Mastodawn

🍉Jan 12, 2025

TumpiCon Jan 12, 2025

The second edition of TumpiCon is here!
📅 June 27-28, 2025
📍 Somewhere near Turin, Italy
🔒 Invite-only

No flashy stages. No fluff. Just raw, technical, and unfiltered hacking.
More details? If you know, you know.
Follow the trail: https://tumpicon.org

TumpiCon 2025

zi0Black

🍉Jun 8, 2023

TumpiCon Jun 7, 2023

ICYMI #TumpiCon schedule is out!
Check it out at tumpicon.org 👀
P.S. expect an email in the next few days with more details 🏞️🧑‍💻

zi0Black

🍉Feb 24, 2023

TumpiCon Feb 24, 2023

👋🏿 hackers, make sure to check your inbox - we started sending the invites for #TumpiCon2023!
If you did not receive one and you like to join us: DMs are open (pro tip: proposing a talk is an awesome way to raise your chances of receiving an invite 😉).

zi0Black

🍉Jan 25, 2023

http://ranum.com/security/computer_security/editorials/dumb/index.html - It makes you laugh and think at the same time.

#TheSixDumbestIdeasinComputerSecurity

The Six Dumbest Ideas in Computer Security

zi0Black

🍉Dec 22, 2022

The actual achievements of this year:
- collected multiple super cool mugs
- got tonnes of swag
- got family recipe inside the Intel PSIRT cooking book
- seated on an exploit for months until someone else reported it

zi0Black

🍉Dec 21, 2022

Shielder Dec 21, 2022

🎁-time: Here you go two Cisco BroadWorks CommPilot Application Software vulnerabilities which our team ( @smaury @zi0Black @thezero ) found during an engagement for one of our customers.
CVE-2022-20951: Unauthenticated #SSRF - https://www.shielder.com/advisories/cisco-broadworks-commpilot-ssrf/
CVE-2022-20958: Authenticated #RCE - https://www.shielder.com/advisories/cisco-broadworks-commpilot-authenticated-remote-code-execution/

Shielder - Cisco BroadWorks CommPilot Application Software Unauthenticated Server-Side Request Forgery (CVE-2022-20951)

CVE-2022-20951: Cisco BroadWorks CommPilot Application exposes a servlet that allows the application to be used as an HTTP proxy server. The lack of validation of the the target URL and the lack of authentication protection allows an unauthenticated attacker to achieve a full-read SSRF.

Shielder

zi0Black

🍉Dec 18, 2022

RT @[email protected]

Did you know you can hide your payloads in phone numbers? ☎️😱
RFC3966 specifies parameters for valid phone numbers that can contain characters. @[email protected] discovered that popular libraries are vulnerable and that it can lead to XSS and even ATO!🔥
#BugBountyTips #NahamCon2022EU

🐦🔗: https://twitter.com/intigriti/status/1604054094808760321

INTIGRITI on Twitter

“Did you know you can hide your payloads in phone numbers? ☎️😱 RFC3966 specifies parameters for valid phone numbers that can contain characters. @securinti discovered that popular libraries are vulnerable and that it can lead to XSS and even ATO!🔥 #BugBountyTips #NahamCon2022EU”

Twitter

zi0Black

🍉Nov 22, 2022

RT @[email protected]

And the recording of our @[email protected] USA talk for "ÆPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture" is finally out as well!

Check it out 👀 https://youtu.be/8ZWc7Hcsl8o

cc @[email protected] https://twitter.com/borrello_pietro/status/1557065793954672640

🐦🔗: https://twitter.com/borrello_pietro/status/1595027725441441792