pyn3rd

@pyn3rd

Security Researcher&Red Team&Cloud Security. BlackHat&HITB&CanSecWest Speaker.

Melbourne, Victoria

blog.pyn3rd.com

Joined February 2016

844Posts 14KFollowers 611Following

You might like

@cyber_advising

@orange_8361

@XssPayloads

@albinowax

@pikpikcu

@K_MnO4_

@pdnuclei

@ptswarm

@garethheyes

@0xacb

@b1u3r

@pentest_swissky

@irsdl

@testanull

@_xpn_

pyn3rd reposted

Qubit

@q810034

Sep 12

I just published From XSS to RCE: Critical Vulnerability Chain in Anthropic MCP Inspector(CVE-2025–58444) medium.com/p/from-xss-to-…

q810034's tweet card. When developing an MCP service, I typically use MCP Inspector for code testing and debugging, as it is an open-source inspection…

From XSS to RCE: Critical Vulnerability Chain in Anthropic MCP Inspector(CVE-2025–58444)

Source: medium.com

pyn3rd

@pyn3rd

Aug 13

Over coffee, found a vulnerability.

Wiz

@wiz_io

Jul 23

🚨 New research: A cryptomining campaign is hijacking exposed PostgreSQL, hiding payloads in fake 404 pages, and abusing legit infra. Multiplatform, stealthy, and still active 👉 wiz.io/blog/soco404-m…

wiz_io's tweet image. 🚨 New research: A cryptomining campaign is hijacking exposed PostgreSQL, hiding payloads in fake 404 pages, and abusing legit infra.
Multiplatform, stealthy, and still active 👉 wiz.io/blog/soco404-m…

#Bugcrowd Team's handling of my recent report has been absurd. I reported a bug 6 days ago, but they didn’t attempt to reproduce it right away. Today, after it was already fixed, they reproduced it and claimed the bug is no longer applicable, considering it theoretical.@Bugcrowd

pyn3rd

@pyn3rd

Jul 19

Old but GOld! That's a good one!

H4x0r.DZ 🇰🇵

@h4x0r_dz

Jul 17

WAF bypass via junk data [this trick has been around for 13 years] exploit-db.com/exploits/18840 Do not forget: Hackerone is a scam

h4x0r_dz's tweet image. WAF bypass via junk data [this trick has been around for 13 years]

exploit-db.com/exploits/18840

Do not forget: Hackerone is a scam

pyn3rd reposted

Nir Ohfeld

@nirohfeld

Mar 25

We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @KubernetesIO project "Ingress-NGINX". The impact? From zero permissions ➡️ to complete cluster takeover 🤯 This is the story of #IngressNightmare 🧵⬇️

nirohfeld's tweet image. We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @KubernetesIO project "Ingress-NGINX".

The impact?

From zero permissions ➡️ to complete cluster takeover 🤯

This is the story of #IngressNightmare 🧵⬇️

pyn3rd

@pyn3rd

Feb 20

It was a genuine pleasure meeting @infosec_au in Sydney and receiving your insightful advice and valuable information. Thank you! Hope to see you again soon!

pyn3rd reposted

Michael Stepankin

@artsploit

Jan 22

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

artsploit's tweet image. Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

pyn3rd

@pyn3rd

Jan 22

I truly appreciate @albinowax's kind help in adding both my blog and slides to Web Hacking Techniques 2024.Thank you so much!

pyn3rd

@pyn3rd

Dec 13

#CVE-2024-49194 Databricks JDBC Driver via JAAS, Make JDBC Attack Great Again!! I’ve included the link to my write-up below. Enjoy!! blog.pyn3rd.com/2024/12/13/Dat…

pyn3rd

@pyn3rd

Dec 10

Activiti is a lightweight workflow and Business Process Management (BPM) platform that supports Expression Language expressions within its flows. In this example, I demonstrate how to exploit this feature to trigger RCE in a SpringBoot environment.

pyn3rd

@pyn3rd

Nov 22

Use MSSQL CLR Assembly To Bypass EDR blog.pyn3rd.com/2024/11/22/How…

pyn3rd

@pyn3rd

Nov 22

XSS based on DNS CNAME Type Record

pyn3rd

@pyn3rd

Nov 12

I’m developing a DNS server that responds with random IP addresses and tracks response times. It’s designed to handle a high volume of cache-miss queries for DNS caching, like Local DNS Server.

pyn3rd

@pyn3rd

Nov 8

I developed an SSH client rootkit to test EDR detection. When a user logs in, it captures the root password and sends it covertly via a DNS TKEY record. With high daily DNS traffic, EDR systems are unlikely to flag this, as analyzing every query would impact performance.

pyn3rd's tweet image. I developed an SSH client rootkit to test EDR detection. When a user logs in, it captures the root password and sends it covertly via a DNS TKEY record. With high daily DNS traffic, EDR systems are unlikely to flag this, as analyzing every query would impact performance.

pyn3rd reposted

tonghuaroot

@tonghuaroot

Oct 22, 2024

Just read "Make JDBC Attacks Brilliant Again", a fantastic 3-year-old research piece that @pyn3rd recently recommended to me. It starts with JDBC attack principles and root causes, dives deep into implementation issues—including their discovery of a Weblogic RCE—unveils new…