David Johansson @securitybits

Working with software security, playing with security software. London Joined April 2012

Tweets

98
Followers

181
Following

66
Likes

56

David Johansson @securitybits

4 years ago

@LewisArdern Yes, if your tweet can count as an ad? 😁

1 0 1 68 0

View Details

Workaround for "Audit selected items" (does not work when crawl is used): hide out of scope items in the site map filter before initiating the scan and they will be excluded ("Consolidate items..." also has an option to check and verify this).

Mastering Burp Suite Pro @MasteringBurp

6 years ago

⚠️In v2's Scanner, items excluded from the Suite scope may be crawled/scanned nonetheless ⚠️ forum.portswigger.net/thread/scanner…

2 1 22 0 2

0 1 4 0 1

View Details

David Johansson @securitybits

6 years ago

First day of attending Burp Pro training with @Agarri_FR was great and nice to see @CryptoGangsta getting some credits for his blog in the course too, really looking forward to the rest of this class!

1 2 10 0 0

View Details

David Johansson @securitybits

6 years ago

Apart from being able to extract the content, #Chrome also sends the full file path when viewing a local PDF, but #Acrobat doesn't do the same. Looks like Chrome always truncates the last character of the file path, incorrectly assuming it's a trailing NULL value.

PortSwigger Research @PortSwiggerRes

6 years ago

Portable Data exFiltration: XSS for PDFs by @garethheyes #BHEU portswigger.net/research/porta…

2 170 439 0 74

0 1 3 0 0

View Details

David Johansson @securitybits

6 years ago

I was looking for an example of RFD to demonstrate on when I realized that @PortSwigger labs provides what I need: portswigger-labs.net/xss/content-ty… Interesting side note: Chrome in Android associates the download with the current page before link is visited, not the download server.

0 1 2 0 0

View Details

David Johansson @securitybits

6 years ago

@albinowax Yes, I agree that DoS is a bit lame and boring compared to the other requests smuggling attacks you've shown, yet potentially devastating for those affected. Just hoping that script kiddies don't turn into "death smugglers". ;)

0 0 0 0 0

View Details

David Johansson @securitybits

6 years ago

Playing around with HTTP request smuggling at @WebSecAcademy tonight after work to confirm that it's trivial to abuse both CL.TE and TE.CL for denial of service attacks, below is a simple page load taking several minutes. Perhaps this is well-known already?

1 2 6 0 0

View Details

David Johansson @securitybits

6 years ago

@rsinha My 15 year old iBook is still running fine and apparently up to date, so why not use it for online banking in addition to watching memes? ;)

0 0 3 0 0

View Details

David Johansson @securitybits

6 years ago

@rsinha No, close but I'm afraid you need to get 012345 to hit the jackpot.

0 0 1 0 0

View Details

David Johansson @securitybits

6 years ago

@Hexploitable @SW_integrity @NowSecureMobile Wishing you all the best in your new adventure! It's been great working with you and I'm sure you'll do a fantastic job I'm your new role.

0 0 1 0 0

View Details

David Johansson @securitybits

6 years ago

@securestep9 Interesting but nothing really new, attempting to ensure 'secure payment' within an insecure and compromised site is doomed to fail. You can outsource your PCI DSS compliance, but you cannot outsource your security responsibility.

0 0 2 0 0

View Details

David Johansson @securitybits

6 years ago

@securestep9 "the take away here is that the big cloud concept of security free from vulnerabilities is wrong. That’s what we showed. It can happen there as well. It’s just software and software has bugs." ^^^this is so true!

0 0 2 0 0

View Details

David Johansson @securitybits

7 years ago

@floyd_ch @swisscyberstorm @cathapman @EnriqueITE @thedeadrobots Agree, it was great to meet you all!

0 0 2 0 0

View Details

David Johansson @securitybits

7 years ago

Had a great evening with the speakers' dinner at @swisscyberstorm, looking forward to the conference tomorrow and what promises to be a great day of security talks! It's a pleasure to be invited to present at this event.

0 1 6 0 0

View Details

David Johansson @securitybits

7 years ago

@pacohope A bit disappointed about you keeping the same job, I mean I had hoped that you would take over the presidency over there instead. ;) Wish you all the best though, we'll all miss you!

1 0 4 0 0

View Details

David Johansson @securitybits

7 years ago

@Uber came over to London and gave us a better taxi experience, now we return the favour by sending over @monzo to do the same for your banking!

Monzo 🏦 @monzo

7 years ago

We're coming to the USA! 🎉 Join the waitlist at monzo.com/usa and follow @monzousa for updates 🇺🇸 monzo.com/blog/2019/06/1…

42 168 778 0 1

0 0 1 0 0

View Details

David Johansson @securitybits

7 years ago

My daughter was there to cheer me on at the 25km mark, now she got inspired and told me she wants to start training for a marathon when she grows up. :)