joernchen (@joern@threatactor.club)

Display name: joernchen
Username: @joern@threatactor.club
Role: admin

About joern

Website: https://0day.click
Signal: https://signal.me/#eu/Y_4bLZQXAEYE9ZOWe6Ac0vfLfHWhftbPNqBv2TQ2fij0qbdwrXFKXogmWuDl79gi
Threema: https://threema.id/K8J68WTX

Your mom's favorite hacker!

My other account is @joernchen

Joined: Nov, 2022
Posts: 687
Followed by: 1129
Following: 261

Recent public posts

exclude boosts

joernchen

@joern

Boost of @i0null@infosec.exchange

Hacker Memes @i0null@infosec.exchange

CTF teams compiling ROP gadgets like

Published: Feb 09, 2024, 19:52
Visibility: Public
Replies: 1

Favourites: 0
Reblogs: 2

joernchen

@joern

Boost of @i0null@infosec.exchange

Hacker Memes @i0null@infosec.exchange

F(nachos) = F(nachos-1) + F(nachos-2)

“Fibonacchos”
The Fibonacci sequence laid out in Nacho’s (Tortilla Chips).

Credits: Cliff Pickover

Published: Feb 09, 2024, 12:05
Visibility: Public
Replies: 3

Favourites: 1
Reblogs: 1

joernchen

@joern

Boost of @buherator@infosec.place

buherator @buherator@infosec.place

Case in point: I just reviewed a report where the author apparently used an LLM to decode base64. The result has nothing to do with the input, but it's pretty easy to find its sources on StackOverflow.

The person has several years of experience and a decent CV too, currently working in a senior position.

RE: https://infosec.place/objects/21ef69ce-b684-4e85-af5d-9c8729f3aeca

Published: Feb 06, 2024, 10:35
Visibility: Public

Replies: 0
Favourites: 0
Reblogs: 1

joernchen

@joern

Jedes Schild hat eine Geschichte.

🤦

Fehlermeldung:

Das hat leider nicht geklappt. Überprüfe bitte Deine Eingabe. Du kannst im Feld „Benutzername" auch Deine Kunden- oder Rufnummer angeben. Das geht dann, wenn Du sie als zusätzlichen Benutzernamen aktiviert hast. Aus Sicherheitsgründen können wir das Sonderzeichen "«" nicht mehr erlauben. Benutzt Du ein Internet-Passwort mit diesem Zeichen? Dann ist ein Login mit Deinem Internet-Passwort richt mehr möglich. Setze es bitte hier zurück.

Published: Jan 29, 2024, 14:24
Visibility: Public
Replies: 3

Language: English
Favourites: 39
Reblogs: 22

joernchen

@joern

Boost of @nblr@chaos.social

~n @nblr@chaos.social

I'm looking for a used (preferably "used, as new") Lenovo T495s or T14s (16GB or more), so far ebay&co did not deliver convincing options. If you'd like to get rid of yours, let me know. Screen options: low-power or privacy guard variant, no touch. UK keyboard a plus.

Published: Jan 19, 2024, 12:46
Visibility: Public
Replies: 3

Favourites: 0
Reblogs: 1

joernchen

@joern

Patch NOW

https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Published: Jan 11, 2024, 23:28
Visibility: Public
Replies: 2

Language: English
Favourites: 10
Reblogs: 20

joernchen

@joern

Boost of @fd0@milliways.social

alex @fd0@milliways.social

Here's a fun story we discovered last year: accessing data in a Bitwarden vault without the password (biometrics, Windows Hello, domain-joined machine) https://blog.redteam-pentesting.de/2024/bitwarden-heist/

Published: Jan 03, 2024, 11:51
Visibility: Public

Replies: 0
Favourites: 0
Reblogs: 2

joernchen

@joern

Happy new year everyone!

Selfie pointing at camera.

Caption:

I want you to have a great 2024!

Published: Jan 01, 2024, 12:50
Visibility: Public

Language: English
Replies: 0
Favourites: 24
Reblogs: 3

joernchen

@joern

Boost of @year_progress@techhub.social

Year Progress @year_progress@techhub.social

░░░░░░░░░░░░░░░ 0%

Published: Jan 01, 2024, 00:00
Visibility: Public
Replies: 14

Favourites: 0
Reblogs: 1

joernchen

@joern

Closing off 2023 with something I haven’t done in a while

DJ mixer and turntable spinning a record

Published: Dec 31, 2023, 18:07
Visibility: Public

Language: English
Replies: 0
Favourites: 10
Reblogs: 0

joernchen

@joern

ping

Published: Dec 30, 2023, 22:50
Visibility: Public
Replies: 10

Language: English
Favourites: 0
Reblogs: 1

joernchen

@joern

o.O

Bard Experiment + was sind die letzten 4 stellen von pi? Weitere Vorschläge ansehen v Die letzten 4 Stellen von Pi sind 5897. Am 28. November 2023 wurden 62,8 Billionen Nachkommastellen von Pi berechnet. Die letzten 10 Stellen lauten 5897932384. Die letzte bekannte Ziffer ist also eine 7. Da Pi eine irrationale Zahl ist, hat sie unendlich viele Nachkommastellen. Die letzten Stellen ändern sich also ständig.

Published: Nov 29, 2023, 16:35
Visibility: Public
Replies: 1

Language: English
Favourites: 9
Reblogs: 6

joernchen

@joern

👀

http://tiny.cc/37c3voucher

#ccc #37c3 #vouchers

Published: Nov 19, 2023, 21:39
Visibility: Public
Replies: 2

Language: English
Favourites: 6
Reblogs: 7

joernchen

@joern

Boost of @postmodern@infosec.exchange

postmodern @postmodern@infosec.exchange

are there SSTI tests that can pinpoint exactly which template engine is being used. {{ 7*7 }} only tells you that SSTI is possible, but not which engine is being used. {{ }} is used by Liquid, Jinja, Vue.js, and Angular.js, so testing with {{ }} doesn't narrow things down.
#ssti #websec

Published: Nov 17, 2023, 19:04
Visibility: Public
Replies: 1

Favourites: 0
Reblogs: 2

joernchen

@joern

Some things never change

Meme:

Why Is It, When Something Happens, It Is Always You Three?

../../, "`id`", ' or 1='1

Published: Nov 10, 2023, 11:58
Visibility: Public
Replies: 5

Language: English
Favourites: 162
Reblogs: 96

joernchen

@joern

OH: Intellektuelle Massephase

Published: Oct 25, 2023, 19:07
Visibility: Public

Language: English
Replies: 0
Favourites: 2
Reblogs: 0

joernchen

@joern

Boost of @bagder@mastodon.social

daniel:// stenberg:// @bagder@mastodon.social

We disclosed this #hackerone report against #curl when someone asked Bard to find a vulnerability, and it hallucinated together something:

https://hackerone.com/reports/2199174

Published: Oct 16, 2023, 14:45
Visibility: Public

Replies: 0
Favourites: 1
Reblogs: 2

joernchen

@joern

I smell quite some FUD about the alleged Signal 0day.

The recommendation is to turn off link previews, however link previews are generated on the sender side. Just tested, with link previews turned off you’ll still receive them from a device that sends those.

I think this would mean either: