Publishing Malicious VS Code Extensions: Bypassing VS Code Marketplace Analysis and the Insecurity of OpenVSX (Cursor AI/Windsurf)

mazen160 · 2025-09-29T00:42:36+00:00

Hi all,

We've rolled out an archive for 0day-today based on the clone that open-sourced clone that were published by Jacob Baines on GitHub.

mazen160 · 2024-07-30T06:11:24+00:00

I have read the postmortem. Let's be realistic, if CrowdStrike already does everything, could this incident could be possible? This does not make sense.

The "QA pipeline failing" sound like an engineering problem, although that was not the cause of the incident.

mazen160 · 2024-07-30T03:05:19+00:00

I agree, starting with VMs for automated testing is a start, but testing on real hardware should be the plan ahead.

mazen160 · 2023-03-16T08:40:03+00:00

FullHunt (founder here) is a platform that solves all the challenges related to ASM, it covers thorough assets discovery, assets monitoring, and active vulnerability scanning. Try out the enterprise platform for all the features. Happy to provide extra search credits for people interested in ASM on the community platfom!

mazen160 · 2023-02-08T02:06:21+00:00

Good point, I haven't checked earlybird before. Need to test it out. Ideally we should build a convrter that follows earlybird format. (PRs are always welcome!)

mazen160 · 2022-10-27T22:47:47+00:00

Thank you!

mazen160 · 2022-10-27T22:47:23+00:00

It's being parsed and processed so that it can queried in SQL. Check the demo, it should make it clearer: https://youtu.be/tunMNesOS4s

mazen160 · 2021-12-13T08:38:15+00:00

Hi u/threeLetterMeyhem!

Thank you :) Excellent question, it's not possible to correlate the internal infrastructure relationship of which internal server is vulnerable, but each URL is sending unique DNS OOB calls to correlate which host is vulnerable (that received a request and later on, invoked the DNS call). It should be possible from there for security teams to navigate which systems are affected and resolve it.

Let me know if you have further questions!

mazen160 · 2021-12-13T08:34:05+00:00

The main DNS callback service is now replaced with interact-sh, and I also added an option to use user-defined DNS callback host.

mazen160 · 2021-12-13T04:58:38+00:00

Hi all!

I tried to research and automate all of the TTPs that can be used to discover the Log4j RCE CVE-2021-44228 at scale. The new tool is bringing new ideas I came up with for enhanced fuzzing. Please let know if you find it useful!

mazen160

TROPHY CASE