Dominic White

Hacker at Orange Cyberdefense’s SensePost Team

Twitter: https://twitter.com/singe
Work Blog: https://sensepost.com/blog
Personal Blog: https://singe.za.net
Get in Touch: https://hello.singe.za.net

Public Key

npub1pfnwnq4gjrap2f2eelmhd5zlpqw2dtrjegk4g2qh64wppa8lm8lsma8d8k

NIP-05 Address

singe_at_chaos.social@momostr.pink

Profile Code

nprofile1qqsq5ehfs25fp7s4y4vulamk6p0ss89x43ev5t259qta2hqs7nlanlcprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy8hwumn8ghj7mn0wd68ytnddakszrthwden5te0dehhxtnvdakqt6tgf4

Publishing to

relay.momostr.pink

nostr.mom

nos.lol

Author Public Key

npub1pfnwnq4gjrap2f2eelmhd5zlpqw2dtrjegk4g2qh64wppa8lm8lsma8d8k

Show more details

Last Notes

2026-08-07 14:29:04 UTC

- reply

And unlike traditional cyber insider defence they have access to the attackers thoughts! Those thoughts appear to have revealed the patterns of abuse regularly. This speaks to a scary lack of monitoring of high autonomy agents that can have vast implications beyond just cyber. (3/3)

2026-08-07 14:29:03 UTC

- reply

A shared package proxy vulnerable to file writes with a simple PUT, that was exploited with hundreds (thousands?) of writes by many different agents speaks both to shoddy security, monitoring and a failure of imagination. Then to have it happen again without a major rethink! (2/3)

2026-08-07 14:29:03 UTC

I haven’t settled my thoughts on the OpenAI incident but I can’t help but feel that the threat modelling & security engineering applied up-front to long-term xhigh training runs with no cyber guard-rails was seriously shoddy. Easy to say after the fact. (1/3)

2026-07-29 11:39:04 UTC

I’ve seen a few dry runs of the absolutely fire talk Reino has prepped for everyone at @npub1dqd…8xy4 this year. Want to see multiple exploit chains on a widely deployed PED device deemed so impactful the vendor asked us to wait two years to disclose, then catch “Very Pwned” https://info.defcon.org/defcon34/content/66621
https://assets.chaos.social/media_attachments/files/117/003/068/323/410/516/original/e4a373676564eed6.jpg

2026-06-13 15:39:11 UTC

- reply

first I’ve seen that. My code is open source at https://github.com/singe/QuantumHello and I can’t see theirs to check overlap. But it’s a pretty simple idea that’s basically just a variation on:
`openssl s_client -connect example.com:443 -servername example.com \
-tls1_3 -groups X25519MLKEM768`

2026-06-13 10:05:56 UTC

- reply

Oh, and the code is at https://github.com/singe/QuantumHello if you’d just like a little go cmd for checking yourself.

2026-06-13 10:04:44 UTC

- reply

You'll no doubt enjoy the irony that this site does not in fact support PQ. But I'd be interest in hearing what real risk that presents.

2026-06-13 10:00:17 UTC

Check whether a site supports post quantum crypto* https://quantumhello.xyz
* Well hybrid PQ key exchange in the form of TLS 1.3 with X25519MLKEM768
https://assets.chaos.social/media_attachments/files/116/742/213/955/170/509/original/8732165a2b8d34f6.png

2026-01-23 05:10:40 UTC

- reply

that’s a really nice summary of the convo.

2026-01-19 16:39:27 UTC

- reply

I hear ya. My knee jerk agreement with you was “don’t rewrite grep” but honestly if it’s learning you want rewriting grep is probably a better approach. If it’s speed you want and a brief search didn’t turn up something close then why not. For context my recent exp was the Burp App Store which didn’t have a simple global sed-like tool. Perhaps an argument for unix philosophy in tooling too.

2026-01-19 16:27:46 UTC

- reply

that’s if your goal is to make something globally useful. If your goal is to solve your current problem it’s a different set of incentives.

2026-01-19 16:18:05 UTC

We’ve crossed the rubicon where for many simple tech use cases it’s easier to vibe code exactly what you want than it is to research several existing solutions and test them.

2026-01-19 15:11:34 UTC

- reply

I’ll need to look closer but it feels like they would be more work than what I needed.

2026-01-19 15:02:11 UTC

In Portswigger's Burp I needed a way to do Match & Replace globally across all utilities, not just the proxy so I wrote an extension https://github.com/singe/burp_global_match_replace
https://assets.chaos.social/media_attachments/files/115/922/362/213/874/789/original/4bad8ef67b50b578.png

2025-12-24 12:01:06 UTC

We (Orange Cyberdefense) are attempting to become a CVE CNA & in prep for that collected the various vulns we had reported over the years that had corresponding public information. 108 of them! It’s mostly a vanity list but will be where we publish new vulns in future. https://advisories.orangecyberdefense.com/advisories

2025-11-18 17:07:36 UTC

Here’s a free scanner for that FortiWeb CVE-2025-64446 I made for you. https://github.com/sensepost/CVE-2025-64446

2025-05-28 07:29:21 UTC

@npub12ts…x422 Hello and welcome back to ZA. Looking forward to your talk today.

