Recent searches

No recent searches

Search options

Only available when logged in.
det.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon Server des Unterhaltungsfernsehen Ehrenfeld zum dezentralen Diskurs.

Administered by:

Server stats:

1.8K
active users

det.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.3

#infosec

444 posts150 participants17 posts today
Xavier «X» Santolaria :verified_paw: :donor:<p>🔥 Latest issue of my curated <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> and <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> list of resources for week #33/2025 is out!</p><p>It includes the following and much more:</p><p>🗓️ 🩹 August Patch Tuesday;</p><p>🇺🇸 🇷🇺 U.S. government seized $1 million in <a href="https://infosec.exchange/tags/Bitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bitcoin</span></a> from Russian ransomware gang;</p><p>🤖 🔓 OpenAI's GPT-5 has faced backlash for poor performance in security and safety;</p><p>📂 🔓 <a href="https://infosec.exchange/tags/WinRAR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WinRAR</span></a> vulnerability exploited;</p><p>🧨 New MadeYouReset HTTP/2-based DDoS Attacks;</p><p>🎣 ✈️ Booking.com phishing campaign uses sneaky 'ん' character to trick you;</p><p>📨 Subscribe to the <a href="https://infosec.exchange/tags/infosecMASHUP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosecMASHUP</span></a> newsletter to have it piping hot in your inbox every week-end ⬇️</p><p><a href="https://infosec-mashup.santolaria.net/p/infosec-mashup-33-2025" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec-mashup.santolaria.net/</span><span class="invisible">p/infosec-mashup-33-2025</span></a></p>
Laurent Cheylus<p>OpenSSH Post-Quantum Cryptography - OpenSSH 10.1 will warn the user when a non post-quantum key agreement scheme is selected, can be disabled with "WarnWeakCrypto" option <a href="https://bsd.network/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://bsd.network/tags/Cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cryptography</span></a> <a href="https://www.openssh.com/pq.html" rel="nofollow noopener" target="_blank"><span class="invisible">https://www.</span><span class="">openssh.com/pq.html</span><span class="invisible"></span></a></p>
Shodan Safari<p>ASN: AS12167<br>Location: Dallas, US<br>Added: 2025-08-14T21:39</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Cryspen<p>How do we prove our cryptography is secure? 🧐</p><p>Join a talk by our Chief Researcher, Karthikeyan Bhargavan, on the rise of formally verified crypto! Learn how libraries like HACL* &amp; libcrux are securing Firefox, Signal &amp; OpenSSH with formally verified guarantees, even against quantum computers. 🛡️</p><p>We'll cover recent breakthroughs, challenges, and a vision for verifying giants like OpenSSL.</p><p><a href="https://ioc.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptography</span></a> <a href="https://ioc.exchange/tags/formalverification" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>formalverification</span></a> <a href="https://ioc.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://ioc.exchange/tags/PQC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PQC</span></a> <a href="https://ioc.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> </p><p><a href="https://cfp.openssl-conference.org/openssl-conference-2025/talk/NPWQHG/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cfp.openssl-conference.org/ope</span><span class="invisible">nssl-conference-2025/talk/NPWQHG/</span></a></p>
Shodan Safari<p>ASN: AS12322<br>Location: Saint-Étienne, FR<br>Added: 2025-08-14T17:46</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS132300<br>Location: Bangkok, TH<br>Added: 2025-08-14T20:21</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
BobDaHacker 🏳️‍⚧️ | NB<p>🎢 Hacked South Park's Casa Bonita. Could access their entire POS system and see all customer payments/tips and more 😬</p><p>Technical details:</p><ul><li>Founders Club admin panel: No auth required, all member emails exposed</li><li>POS registration: Form disabled client-side only, API endpoint still functional</li><li>Reservation enumeration: Sequential IDs exposed full customer data</li><li>Full control over customer tabs, payments, and inventory</li><li>Supabase misconfiguration: Public signups triggered automated membership cards</li></ul><p>No security.txt anywhere. Had to email parkcounty.com addresses then get help from my friend whose company partners with South Park.</p><p>Fixed fast but never thanked me. Got a Founders Club card 6 months later though, because the system automatically sends them 😂</p><p>Full Technical Writeup: <a href="https://bobdahacker.com/blog/i-hacked-southpark" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">bobdahacker.com/blog/i-hacked-</span><span class="invisible">southpark</span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/bugbounty" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bugbounty</span></a> <a href="https://infosec.exchange/tags/responsibleDisclosure" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>responsibleDisclosure</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/southpark" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>southpark</span></a> <a href="https://infosec.exchange/tags/CasaBonita" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CasaBonita</span></a></p>
