NimdaKey @NimdaKey

The author of "揭秘家用路由器0day漏洞挖掘技术". Joined April 2014

Tweets

16
Followers

18
Following

136
Likes

134

GG @oldfresher

6 months ago

I reported a file disclosure vuln in @openclaw. Any group chat member can steal API keys and conversation history. Silently fixed the next day. Never notified. Then denied as "not a vulnerability." A one-day fix shows urgency. Denying it shows disrespect. #infosec

10 20 119 58K 38

View Details

NimdaKey @NimdaKey

9 months ago

@ScaryByteGroup fake news

0 0 0 28 0

View Details

NimdaKey @NimdaKey

2 years ago

#Telegram It's not a RCE.😂

0 0 0 41 0

View Details

NimdaKey @NimdaKey

2 years ago

#CVE-2024-21762 exploit version 7.4.2

0 0 0 36 0

View Details

NimdaKey @NimdaKey

2 years ago

CVE-2024-21762 is similar to the heap overflow vulnerability caused by XOR last year . so I spent some time reproducing this vulnerability, and it was quite interesting. Now it's showtime.

2 0 1 132 0

View Details

NimdaKey @NimdaKey

2 years ago

@krjcybersec Don't care about whether he's using malloc or calloc.The memory seems to have been allocated already.

0 0 0 20 0

View Details

NimdaKey @NimdaKey

3 years ago

@elonmuskusaaaaa 14🫡

0 0 0 9 0

View Details

NimdaKey @NimdaKey

3 years ago

@haverts101010 Sorry, I won't be releasing the proof of concept for now. I encourage everyone to implement it themselves, as this process will greatly benefit you.

0 0 0 90 0

View Details

NimdaKey @NimdaKey

3 years ago

This is a fascinating vulnerability. I have learned a lot during the process of exploiting it. I recommend that everyone tries their hand at writing their own exploit code for it. #CVE-2023-27997

4 1 7 1K 0

View Details

NimdaKey @NimdaKey

3 years ago

@M1cr0hunt3r Sorry, I won't be releasing the proof of concept for now. I encourage everyone to implement it themselves, as this process will greatly benefit you.

0 0 0 92 0

View Details

NimdaKey @NimdaKey

3 years ago

@Ddd865827390328 Sorry, I won't be releasing the proof of concept for now. I encourage everyone to implement it themselves, as this process will greatly benefit you.

0 0 0 50 0

View Details

NimdaKey @NimdaKey

3 years ago

@krjcybersec I use SSL_do_handshake to trigger the ssl->handshake_func.

1 0 1 216 0

View Details

NimdaKey @NimdaKey

7 years ago

I just wrote an exploit. by browsing to the website, I triggered a safari bug, then pivoted from root to kernel. The kernel exploits bypass SMAP/SMEP on a macOS box. I learned so much. Thanks @s1guza for helping.