Udemy - Account Takeover
What happens when security configurations do not work as intended: an MFA gap at Udemy that let a threat actor take over already-compromised accounts, with CVSS scoring and the disclosure timeline.
offensive security · open-source tooling · disclosures
Penetration testing and security advisory by day. In the margins I build the tools I wish I had: KrakenHashes for cracking across a fleet, Porthole for driving coding agents from a phone over my own VPN, and Heimdall for the blue team.
★ 408 · ⑂ 42 · Go · updated 2026-11-11 · v3.0.1
Distributed password cracking for security teams. Agents wrap Hashcat across every GPU you own, one web UI runs the job.
★ 3 · ⑂ 2 · Go · updated 2026-11-09 · v2.0.0
Passive sensor for the LLMNR, NetBIOS, mDNS, WPAD and DHCPv6 chatter that Responder, Inveigh and mitm6 feed on, and for hosts that answer like a poisoner.
What happens when security configurations do not work as intended: an MFA gap at Udemy that let a threat actor take over already-compromised accounts, with CVSS scoring and the disclosure timeline.