Shmethical #Hacker. #Research mucky-muck at @runzero. #Election Judge. #CVE bagman. #Metasploit collaborator. Briefly a fed. #FriendofDeSoto. #Podcaster #fedi22-findable
All subpoenas, warrants, contracts, and other linguistic puzzles should be directed to my attorney, @hotdogitsclaire.
I post here for me, mostly around #infosec / #cybersecurity. Sometimes I post work stuff.
Attending #BSidesLV has been pivotal for my career. In that spirit, I'm giving away a free pass to a student or someone early in their cyber career for the event on Aug 4-6, 2025.
If you'd like to be considered, please send me a direct message explaining why attending would be meaningful for you.
@Viss oh great now I learn this. After I gave OnlyFans my driver license. Which they’re probably going to use to buy beer.
@mttaggart yeah that’s fair. I repeatedly make the mistake of demeaning CTF challenges as “mere” “puzzle solving.”
Puzzles are extremely difficult to design well, and well designed puzzles and require loads of skill to solve.
@mttaggart I'd not expect very casual users to care enough to commit a change.
oh and the Nuclei scraping only looks at those with CVE IDs, none of their other stuff. There's like 11k templates in there, only 3k or so that are named for a CVE. No reason why you couldn't look at the rest, of course.
(without the date limiter, you get a lot of very old Metasploit modules at the top -- psexec is number 1 with 150 commits, for example, and MS17-10 and MS08-067 are numbers two and three.)
Something like 10 years ago, I noticed that if you looked at the commit counts on #Metasploit modules, you'd get a good idea of what modules people were actually using and wanting to improve. The idea being, these were modules that pentesters were actually using on site, and something about them bugged someone enough to put in a fix (maybe a missing target, or more options, or whatever).
I just looked again today after a conversation with @sawaba, and also looked at #Nuclei templates. Here's the top 10 of each, limited to the last 5 years worth of commits, excluding GitHub actions.
Whatcha think? Interesting?
exploits/multi/http/papercut_ng_auth_bypass.rb 38
exploits/multi/http/open_web_analytics_rce.rb 37
exploits/windows/local/bits_ntlm_token_impersonation.rb 37
exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb 32
exploits/linux/local/sudo_baron_samedit.rb 31
exploits/unix/webapp/openmediavault_rpc_rce.rb 29
exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb 28
exploits/linux/http/empire_skywalker.rb 28
exploits/multi/http/log4shell_header_injection.rb 26
exploits/windows/http/exchange_proxylogon_rce.rb 26
./http/cves/2019/CVE-2019-17382.yaml 27
./http/cves/2021/CVE-2021-40822.yaml 27
./http/cves/2023/CVE-2023-27034.yaml 27
./http/cves/2021/CVE-2021-43798.yaml 27
./http/cves/2023/CVE-2023-32243.yaml 27
./http/cves/2021/CVE-2021-40870.yaml 26
./network/cves/2016/CVE-2016-3510.yaml 26
./http/cves/2021/CVE-2021-28164.yaml 26
./network/cves/2020/CVE-2020-1938.yaml 26
./http/cves/2022/CVE-2022-23854.yaml 25
@neurovagrant update: After several tries, I now have a verified OnlyFans account.
https://onlyfans.com/sudo_whoami
Now to figure out livestream
@rk it was open today? Weird.
I first learned about Juneteenth when I moved to Texas.
It’s a pretty great federal holiday.
Matt Blaze (not shown) continues to do the lord’s work in debunking 2024 #election conspiracy theories.
Yes, he’s irascible. He is unkind to people pushing democracy-eroding narratives. I fully appreciate his frustration.
It’s a classic pattern in social media: the effort it takes to push poisonous narratives - especially when unwitting - is trivial compared to the effort it takes to patiently refute and debunk. Again, and again, and again.
(FWIW, I investigated the 2024 election stealing / vote flipping claims, and I promise you, it’s nonsense.)
@CppGuy @mhoye Yeah this is a nonsense article. The pull quote attributed to “researchers” is especially weird.
Yo @cybernews, cite any source.
Edit: Gossi the Dog says it's just a repackaging of previously leaked data. The warning sign I mentioned turned out to be worth listening to.
https://cyberplace.social/@GossiTheDog/114712265317709512
The story is on lots of well-known sites:
https://cybernews.com/security/billions-credentials-exposed-infostealers-data-leak/
But the reports point out that it's impossible to say how much the datasets overlap, and therefore whether the number of compromised amounts is really anything like 16 billion.
Most of the reports seem to be derived only from Cybernews, which is a warning sign.
I hope people take the right lesson from this. Mastodon GmbH was all ready to go on a new ToS, people flipped out, they backed off and will reassess.
Notably, Mastodon GmbH did not dig in, double down, nor fight back. Simple, clear, mea culpa language.
Not everything needs to be a fight. It’s okay to be wrong sometimes.
This is how we do it.
https://www.tiktok.com/@simonhennescenes/video/7382989241329945889?lang=en
https://mastodon.social/@mcc/114710875472699375
If you repeat this stuff, you are a bad person. You’re either choosing not to use your brain’s most basic critical thinking functions, or you’re deliberately spreading disinformation. I think less of you either way. Stop it.
Picard management tip: Share the credit. Take the blame.
For those with an interest in the cybersecurity of enterprise IoT, the UK gov wants to hear from you (even if you aren't UK-based): https://www.gov.uk/government/calls-for-evidence/call-for-views-on-enterprise-connected-device-security. You don't need to be a policy pro or lawyer, or representing your employer; if you have relevant info to share, they want to hear from you. Consultation closes on 7/7.
I have only anecdotal evidence, but I feel like iOS autocorrect is being more aggressively wrong lately. Correcting we’ll to well, border to boarder, and Tod to Today are three pretty consistent examples.
This a known thing? Right now I’m on iOS 18.5 (22F76).
