But maybe I'm just too old.
9.
by 0xad 6y ago
You can use grammarinator or any other of myriad grammar fuzzers BUT I'd start with radamsa and its string-related flags. Radamsa is _awesome_, you run it on an input and you get mutated output. Works both for binary files and text fle
10.
by 0xad 6y ago
OP here. I'm planning to do so, however it will require more work (better description of the problem, wider description of viable solutions, additional case studies). Most probably it will land on Medium and Dev.to.
11.
by 0xad 6y ago
Yes you will, but only because GitHub already recognised this class of problems and came up with their own solution [1]. Bear in mind that it works only for vendors that integrated, so while it's true for AWS it might not be for your F
12.
by 0xad 6y ago
Hey, OP here. I agree that a blog post would be more readable. In this particular case I just didn't expect that it will catch fire. If I would then I would spend more time on the form. I won't make that mistake again (i.e. in the
13.
by 0xad 6y ago
Cool! Thanks for explanation.
14.
by 0xad 6y ago
Greetings fellow Hackers! OP here. I see that my experiment got some traction which means more awareness should be spread about this class of bugs. For starters I recommend reading "How Bad Can It Git" [1] and "Detecting and
15.
by 0xad 6y ago
Awesome, thanks for the background information!
16.
by 0xad 6y ago
You mean adversaries? No. For token generation I used https://canarytokens.org/ so the only information I got was abou triggering the token, but not the context in which it was triggered. BTW. GitHub (apart from GitGuardian
17.
by 0xad 6y ago
Thanks!
18.
What will happen when you commit secrets to a public Git repo?(twitter.com)
133 points by 0xad 6y ago|64 comments
19.
by 0xad 8y ago
What AFL needs is _instrumentation_ and of course the easiest way is to get that at compilation step, however you are not constrained by anything to get that part via other means. Check https://github.com/ivanfratric/
20.
by 0xad 8y ago
Great article. Kudos. On a side node, my old project https://github.com/dyjakan/interpreter-bugs along with short presentation I did on WarCon 2017 https://github.com/dyjakan/conference-talks/
21.
by 0xad 8y ago
And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
22.
External Third-Party Resources and Your (Web) Application(blog.sigsegv.pl)
1 points by 0xad 8y ago|0 comments