John Hammond
@_JohnHammond • 321,555 subscribers
Cybersecurity Researcher @HuntressLabs Just Hacking Training @JustHackingHQ w/ @ethicalhacker https://t.co/UtsNJiyQtS && https://t.co/narO3sz7y6
Shorts
Videos
Well, this was a stupid insomnia project, but... 😂 Playground code is here:
John Hammond257,532 Aufrufe • vor 1 Jahr
The MOVEit Transfer exploitation is not just SQL injection(👀) We uncovered the very last stage of the attack chain to drop human2.aspx ultimately ends up gaining remote code execution ‼ We fully recreated the attack chain with a demo achieving a reverse shell & ransomware!
John Hammond236,679 Aufrufe • vor 3 Jahren
A few months ago I flew to New York to film in the Good Morning America studio, for a segment on the "grandparent scams" where bad actors use AI to impersonate family members and steal money. Last night it aired on Nightline! 🥳 Incredible opportunity, thank you for having me!💙
John Hammond59,837 Aufrufe • vor 9 Monaten
CVE-2023-34362: We haven't figured out how it's moved in wwwroot just yet, but we've just about got the attack chain where we perform SQL injection, own the MOVEit instance and upload/exfitrate files! 🤩 Huge thanks to Caleb Stewart for being my partner in (cyber)crime here! 💪
John Hammond152,846 Aufrufe • vor 3 Jahren
Lotta chatter around #ScreenConnect vulnerabilities now as folks are getting spun up. Fellow Huntress researchers and I were up all night to recreate the auth bypass and RCE exploit. I'm not a huge fan of giving a PoC to threat actors, but I do dig snazzy video demos 😜
John Hammond79,092 Aufrufe • vor 2 Jahren
Keine weiteren Inhalte verfügbar