2025-05-26 16:50:13 UTC

- reply

Something pandoc can do?

2025-05-11 08:03:11 UTC

- reply

Its always been like that. Early twitter, late twitter too.

2025-04-28 09:55:23 UTC

Working with s/mime on macOS has first class support with the "security cms" command and keychain. Here's how to replace openssl with it, with the mutt mail client being the specific use case https://github.com/singe/smutt

2025-04-26 21:43:14 UTC

Microsoft Outlook is pants at usability and running a fat GUI isn’t great for security. About a year ago I went on a mission to make mutt (the CLI mail client) work in a sandbox so I could read my work Microsoft365 mail nicely and more securely. Here’s how https://github.com/singe/muttpack

2025-04-14 12:24:31 UTC

Amazing that despite numerous C2 comms to this IP from malware, it's still clean as a whistle on VT. So much for all that vaunted threat intel helping us clean up malicious comms.
https://www.virustotal.com/gui/ip-address/45.144.53.145/relations
https://assets.chaos.social/media_attachments/files/114/336/295/100/488/856/original/159714b694663f1d.png

2025-04-06 18:11:07 UTC

I’m increasingly convinced that AI is less likely to replace junior hackers & more likely to replace the seniors who refuse to use it.
Juniors are more open to experimenting with it, & are … cheaper. The wave of layoffs in security in 2023 targeted a lot of seniors due to cost.

2025-03-05 10:53:26 UTC

Prompt engineering made sense in the early days of diffusion models where you knew the training set and could weight certain styles more heavily. But I’m finding it increasingly less important with LLMs. Instead, dumping the system prompt and knowing what tools it has available is way more useful.

2024-12-02 09:17:03 UTC

- reply

and no weird looks?

2024-12-02 09:11:28 UTC

Is it just me that struggles with greeting people at work? My preferred approach is to just shake everyone’s hand, or if the person is from a “no touching” culture a slight head bow with no difference across genders. But I regularly get puzzled looks or awkward expressions. What am I missing?

2024-11-08 06:11:57 UTC

- reply

absolutely, and the disinformation is so tightly wound into that nobody can differentiate. I’m interested in the idea of https://ground.news/ and its blind spot feed as a potential counter to it.

2024-11-08 04:48:17 UTC

I’m genuinely worried about a Trump presidency at a time where we have a proxy war in Eastern Europe with N Korea allied with Russia against “the west”. A proxy war in the Middle East with “the west” vs Iran & proxies. China ready to move on Taiwan. Weak & divided European leadership …

2024-11-08 04:36:12 UTC

2/2 believe in and want to see. Made possible by Trump’s lack of firm policy objectives & capricious ever-shifting statements. It’s hard to accuse someone of flip flopping when they’ll doing it in the same sentence. It somehow raises the noise floor allowing a blank canvas for a voter to project to.

2024-10-29 19:47:42 UTC

I’m doing Movember this year with a focus on raising awareness about colon cancer, since it typically kills more men than prostate & testicular cancer & it took my Dad. I’d appreciate it if you shared my page, joined me, or donated for cancer research. https://ex.movember.com/mospace/15243648

2024-10-25 06:35:15 UTC

- reply

call me vain - but that there’s no reference to the original research behind the field work makes me sad. https://m.youtube.com/watch?v=3HFiv7NvWrM & https://github.com/sensepost/birp
@npub1d86…jwwp is involved though and is the OG progenitor of so much of it, who’s still working on it and mentoring new peeps like Michelle.

2024-10-21 18:25:26 UTC

If you had to recommend one place for a user to report phishing URLs that would lead to the widest dissemination to list that would actually block it, and/or encourage someone to investigate it - what would it be? Virustotal, safe browsing, somewhere else?

2024-10-12 16:05:22 UTC

Microsoft on mitigating Kerberoasting https://www.microsoft.com/en-us/security/blog/2024/10/11/microsofts-guidance-to-help-mitigate-kerberoasting/
I’d love to stop seeing this vuln in so many reports.
https://assets.chaos.social/media_attachments/files/113/295/302/241/586/884/original/117c7afd0c90f683.jpeg

2024-09-11 04:53:38 UTC

In January 2020 a Raspberry Pi4 B 2G cost R720 it now costs R950. I was shocked at the 32% price increase. A quick calc showed that was only* 6.12% annual average inflation - and I was once again reminded how bad humans** are at understanding compounding effects.
* that’s not bad for South Africa
** I may be generalising too much - at least me

2024-08-26 18:47:29 UTC

This was a keynote I gave to our first BSides in Johannesburg recently. It covers what I think a community needs to do to create great hackers and warns of the dangers of racing to the bottom. While it focuses on South Africa - it’s, I think, more widely useful.
https://youtube.com/watch?v=Ri5DoRRnGWs (or on invidious https://yewtu.be/watch?v=Ri5DoRRnGWs)

2024-08-11 00:41:14 UTC

Something in @npub1fdr…lvhs’s @npub1dqd…8xy4 talk has been sitting with me all day. To summarise badly:
Tech workers were looked after when it was a scarce skill. The layoffs make it clear it isn’t as scarce anymore.
As the saying goes - the future is here just not evenly distributed.
Abused amazon delivery/warehouse workers are the tech worker future.
The only defense is to unionise.