Marco Ivaldi

When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

Homepage: https://0xdeadbeef.info
GitHub: https://github.com/0xdea
Twitter: http://www.twitter.com/0xdea

Public Key

npub137swhpts57chhtgttt4tm23qprkjw7dh87v3fgck8sgyu8q0zy0q7u50fd

NIP-05 Address

raptor_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsglg8ts4c20vtm4594464a4gsq3mf80xmnlxg55vtrcyzwrs83z8sfp4u5w

Author Public Key

npub137swhpts57chhtgttt4tm23qprkjw7dh87v3fgck8sgyu8q0zy0q7u50fd

Show more details

Last Notes

2025-03-27 14:04:40

"The designer of a new system must not only be the implementor and the first large-scale user; the designer should also write the first user manual. If I had not participated fully in all these activities, literally hundreds of improvements would never have been made, because I would never have thought of them or perceived why they were important."
-- Donald Knuth, “The Errors of TeX”

2025-03-21 07:20:16

Rejoice! 🎉
My idalib-based vulnerability research tools are now fully compatible with Windows 🪟
Please test them and report any bugs 🪲
https://security.humanativaspa.it/streamlining-vulnerability-research-with-ida-pro-and-rust/
(PS. Ya like my GPT writing style? 🚀)

2025-02-26 14:03:21

rotfl https://hackerone.com/reports/2293343

2025-02-25 17:53:23

- reply

so true

2025-02-21 13:17:12

Lesser known tricks, quirks and features of #C
https://jorenar.com/blog/less-known-c

2025-01-28 20:42:47

Tour of #Rust's Standard Library Traits
https://github.com/pretzelhammer/rust-blog/blob/master/posts/tour-of-rusts-standard-library-traits.md
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/907/922/664/696/320/original/7864cf611b0c5762.png

2025-01-16 12:10:42

- reply

it’s not yesterday’s post, it’s an upcoming one in the near future

2025-01-16 11:06:50

- reply

my colleague wrote this, I expect it to be clean 😅

2024-12-26 11:08:44

Safe #Rust AIN'T SAFE!? (cve-rs explainer)
https://youtu.be/vfMpIsJwpjU

2024-12-26 06:54:43

2025 is just around the corner. If #LearningRust is among your New Year’s resolutions, I’ve got you.
Following my ongoing #Rust series on the @npub1fnd…8ya4 blog (https://security.humanativaspa.it/tag/rust/) and adding something along the way, in the next days I’ll recommend the learning resources that worked for me.
Stay tuned!

2024-12-24 05:51:07

Announcing #CodeQL Community Packs
https://github.blog/security/vulnerability-research/announcing-codeql-community-packs/

2024-12-14 07:46:34

Oasis Security Research Team Discovers Microsoft #Azure #MFA Bypass
https://oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass

2024-12-08 15:25:28

Pointers Are Complicated, or: What's in a Byte?
https://www.ralfj.de/blog/2018/07/24/pointers-and-bytes.html
Pointers Are Complicated II, or: We need better language specs
https://www.ralfj.de/blog/2020/12/14/provenance.html
Pointers Are Complicated III, or: Pointer-integer casts exposed
https://www.ralfj.de/blog/2022/04/11/provenance-exposed.html

2024-12-06 16:00:26

Breaking the most popular #Web Application Firewalls (#waf) in the market
https://nzt-48.org/breaking-the-most-popular-wafs

2024-11-16 18:25:29

- reply

done! https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy

2024-10-30 14:16:37

- reply

funny that you mention keycloak on the very same day that we chose to disclose some vulnerabilities in it 🤷‍♂️ https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/

2024-10-26 08:17:51

Super useful diagram that explains all available transformations between Result and Option standard #Rust types and their interactions.
Source: https://docs.google.com/drawings/d/1EOPs0YTONo_FygWbuJGPfikO9Myt5HwtiFUHRuE1JVM/edit
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/372/731/627/019/138/original/a60e52406eeff462.png

2024-10-24 11:20:49

Got some #MSRC #swag 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/362/131/121/808/064/original/4b5eecd61ec62809.jpeg

2024-10-12 10:43:05

- reply

yes! And it’s quite convenient to use, e.g. https://security.humanativaspa.it/big-update-to-my-semgrep-c-cpp-ruleset/

