Tweetovi
- Tweetovi, trenutna stranica.
- Tweetovi i odgovori
- Medijski sadržaj
Blokirali ste korisnika/cu @SandboxBear
Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @SandboxBear
-
Prikvačeni tweet
Sometimes I feel like this. Just really out of place. Like a tourist in a human world. Feeling alone and misunderstood, longing for the ice and snow where I belong. I miss the other polar bears.pic.twitter.com/6LA14FB8jz
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
When I get to Microsoft, I'm going to work day and night. I'm going to make sure hiring me wasn't a mistake. I don't feel like I've finally won yet, I feel like I've been given a chance to finally prove myself, and that's what I'm going to do.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
One day I also want to be in a position to hire people and bears. I'll hire all the folks that nobody wants because I know how painful it is to be passionate about something but not be given any chances.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
SandboxEscaper proslijedio/la je Tweet
Drop 0days, have fun, be yourself & forget the haters.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Took 5 years until a manager came along who didn't just see an emotionally unstable 0day dropper. For all I care he is the only cool manager in this industry and the only manager I respect.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
How to get a vuln research job: -Get a fancy CS degree -Find mem corruption bugs, forget about logic bugs -Don't drop 0days out of despair because of getting nowhere in this industry because you'll be labeled untrustworthy People say there is a skill shortage in infosec.. lol.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
People who sell 0days don't give back. They are just money whores facilitating the geopolitical games of shitty countries.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
I was often offered six figures for an LPE. But the 0day trade is disgusting. Even the west isn't a beacon of civilization anymore. The story of 'it gets used to catch criminals' is bullshit, I don't believe it. You don't pay that much money to catch criminals.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
When I move to Vancouver, spring will be around the corner, bears will be coming out of hibernation. I'll have atleast one good friend nearby over in Redmond. The routine of going to work every day.. things are going to be alright.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
People think I'm not a real polar bear, but how do you explain this selfie then?pic.twitter.com/PSZgXTMovE
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
I'm glad someone finally took a chance on me and got me a job. After 5 years of getting nowhere in this industry (guess people didnt think my work had value for their company). Now I can finally learn new things and step up my game.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
I hope my last 3 write-ups have covered the subject of filesystem bugs enough. It talks about discovery using procmon, and also poc writing now. You can just copy paste from the poc on github for a lot of bugs I guess. I hope it helps get atleast one person into the field.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
If you are a worthless highschool dropout like me without education. Become good at just one thing. Hyper-specialize. Maybe I suck at memory corruption bugs, but try and beat me at my own game of junctions, oplocks and race conditions. I breath that shit. Got me a job too.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Also made around 100k in the process, which is mad because I didn't even work a lot. I won't be going after LPEs again. I want to find the next challenge now.. so you folks go find all of them and get rich. Feel free to tweet at me if you have technical questions.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
I think it's just easier clicking random stuff then reversing IPC related stuff. Most of that IPC related stuff (rpc/com/etc) can be triggered naturally by clicking stuff. Found 12 bugs this way last year.. don't think I worked more then 2-3 months total lol, was always hiking.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Like seriously, I sometimes wonder why Microsoft even wanted to hire me in the first place. Guess that's easier then dealing with a lunatic dropping 0days all the time, even if they are shit 0days.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
People think I have talent, but I don't. I click things in windows, I look at procmon, write shitty PoCs.. it's easy money and you really don't need talent at all. I got into filesystem bugs right at the start, that's my only advantage.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Oh also, this bug earned me 20k in bounty money. It's a dumb bug, but 20k is 20k lol. There's so many similar bugs still out there.. literally only takes me a few days to find these.https://twitter.com/SandboxBear/status/1223048229169876993 …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Anyway, it's a shitty bug, I'll upload some better junction bugs to github in the future.. but it doesn't use Oplocks for bait and switch (wasn't an option) and demonstrates ways to still get your timings. Which is something that you need to know when going after these bugs.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Also, at the bottom of the write-up I mention a trick that lets you control the filename too (the people from cyberark first wrote about it). If that trick is not patched yet, I recommend learning how to do this. This is probably where the current junction "meta" is headed to.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
https://sandboxescaper.blogspot.com/2020/01/chasing-polar-bears-part-2.html … Fuck it, I can't focus at all today. It's a mess, sorry.. I've also uploaded the discussed bug to github. Maybe someone can make sense of it. It's a junction bug that's a little more complicated then a simple "bait and switch". Hope it's useful to someone.
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.