Dave Vieira-Kurz
@secalert
Followers
4K
Following
5K
Media
27
Statuses
2K
🇧🇷 Full-time Security Ninja since 2007. I have Shuriken throwing stars in my tool chain. 🇩🇪
Germany
Joined March 2011
In my web security training I often get asked for multi context payloads. This is the one I've created and learned to love in the past 10 years. Try yourself with @owasp_juiceshop by @bkimminich #bugbounty #hacking #juiceshop #owasp #hackerone #Security #WordPress #number23
6
94
244
During a recent code review I noticed something in the VSCode Language Server JSONRPC implementation that made my brain tingle. Why not investigate this on stream? Maybe we find nothing, maybe we find something useful. https://t.co/X3ezcY4Uq3
3
10
82
DroppedConnection - a fake VPN server that captures credentials and executes code via the Cisco AnyConnect client. https://t.co/X8IlRj8BIt
7
179
440
A prototype @Burp_Suite extension for Enterprise/Pro using the new Montoya API. Leverages the Google Safe Browsing API to check that any URLs in the enumerated site map aren't known to be malicious. Help detect those watering holes! Code 👇 https://t.co/TO02ZJ1uAL [1/2]
3
17
41
New blog post and updated #binaryninja plugin: "Statistical Analysis to Detect Uncommon Code" We use statistics to identify obfuscation in an #Anticheat, a mobile DRM, a #Windows kernel module & malware. Link: https://t.co/AxDgMwgxmT Code: https://t.co/wWPTnvSflh
2
93
259
Someone criticized us for using "the LGBTQ flag" in this artwork (made by @Nico_n_art), and said they would not follow vx-underground if we supported "the homosexual agenda". We have decided to make that our entire theme for the time being.
55
78
1K
6
123
474
tl;dr Threat Actors don't need malicious documents, they just need Google ads and a stolen credit card https://t.co/zQHQhJRm4c
As Microsoft tightens loose ends and macro-based malware droppers become more difficult for Threat Actors to leverage - data traffickers are increasingly abusing SEO poisoning and/or malvertising. Intel via @malwrhunterteam & @wdormann
2
32
67
"deepce: Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)" #infosec #pentest #redteam
https://t.co/0paauFtOQF
3
70
212
The Mailchimp Security team identified an unauthorized actor accessing one of the tools used by Mailchimp customer-facing teams for customer support and account administration. #hacking #infosec #Mailchimp More: https://t.co/kKahsZTnQh
mailchimp.com
Maintaining our security commitment to our customers
0
1
3
I'm happy to announce the first keynote speaker at CanSecWest in Vancouver on March 22-24 will be Dino Dai Zovi (@dinodaizovi) who is always amazingly insightful.
secwest.net
CanSecWest2025_newtype LLM Safety and Information Security (April 24/25 2025)
0
2
10
The Department of Justice has announced the arrest of Anatoly Legkodymov. Legkodymov, the Founder and Majority Owner of Bitzlato Ltd, is accused of laundering more than $700,000,000 in illicit funds from ransomware groups and Hydra Marketplace More info:
justice.gov
BROOKLYN, NY – A complaint was unsealed this morning in federal court in Brooklyn charging Anatoly Legkodymov, a Russian national and senior executive of Bitzlato Ltd. (Bitzlato), a Hong Kong-regis...
4
61
169
The Billion Dollar Vulnerability Forcing a Major Fork On The Ethereum Chain https://t.co/LfsZMpWQmX
0
10
82
Pleased to share that I'll be delivering the keynote at the 10th Information Security Conference in Greece on Feb 22, 2023. My talk: "The Future of Cyber Security: Preparing for the Unforeseen" #cybersecurity #infosec #futureofsecurity
5
15
105
https://t.co/MV8r9Kxlk5 => „BugChecker is a SoftICE-like kernel and user mode debugger, supporting Windows versions from XP to 11, both x86 and x64)“ #SoftIce #Debugging #Oldschool
7
95
256
I hacked a large company (70k+ employees) through social engineering. Legally of course. • I set up the infrastructure • Scraped names & emails with LinkedIn • Sent 200 phishing emails. I had access to their AWS console within 2 minutes. And much more:
74
587
4K
1
1
8