HAIJA INTEL REPORT

Happening TODAY! Join @jaredcatkinson & @JustinKohler10 at 1pm ET/10am PT for a discussion into Identity Attack Path Management in AWS, Entra Agent ID support, agentic AI security & the growing OpenGraph ecosystem. https:// ghst.ly/4h0yWPn

Break and Bypass - Tasting Menu Comment & Jump Technique UNION--%0ASELECT Info Disclosure Easy Wins /.git /.env /server-status /swagger.json SSRF Polyglot for Filters http://trusted.com@0177.0.0.1#@trusted.com JWT jku Trust Abuse Brute Bundle AfterMath Statistical, Broken Token J

Red teaming should produce findings security leaders can act on. @ne0nd0g , @andrewchiles & @_xpn_ will discuss aligning engagements to business risk, the impact of assumed breach & the difference between measuring and building detection & response. https:// ghst.ly/4qAYKEj

Doing vulnerability research & bug bounty using LLMs is like gambling.

I made some typos, I meant to say "more technical for nerds", and when I copied the C2 addresses for ILSpy I messed up the formatting. This was actually a kind of annoying payload to reverse because everything was so absurdly bloated and filled with junk. Anyway, that's what

Logic flaws are among the most underrated bug classes in bug bounties, as they usually remain undetected by scanners! From bypassing payment flows and exploiting race conditions to abusing permission profiles and manipulating multi-step workflows! Our guide covers how

If you're going to distribute malware, at least have the common courtesy to do it in a manner which allows EVERYONE to get the malware. Last time on Dragon Ball Z: I got over 9,000 DMs about a GTA VI video game leak circulating on torrent sites. Truthfully, I'm not up to date on

When you have malware on your computer, and you let your anti-virus remove it, this is who you're hurting. Happy now? Don't remove the malware. Malware is good

ICYMI: @_wald0 , @harmj0y & @CptJesus joined #KnowYourAdversary to take a look back at 10 years of BloodHound! Tune in & hear about how BloodHound has evolved in the years since it was first unveiled at #DEFCON in 2016. Listen to both parts https:// ghst.ly/3Kkoiob

Tool Tuesday: Rclone A legitimate tool for backing up and syncing data to the cloud, which is exactly why threat actors reach for it to steal yours. In our investigations, actors drop Rclone (often renamed) to exfiltrate gigabytes to MEGA, SFTP, or FTP just before ransomware.