BobDaHacker 🏳️‍⚧️ | NB<p>🍔 Found huge security flaws in McDonald's - crew members could access sites reserved for corporate employees with internal functions, API keys exposed, and more. Had to call their HQ and pretend to know people just to report it 🤦</p><p>Technical details:</p><ul><li>Design Hub: Used to be client sided password, Registration endpoint exists and works even tho they dont want signups</li><li>TRT portal: Crew accounts could enumerate/impersonate all employees from general manager to CEO</li><li>GRS panel: Complete authentication bypass, arbitrary HTML injection</li><li>Magicbell API keys/secrets exposed in client-side JS</li><li>Algolia indexes listable with user PII</li><li>CosMc's: Server-side validation missing for coupon redemption</li></ul><p>They fixed it but fired my friend who helped find the OAuth vulnerabilities.</p><p>Full Technical Writeup: <a href="https://bobdahacker.com/blog/mcdonalds-security-vulnerabilities" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">bobdahacker.com/blog/mcdonalds</span><span class="invisible">-security-vulnerabilities</span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/bugbountry" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bugbountry</span></a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>responsibledisclosure</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a></p>
Shodan Safari<p>ASN: AS4134<br>Location: Shenzhen, CN<br>Added: 2025-08-13T21:18</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Mike Sheward<p>Mini Pen Test Diaries story, happened in the last couple of years. The debrief meeting went like this:</p><p>“In your report you said you we’re able to crack the domain admin account instantly because the password was stored using the LM hash?”</p><p>“That’s right, yes.”</p><p>“But we’ve had LM hashing disabled for like 15 years, that can’t be possible?!”</p><p>“When was the last time that password was changed?”</p><p>“Well it’s been the same since I got here, 20 years ago.”</p><p>“And what hashing mechanism do you think was used back then?”</p><p>“Oh no."</p><p>For more, less mini stories like this, check out <a href="https://infosecdiaries.com" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">infosecdiaries.com</span><span class="invisible"></span></a>.</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pentest</span></a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pentesting</span></a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>redteam</span></a></p>
Dumb Password Rules<p>This dumb password rule is from Coventry Building Society.</p><p>Password has to be between 6 and 10 characters, can't contain any punctuation and you have to give characters from it on the phone to confirm identity.</p><p><a href="https://dumbpasswordrules.com/sites/coventry-building-society/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">dumbpasswordrules.com/sites/co</span><span class="invisible">ventry-building-society/</span></a></p><p><a href="https://infosec.exchange/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>password</span></a> <a href="https://infosec.exchange/tags/passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>passwords</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/dumbpasswordrules" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dumbpasswordrules</span></a></p>
Elias Mårtenson<p>The <a href="https://functional.cafe/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> product universe is weird. They sure are into trying to sell magic bullets. What in the world is "AI boot verification"?</p>
Shodan Safari<p>ASN: AS24940<br>Location: Falkenstein, DE<br>Added: 2025-08-14T09:41</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS132203<br>Location: Singapore, SG<br>Added: 2025-08-12T20:46</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS11525<br>Location: Greenwood, US<br>Added: 2025-08-14T05:13</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS29802<br>Location: New York City, US<br>Added: 2025-08-14T18:24</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS48551<br>Location: Shiraz, IR<br>Added: 2025-08-15T01:09</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS29119<br>Location: Aranda de Duero, ES<br>Added: 2025-08-15T01:18</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS17996<br>Location: Sleman, ID<br>Added: 2025-08-14T04:07</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Shodan Safari<p>ASN: AS16276<br>Location: Calais, FR<br>Added: 2025-08-12T23:23</p><p><a href="https://infosec.exchange/tags/shodansafari" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>shodansafari</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
TrendingLive feeds
About