A curated list of videos by established bug bounty hunters, showing you their recon methodologies, tools, and automation.

For Cloudflare customers, having Cloudflare is like paying a peace of mind insurance that your system will get 99% protection against…

The HTML Sanitizer is a great new API that allows web developers to filter untrusted HTML natively in the browser rather than use a JavaScript library such as DOM Purify. Microsoft created a similar A

Около двух десятков пакетов NPM воровали данные из форм, встроенных в мобильные приложения и сайты, с декабря 2021 года. Эксперты дали этой кампании название IconBurst, так как в основном малварь маскировалась под популярные пакеты ionic.

Translated version ( Russian version ) is in the comments hello boys, This is my first post in the forum and in the contest, so I wanted to make it something good. Sorry I am writing this article in English but If you have any question or anything unclear don't hesitate to ask me and I will...

Это логическое продолжение первой части шестой статьи: https://xss.is/threads/67021/ Название статьи для голосования пусть будет взято из этой части, так как CobaltStrike от А до Я уже было использовано в прошлом конкурсе, и повторяться как-то не в рамках приличия... То есть: [0day] Золотая...

Пару слов о ботнетах Все современные ботнет сети страдают одной проблемой - абузами на сервера управления, чем больше ваша сеть тем быстрее блокируют управляющий сервер. Разработчики прибегают к разным хитростям: делают списки серверов, генерацию доменов от фазы луны, fast-flux техники, .bit...

Hello everyone! I will be posting a series of articles regarding different attack vectors in PHP which can be exploited. Part 1 we will look at different interesting PHP functions. Buckle up, here we go! Before starting, there are a few prerequisites that has to be fulfilled if you want to...

I am using Windows Remote Desktop to connect to a server. I have enabled access to a local drive as per http://support.microsoft.com/kb/313292 but I'm trying to figure out how to access the drive ...

On this page you will find an overview of most of the available.rdp file settings for Remote Desktop and Remote Desktop Plus.

Capture The Flag, CTF teams, CTF ratings, CTF archive, CTF writeups

A true story on taking over a client’s Azure tenant via a successful phish. TL;DR A tempting phish got lots of users to disclose their passwords, and a lack of […]

This exploit was brought to you by “reading the manual”, mostly. It is the second local privilege escalation I found while doing an extremely low effort audit of Zimbra. You should read…

We discovered vulnerabilities in Horde Webmail that allow an attacker to execute arbitrary code on Horde instances by having a victim open an email

0x01 ForewordsRecently I see some discussions about arbitrary file upload in Java environment on Internet. The main takling points are how to bypass file name detection when uploading arbitrary file.

Use POSIX file capabilities and PHP to create a backdoor that opens a root back-channel to the attacker's PC on port TCP 53 when a PHP page is called with a special url.

UAC Bypass via DLL hijacking of Microsoft Support Diagnostic Tool (MSDT). The UAC bypass method described here is based on DLL hijacking which happens when loading the Bluetooth diagnostic package.

How to hide Visual Basic Scripts HTA in other files and generate self playing HTA files without the .hta extension.

Automated malware analysis with Hatching Triage, the high-volume sandbox solution for SOCs, CERTs, SOARs, and MSSPs.

SaaS vanity URLs can be spoofed and used for phishing campaigns and other attacks. In this article, we’ll showcase two Box link types, two Zoom link types, and two Google Docs link type that we were able to spoof.

Windows Defener... как много боли в этом слове. Вероятнее всего, если вы хоть краем уха были связаны с распространением ВПО -- данный антивирус уже успел доставить вам массу неудобств. Имеющий самую обширную облачную базу в мире АВ не мог остаться без внимания крипторов и малварщиков, в...

Please upgrade your Elementor websites

Ambionics Security team discovered an RCE in Laravel, when the framework is in debug mode.

CTF writeups from GatorSheavesMutably (https://ctftime.org/team/109518) - ctf-writeups/hxp-2020/heiko at master · aels/ctf-writeups

A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.

In 2019, our intelligence team reported ProcessHacker being hijacked to kill a list of targeted processes. Explore more on DoppelPaymer implementation here.