Sign in

Will Dormann is on Mastodon

@wdormann.bsky.social
1.8K followers 253 following 153 posts

I play with vulnerabilities and exploits. While this site initially showed promise, I've grown tired with its lack of improvement. You'll find me @wdormann@infosec.exchange on Mastodon.

PostsRepliesMedia
Will Dormann is on Mastodon @wdormann.bsky.social · 18/08/2026
I will be presenting at THREATCON1 in October, explaining how I figured out how a non-admin user could get code execution as SYSTEM on Windows 11 by way of playing a MIDI file. 😂 threatcon1.org/agenda
020
Will Dormann is on Mastodon @wdormann.bsky.social · 13/04/2026
The masses don't need those features. 😂
010
Will Dormann is on Mastodon @wdormann.bsky.social · 12/04/2026
Yeah, I'm pretty sure that Adobe Reader only exists for when somebody has a PDF that they need to sign. 😂
100
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026
"Adobe Reader is still a thing" is what surprises me more. 😂
100
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026
I suspect that the function has been removed. 🤷‍♂️
000
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026
Yes, that's the vulnerability at play here. The JavaScript is able to self-bless itself as privileged.
110
Will Dormann is on Mastodon @wdormann.bsky.social · 10/04/2026
I have wonders about official documentation for Adobe Reader JavaScript. For example, Collab.collectEmailInfo() is definitely a function, as it was part of CVE-2007-5659. However, if you look for documentation about this: Nada. www.google.com/search?q=Col...
google.com
Google Search
110
Will Dormann is on Mastodon @wdormann.bsky.social · 10/03/2026
It is much more difficult to stock it when it's locked, yes.
000
Will Dormann is on Mastodon @wdormann.bsky.social · 17/12/2025
Social media user swipes left on a picture in a post with multiple pictures in their web browser... Twitter, Mastodon: Swipes to next picture. BlueSky: Do nothing. I get that when Twitter doused itself in gasoline and lit a match, BlueSky had potential. But seriously. How is the web app SO BAD? 🤦‍♂️
000
Will Dormann is on Mastodon @wdormann.bsky.social · 15/12/2025
Social media user double taps image in their web browser... Twitter, Mastodon: Zoom in. BlueSky: Close image, re-open it. 🤦‍♂️
200
Will Dormann is on Mastodon @wdormann.bsky.social · 12/10/2025
There is nothing that distinguishes a CVE that is disputed because it's fake and one that is disputed because the vendor didn't want to acknowledge it. This is a problem.
000
Will Dormann is on Mastodon @wdormann.bsky.social · 05/06/2025
Did one really need to look any further than hearing that it used "bitcoin style encryption"?
040
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025
Eh, I just enabled passwordless for my 20-year-old hotmail account. And RDP still accepted my old password. (No Microsoft Authenticator required) 🤷‍♂️
010
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025
When you log in to windows using a Microsoft account (eg hotmail), you can use that account's credentials to RDP in. No RDS AAD or web view here.
110
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025
I don't know what RDS AAD is. Simple repro: 1) Log in to Windows 11 with a Microsoft account (eg hotmail) 2) Enable RDP 3) Connect to Windows via RDP using hotmail account 4) Change hotmail password 5) Connect to Windows via RDP using old hotmail password
120
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025
I'm using a web browser for this website.
010
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025
Testing GIF upload from an iPhone...
100
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025
With BlueSky, animated GIFs are uploaded with the video icon. Because GIF89a files are clearly videos and not images. Cross-posting apps don't recognize this silly behavior. (Yet??)
200
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025
If the desire is to implement your own homemade WDAC block policies, tread lightly. If you simply apply a "block this thing" policy, you might very well end up preventing Windows from booting, as a "block this thing" without a corresponding "allow this", well... WDAC will only block and not allow.😬
000
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025
If you wish to inspect an on-device (binary) policy file, you'll need WDACTools: github.com/mattifestati... With this, you can run ConvertTo-WDACCodeIntegrityPolicy to get a stripped-down human-readable XML policy.
github.com
GitHub - mattifestation/WDACTools: A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies
A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies - mattifestation/WDACTools
131
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025
If you enable HVCI and then run: ApplyWDAC -auto -enforce you'll be good to go, as it will pull the more-complete online list. github.com/vu-ls/applyw... If you can't enable HVCI, you'd need to wait for MS to fix WDAC to get complete coverage. But that's not going to happen if I am to believe MSRC.
github.com
GitHub - vu-ls/applywdac
Contribute to vu-ls/applywdac development by creating an account on GitHub.
100
Will Dormann is on Mastodon @wdormann.bsky.social · 09/01/2025
You've made both of these statements: - Threat actors are manipulating the ICT to bypass detection - Run the ICT checker Doesn't the former sort of invalidate the latter? 🤔 Or is hope that you've got one of the not-so-good attackers that result in an ICT flagging something?
010
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024
I suppose my gripe about the wording is that electricity itself has no sound. *Physical objects* energized by electricity can emanate sound by vibration. 😀
140
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024
Electric vehicles run on DC. Not AC.
280
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024
"they can hear electricity circulating but not enough to power anything else" I'm curious what electricity sounds like?
5260
Will Dormann is on Mastodon @wdormann.bsky.social · 25/12/2024
Sounds about right for the person who left the Superbowl early because Biden's Tweet got more attention than his. 😂 But heck, drawing attention to your and @kateconger.com 's book is surely a good idea. Everybody should read it!
