Ben 'epi' Risher

462 Followers
391 Following
29 Posts

Interested in vulnerability research, rust, fuzzing, offensive security, llvm stuff, symbolic execution, and reversing.

In my spare (computer-related) time, I maintain feroxbuster and feroxfuzz as well as contribute to and/or maintain various other open source projects.

GitHubhttps://github.com/epi052
Bloghttps://epi052.gitlab.io/notes-to-self/
Twitterhttps://twitter.com/epi052

howdy!

I pushed a new feroxbuster release this morning! Notable changes:

--request-file for scanning based on a raw http request (e.g. from burp)

--limit-bars to cap the number of progress bars shown during a scan

--scan-dir-listings to recurse into dir listing enabled dirs

I also fixed the documentation site's search functionality and upgraded all the CI/CD pipelines.

docs: https://epi052.github.io/feroxbuster-docs/docs/

pre-built binaries are available on the releases page: https://github.com/epi052/feroxbuster/releases

Happy hacking!

Documentation

A fast, simple, recursive content discovery tool written in Rust.

feroxbuster

New #feroxbuster release!

Github user lavafroth added

--server-certs
--client-cert
--client-key

client-* options enable ferox to talk to servers that verify clients 🎉

server-certs allows you to verify unknown servers, instead of using --insecure

https://github.com/epi052/feroxbuster/releases

Releases · epi052/feroxbuster

A fast, simple, recursive content discovery tool written in Rust. - epi052/feroxbuster

GitHub

Howdy!

New version of feroxbuster is out🎉 The biggest change is in how auto-filtering is done. I'm keen to hear feedback on how it's working for you. If ferox doesn't correctly auto-filter your 404-like responses, let me know so we can make it better!

https://github.com/epi052/feroxbuster/releases/tag/v2.9.0

Release v2.9.0 · epi052/feroxbuster

What's Changed banner is shown again after exiting scan management menu by @aancw in #804 improved auto-filtering accuracy Fixed issue where a wildcard redirect caused every request to recurse int...

GitHub

7️⃣ Table-top an assumed breach and having to do a complete internal repo credential rotation.

Even the best sec strategy can fail, this process needs to be defined and practiced.

8/x

Fuzzing101 with LibAFL - Part I: Fuzzing Xpdf -

Part one of a series covering fuzzer development using LibAFL

#AdventOfCode Day 16: "Proboscidea Volcanium"

https://youtube.com/watch?v=rN4tVLnkgJU

By far the hardest challenge yet this year. I'll use a recursive algorithm with caching to walk a graph turning on valves in reasonable time. #python

Day 16: Proboscidea Volcanium [AOC2022 Python]

YouTube

🆕🦀 Just an hour ago, #rustlang 1.66.0 was released!

As usual, here's a thread with some of the highlights. 🧵

1/12

I've just discovered this fantastic blog series about Rust & LibAFL by @epi ! Thanks for sharing these 🍻 #security #BugBounty

For your first day on Mastodon, just a few humbly suggested steps! Welcome to the party!

1) Consider if you're on the server for you, your hobbies, and your moderation desires. You can always migrate your account, later. https://docs.joinmastodon.org/user/moving/

2) Make a profile! These can be longer than Twitter ones - and you can format them with line breaks, italics (using asterix), and loads of emoji if your server supports markup. Check the emoji on your server, here! https://emojos.in/

3) If you liked who you followed on Twitter, use https://debirdify.pruvisto.org/ and/or https://fedifinder.glitch.me/ to create a csv of all the people you followed there to upload into Mastodon, using the web menu option Preferences > Import. Now you are following the same folks!

4) Using https://debirdify.pruvisto.org/, you can also export your Twitter blocklist, and import it using the same function in Mastodon.

5) Create an introduction post! Use lots of hashtags to help people find you and your interests, as there's no algorithm or string search function here. Make sure to add the hashtag introduction!

6) Get used to using hashtags in your posts regularly, so that people can find them manually or using the hashtag following function, or the rss feed function.

7) Use CWs liberally, to help people decide what to see. Follow your server's guidelines, but definitely CW those movie spoilers!

8) Use alt text in your images whenever possible, to help people with screen readers enjoy it here, too!

9) Enjoy your new community, and have a lot of fun!

#MastodonTips #MastodonNewbie

Moving or leaving accounts - Mastodon documentation

Take your information and do what you want with it.

As promised: Here's the first $10,000 Intel bug (aka CVE-2022-33942) that allows to bypass the authentication of Intel's DCM by spoofing Kerberos and LDAP responses.

Exploit inside, enjoy 😎​

https://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942

#BugBounty #security

From Zero to Hero Part 1: Bypassing Intel DCM’s Authentication by Spoofing Kerberos and LDAP Responses (CVE-2022-33942) – RCE Security