2024-10-10 14:58:55

A step-by-step guide to writing an #iOS #kernel #exploit -< short and to the point!
// by [@alfiecg_dev](https://bird.makeup/users/alfiecg_dev )
https://alfiecg.uk/2024/09/24/Kernel-exploit.html
https://github.com/alfiecg24/Vertex

2024-10-04 06:37:39

#Hacking is not just #OldSchool tooling and techniques. Modern #MobileApps are a fun target for #ReverseEngineers and #Pentesters alike. A fundamental tool to properly hack mobile apps is @npub1ufe…m7ps by [@oleavr](https://fosstodon.org/@oleavr ).
We continue our tour of my [@github](https://infosec.exchange/@github ) projects with my humble contributions to this field:
https://github.com/0xdea/frida-scripts
For a well-maintained project that includes some of my #Frida scripts, check out #Brida by [@apps3c](https://infosec.exchange/@apps3c ) and Piergiovanni Cipolloni:
https://github.com/federicodotta/Brida
And even after many years, if you search for well-crafted Frida scripts to bypass certificate pinning or root detection, there’s a very good chance that you’ll stumble upon the work of some of my colleagues… Very proud of my team at [@hnsec](https://infosec.exchange/@hnsec )!

2024-09-29 12:19:33

#patchfriday on #cups #vulnerabilities
https://patchfriday.com/158/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/220/804/297/042/971/original/ee02f3475df3e6ca.png

2024-09-20 07:17:52

Continuing the tour of my @npub1545…mva5 projects, the #TacticalExploitation toolkit deserves to be mentioned. It's now a bit old, but I believe the concept still applies, and very much so.
https://github.com/0xdea/tactical-exploitation
"The Other Way to Pen-Test" -- @npub18pc…787r & @npub14pv…jqkx
I've always been a big proponent of a tactical approach to #PenetrationTesting that doesn't focus on exploiting known software #vulnerabilities, but relies on #OldSchool techniques such as #InformationGathering and #BruteForce. While being able to appreciate the occasional usefulness of a well-timed 0day, as a veteran penetration tester I favor an exploit-less approach. Tactical exploitation provides a smoother and more reliable way of compromising targets by leveraging process vulnerabilities, while minimizing attack detection and other undesired side effects.
Since a few years, I've meant to give a talk on this very subject, with the working title of "Empty Phist Style - Hacking Without Tooling" (inspired by @npub18ym…460u). Sooner or later it will happen.

2024-09-17 08:19:18

- reply

makes sense!

2024-09-17 07:42:28

Not a fan of the #AI hype at all, but @npub1nnw…ytvc #RustRover new full line code completion feature is impressive
https://blog.jetbrains.com/blog/2024/04/04/full-line-code-completion-in-jetbrains-ides-all-you-need-to-know/

2024-09-17 07:26:01

I'd like to share some of my projects that are hosted on @npub1545…mva5. Let's start with my public #exploits that span more than two decades of #pwning.
https://github.com/0xdea/exploits
"You can't argue with a root shell." -- Felix "FX" Lindner
Probably the most known is raptor_udf.c that targets #MySQL (those of you who solved the @npub1n4p…t7gf #OSCP training labs should recognize it).
My favorite is still raptor_rlogin.c, a glorious #Solaris #RCE from the early 2000s. Take your pick!

2024-09-09 07:05:10

I finally got my copy of #Phrack71!
Impressive work by the new @npub1am3…j6qn staff 💚
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/106/321/877/286/814/original/2e694c1122b0fd57.jpeg

2024-09-03 07:08:45

Come for the #OffensiveRust content, stay for the #ThrashMetal revival 🎸 https://infosec.exchange/@hnsec/113072354880406361

2024-08-28 19:13:58

- reply

what is the source?

2024-08-26 05:12:57

#patchfriday
https://patchfriday.com/157/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/026/608/301/814/892/original/8dc635f03000c4fd.png

2024-08-12 05:58:08

So cool to see my vulnerability research automation work integrated into such a powerful tool! Keep it up ✊
https://infosec.exchange/@securefirmware/112937856513629704

2022-11-22 16:33:09

"Sometimes, hacking is just someone spending more time on something than anyone else might reasonably expect.”
— Jerry Gamblin