TL;DR

In this blogpost I’ll explain my recent bypass in DOMPurify – the popular HTML sanitizer library. In a nutshell, DOMPurify’s job is to take an untrusted HTML snippet, supposedly coming from an end-user, and remove all elements and attributes that can lead to Cross-Site Scripting (XSS). This is the bypass: Believe me that there’s not ...

Prototype pollution is a vulnerability that is specific to programming languages with prototype-based inheritance (the most common one being JavaScript). While the bug is well-known for some time now, it lacks practical examples of exploitation. In this post, I'm showing how to exploit it to achieve Remote Code Execution in Kibana.

This is 🍊 speaking

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities - sslab-gatech/pwn2own2020

Text rendering quality is an amazingly complicated topic, with hardware, settings, fonts, differing rendering engine philosophies, and user preferences all playing key roles. In some cases, however…

Search and explore code

In this article I’ll cover the prototype pollution vulnerability and show it can be used to bypass client-side HTML sanitizers. I’m also considering various ways to find exploitation of prototype pollution via semi-automatic methods. It could also be a big help in solving my XSS challenge. Prototype pollution basics Prototype pollution is a security vulnerability, ...

Finding Google Meet phone numbers and bruteforcing PINs to join random meetings

We are in 2020 and the US president is about to ban TikTok, a video-sharing social network mobile app, because “it poses a risk to US…

A story about macOS File Quarantine, 10years old bug, OneDrive entitlements and UX Security in apps.

Quarantine nights Exploring File Quarantine handling in macOS Apps / @Metnёw

Accenture's blog shares an exploitation exercise for CVE-2020-1062, a recent Internet Explorer (IE) use-after-free (UAF) vulnerability. Read more.

Источник: unsplash.com По словам Джеки Стюарта, трехкратного чемпиона мира по гонкам Формулы-1, понимание автомобиля помогло ему стать лучшим пилотом: «Гонщику...

Back in October 2019 we detected a classic watering-hole attack that exploited a chain of Google Chrome and Microsoft Windows zero-days. In this blog post we’d like to take a deep technical dive into the attack.

Hi everyone! 👋 If you have been following my blog then you might have already read the article on reverse engineering an Android app by writing custom smali code. I am still very much a reverse engineering beginner so after that article, I got to learn about Frida. I was told that Frida is much faster and a lot easier for scenarios where I want to snoop on functions. Well, I am glad to report that all the suggestions were absolutely correct.

In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Pengsu Cheng and Yazhi Wang of the Trend Micro Research Team detail a recent code execution vulnerability in Microsoft Windows. The bug was originally discovered and reported by Zhipeng Huo (@R3dF09) of Tencent Sec

Several days ago I came across an interesting entry in the curious ‘ICS Future News’ blog run by Patrick Coyle. Before anyone becomes alarmed, the description of this blog is crystal clear about its contents: “News about control system security incidents that you might see in the not too distant future. Any similarity to real people, places or things is purely imaginary.” IOActive provides research-fueled security services, so when we analyze cutting-edge technologies the goal is to stay one step ahead of malicious actors...

Простейшие правки текста твоего прелендинга гарантированно увеличивают пробив и конверт связки. Доказано внутренним отделом баинга MONEY4LEADS на больших объёмах. 1. Обосновывай утверждения ссылками на авторитетные источники! Чтобы усилить текст проклы необходимо все важные и непонятные термины или утверждения завязать на авторитетных источниках. Тогда ваш текст будет выглядеть не как поток пустых слов, а приобретет некую...

A place to discuss and post TikTok reverse engineering research.

How I Finally could Got into an Internal Network (and could accessing all of their internal assets) by Using Various Vulnerabilities.

A vulnerability in Bitdefender Antivirus allowed any website to run arbitrary code with user's privileges. This was caused by issues very similar to ones found in other antivirus products before.

In this post I'll look at some use-after-free vulnerabilities in Chrome which were the result of object lifetime misassumptions based on objects being kept alive unexpectedly in audio callbacks.

DLL Hijacking is a popular technique for executing malicious payloads. This post lists nearly 300 executables vulnerable to relative path DLL Hijacking on Windows 10 (1909), and shows how with a few lines of VBScript some of the DLL hijacks can be executed with elevated privileges, bypassing UAC.

Gsuite is an immensely powerful tool for account administration. It allows the administrator to control just about anything regarding the user accounts in his organization, from determining how one can login and which apps he can access, to which contacts are allowed and what Email headers should be applied. This last