090
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024
No, I don't have a Facebook or Reddit account. I suppose I was referring to Twitter and Mastodon. With either of those you can upload a media thing (image, animated, GIF, MP4, etc.), and the trigger to do that is you click a single "media" button. Separate buttons is completely unnecessary.
000
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024
BlueSky is the first social media app I've ever used that has a different icon to pick depending on what file type the media is. This seems unnecessarily complicated.
000
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024
The fact that BlueSky decides to take the GIF I uploaded and convert it to MP4 does not change the fact that what I'm loading is a GIF file and not a movie file. 🤷‍♂️
010
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024
Wait... Animated GIF images maybe need to be uploaded using the "Movie" icon, because GIF89a's are clearly not images? 🤔
120
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024
There goes my hopes for a viable post-Twitter platform where we all hang out. 😡
010
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024
Oh, BlueSky doesn't even support uploading animated GIFs. FFS why is this platform so slow to improve?
230
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024
So you have to use BlueSky directly to get animated GIFs? Lame...
110
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024
Testing multi-posting app Croissant...
210
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024
Eventually your client will get throttled with an HTTP 429 (Too many requests), or the site will otherwise fail. If you have a lot of posts to delete, it's going to take a while. But is worth it, IMO.
010
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024
You'll note that what you get is not just a blob of text that you'll have to grep through, but a FULLY FUNCTIONAL website including search! And all uploaded media will be there in the form that it was in on the Twitter website. Delete away, friends!
110
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024
2) Delete your posts. e.g. by pasting in this javascript to your authenticated web browser session's JavaScript console. gist.github.com/nsuan/a2e42d... Obviously closely inspect what you're about to paste, as pasting JavaScript into a web browser session can be VERY DANGEROUS.
gist.github.com
Delete all <s>anime.exe</s> tweets
Delete all <s>anime.exe</s> tweets . GitHub Gist: instantly share code, notes, and snippets.
120
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024
To those who still have posts remaining on the Nazi site for the sole purpose of being able to search through things that you've said in the past: 1) First download an archive of your data. (There might be a 1-day delay before you get it) x.com/settings/dow...
x.com
x.com
1102
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024
Did everybody enjoy that video streaming marvel that was the Mike Tyson fight last night?
1153
Will Dormann is on Mastodon @wdormann.bsky.social · 15/11/2024
Maybe. That's the time that I decided to pick Mastodon instead of here. We'll see how things look when the dust settles. I'm not married to any particular platform. It just would be nice for everybody to be in one place (LOL).
120
Will Dormann is on Mastodon @wdormann.bsky.social · 15/11/2024
The first time I had at it, my conclusion was that BlueSky was relatively pleasant to use but there were zero infosec people here. Or at least, anything I posted got nearly zero interaction. So I settled on Mastodon. We'll see how this plays out...
200
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024
Yeah, thanks. My OP was a touch misleading. I've posted a follow-up clarification to the best that I can with the small amount of characters that they allow on this site for some reason. 😕
010
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024
PDD is a company that makes Pinduoduo and Temu. The former is the version of the store for the Chinese market, made available in Chinese app stores. The latter is for the rest of the world, available in the Google Play Store. The company that runs Pinduoduo and Temu decided to use an 0day exploit.
001
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024
Did you notice that Temu dropped the bucks for *several* superbowl ads? Turns out that their Android app was utilizing an 0day exploit to achieve an advantage over their competition. Totally normal stuff going on here. arstechnica.com/information-...
264
Will Dormann is on Mastodon @wdormann.bsky.social · 13/02/2024
Every Patch Tuesday I'm reminded that in Microsoft's world, "No thanks" means "Ask me again later".
050
Will Dormann is on Mastodon @wdormann.bsky.social · 11/02/2024
Dear documentation authors, You... You do know that people can't click buttons on paper, right?
040
Will Dormann is on Mastodon @wdormann.bsky.social · 09/02/2024
watchTowr: Ivanti Connect Secure CVE-2024-22024 - Are We Now Part Of Ivanti? labs.watchtowr.com/are-we-now-p...
031
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024
Just to clarify, when I say "on a current Ivanti VPN box", this is what comes with the VMware version of the appliance that Ivanti provides for download, which is a 2023 version of the software. There may be some upgraded packages with newer versions of the Ivanti software. YMMV.
000
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024
This is just a spot check of a few execuables on the system. I didn't even look at any of the libraries. If customers knew what they were purchasing, do you think they'd go through with the purchase? Imagine a complete SBOM for *everything* on the box...
100
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024
Things on a currrent Ivanti VPN box: curl 7.19.7 2009-11-04 (14 years) openssl 1.0.2n-fips 2017-12-07 (6 years) perl 5.6.1 2001-04-09 (23 years) psql 9.6.14 2019-06-20 (5 years) cabextract 0.5 2001-08-20 (22 years) ssh 5.3p1 2009-10-01 (14 years) unzip 6.00 2009-04-29 (15 years)
100