Mastodon: https://nitter.gq/t.co/UGb5nhn87J
Joined September 2016
- Tweets1.3K
- Following752
- Followers2.9K
- Likes1.8K
Pinned Tweet
🤠 Howdy! I'm happy to release v1.0.0 of my new project, feroxbuster! feroxbuster is a forced browsing tool akin to gobuster/ffuf. It's written in Rust using async/await for concurrency.
after a few years of building, feroxbuster-pro is live!
i always knew it could be better. some early design decisions made things like adaptive scans impossible. feroxbuster-pro is built on feroxfuzz, which was always the foundation i needed to take it further.
1/2
highlights:
- semantic javascript analysis (not just regex)
- expanded endpoint extractors
- per-URL discovery provenance
- tiered wordlists
- adapts to live target behavior
- scan diffing
one-time payment for a lifetime license
feroxbuster.pro
Howdy!
Just pushed a new version of feroxbuster.
New cli options:
* --response-size-limit
* --unique
* --data-json
* --data-urlencoded
Added ability to set number of dir scans from the Scan Mgmt Menu. Also bugfixes and smaller enhancements.
Enjoy!
github.com/epi052/feroxbuste…
Ben 'epi' Risher retweeted
Love the feroxbuster team for listening to feedback and understanding edge cases. It's my favorite directory busting tool for that reason.
Case in point, it used to stop scanning if it encountered a directory listing, which does make sense...except it's possible to hide certain files from a listing, and this actually caused issues solving a @tryhackme machine.
Anyway now it will warn you and also provide an option to keep scanning directory listings!
github.com/epi052/feroxbuste…
howdy!
I pushed a new feroxbuster release this morning! Notable changes:
--request-file for scanning based on a raw http request (e.g. from burp)
--limit-bars to cap the number of progress bars shown during a scan
--scan-dir-listings to recurse into dir listing enabled dirs👇
I also fixed the documentation site's search functionality and upgraded all the CI/CD pipelines.
docs: epi052.github.io/feroxbuster…
pre-built binaries are available on the releases page.
Happy hacking!
github.com/epi052/feroxbuste…
Ben 'epi' Risher retweeted
The slides of our (CC: @m_u00d8) talk "Unleashing AI: The Future of Reverse Engineering with Large Language Models" at @reconmtl are now online.
Slides: synthesis.to/presentations/r…
ReverserAI: github.com/mrphrazer/reverse…
Ben 'epi' Risher retweeted
Happy to announce the release of our LLVM-based (dis)assembler framework, Nyxstone. It supports all architectures of LLVM, label-support in the assembler comes with Python & Rust bindings.
We are happy to open source Nyxstone, our (dis)assembly framework. It supports all LLVM 15 architectures, with C++, Rust, and Python bindings.
Check out our technical blog post and the repository for more details:
Blog: emproof.com/introducing-nyxs…
GitHub: github.com/emproof-com/nyxst…
Ben 'epi' Risher retweeted
Wrote a blogpost summarizing all of the features we've added to Lucid in the last few months: Snapshots, Code Coverage Feedback, and more. In the blogpost we actually get all the way to fuzzing a Linux kernel syscall which includes a setup description. h0mbre.github.io/Lucid_Snaps…
Ben 'epi' Risher retweeted
I gave Claude 3 the entire source of a small C GIF decoding library I found on GitHub, and asked it to write me a Python function to generate random GIFs that exercised the parser. Its GIF generator got 92% line coverage in the decoder and found 4 memory safety bugs and one hang.
Ben 'epi' Risher retweeted
New Lucid development blogpost, Episode #3 in the series. We were able to finally build Bochs -static-pie with a custom Musl toolchain. Executing Bochs now, we implemented a simple MMU and emulated File I/O. Some other details on some refactoring included: h0mbre.github.io/Loading_Boc…
Ben 'epi' Risher retweeted
New blog post about implementing syscall sandboxing to keep a test program from interfacing with the kernel via changes to Musl. We implement our own context-switching routine and handle the syscalls in the fuzzer. Next we'll sandbox Bochs & do snapshots h0mbre.github.io/Lucid_Conte…
Ben 'epi' Risher retweeted
starting a new fuzzer project on the blog that is based on an old @gamozolabs idea. in the first post, we load a statically built Bochs emulator ELF into our fuzzer process and execute it. there is some code and the humble beginnings of a repo. lets gooo h0mbre.github.io/New_Fuzzer_…
Ben 'epi' Risher retweeted
The blog post about the libwebp vulnerability fuzzing is up, it explains how I set up the experiment, how the crash was found and why oss-fuzz was not able to find it: srlabs.de/blog-post/advanced… #fuzzing @metzmanj
Ben 'epi' Risher retweeted
In the spirit of "this talk could've been a tweet", I just pushed a button:
#BinDiff is now open source.
- Snapshot release, no major new functionality
- Release binaries later today or tomorrow
- This is my 20% and I won't we able to act on PRs until end of Q4 (OOO traveling)
Ben 'epi' Risher retweeted
Emulated full system snapshot fuzzing by Intel 👀
haunted.computer/@novafacing…
Ben 'epi' Risher retweeted
on vacation a few months ago i challenged myself to come up with a data-only exploit for a `struct file` UAF to escape the Google kCTF container. i was able to find my own arb read/write gadgets and grab the flag, thanks to all mentioned within! h0mbre.github.io/kCTF_Data_O…
New #feroxbuster release!
Github user lavafroth added
--server-certs
--client-cert
--client-key
client-* options enable ferox to talk to servers that verify clients 🎉
server-certs allows you to verify unknown servers, instead of using --insecure
github.com/epi052/feroxbuste…
