Overview As our first article addressing the various methods of detecting the presence of VMMs, whether commercial or custom, we wanted to be thorough and associate it with our research on popular anti-cheat vendors. To kick off the article it’s important for those outside of the game hacking arena to understand the usage of hypervisors for cheating, and the importance of anti-cheats staying on top of cheat providers using them. This post will cover a few standard detection methods that can be used for both Intel/AMD; offering an explanation, a mitigation, and a general rating of efficacy. ...

turn server - into something you can - see - through 🏙 - trichimtrich/turnproxy

Introduction In this post I'm going to try to explain a new obfuscation technique I've come up with (at least I have not seen it before, pl...

tldr: For now, don't open .webarchive files, and check the Metasploit module, Apple Safari .webarchive File Format UXSS Safari's webarchive format saves all the resources in a web page - images, scripts, stylesheets - into a single file. A flaw exists in the security model behind webarchives that allows us

Период самоизоляции – хорошее время для приобретения новых знаний. Новинка издательства «Альпіна Паблішер» «Как создать крутой рекламный текст. Принципы выдающегося американского копирайтера» как раз

Twitter — достаточно старый, но при этом все еще популярный у широкой аудитории сервис микроблогов, которым активно пользуются как рядовые пользователи, так и...

Настроили и запустили контекстную рекламу, а показов нет… Или они были, но пропали. Не спешите пинать техподдержку рекламных систем — пройдитесь по чек-листу. С...

Techincal walkthrough

This research started around summer time in 2019, when everything settled down after my talk in 2019, where I detailed how did I gained root privileges via a benign App Store application, that I developed. That exploit used a symlink to achieve this, so I though I will make a more general approach and see if this type of vulnerability exists in other places as well on macOS systems. As it turns out it does exists, and not just on macOS directly but also on other apps, it appears to be a very fruitful of issue, without too much effort I found 5 exploitable bugs on macOS, 3 in Adobe installer...

К концу этой статьи вы сможете понять, как на самом деле работает внимание, и превратить посетителей вашего сайта или приложения в потенциальных клиентов

I mostly wanted to share this post not because it’s a novel and unique attack, but to show the thought process of attacking this…

xdavidhu's bug bounty writeups.

[Josh] has a series called Ham Radio Crash Course and a recent installment covers how you can grab satellite images directly from weather satellites. This used to be more of a production than it is…

Оценка степени конкуренции по ключевому запросу является одной из сакральных задач поисковой оптимизации. Надежда обнаружить незамеченный конкурентами запрос с...

With some luck and a couple of XSS bugs I was able to break the new Edge

A curated list of delightful Unicode tidbits, packages and resources. Foreword Unicode is Awesome! Prior to Unicode, international communication was grueling- everyone had defined their separate extended character set in the upperhalf of ASCII (called Code Pages) that would conflict- Just think, German speakers coordinating with Korean speakers over which

Evasion techniques

This is a blog post about how I found three vulns and chained them to get RCE in the Microsoft AttackSurfaceAnalyzer (ASA moving forward) GUI version. ASA uses Electron.NET which binds the internal Kestrel web server to 0.0.0.0. If permission is given to bypass the Windows OS firewall (or if used on an OS without one), a remote attacker can connect to it and access the application. The web application is vulnerable to Cross-Site Scripting (XSS). A remote attacker can submit a runID with embedded JavaScript that is executed by the victim using the ASA Electron application. Electron.NET does ...

Anti-fraud solutions reverse engineering

At Fighting Abuse @Scale 2019, speakers from Facebook, Google, LinkedIn, Microsoft, and YouTube discussed review systems, detection, mitigation, and more.

Lack of origin authentication (CWE-346) at IPN callback processing function allow (even unauthorized) attacker to remotely replace critical plugin settings (merchant id, secret key etc) with known to him and therefore bypass payment process (eg. spoof order status by manually sending IPN callback request with a valid signature but without real payment) and/or receive all subsequent payments (on behalf of the store).

I started building browser extensions more than 22 years ago, and I started building browsers directly just over 16 years ago. At this point, I think it’s fair to say that I’m entering …

tl;dr Я бы сказал, что Microsoft на несколько световых лет опередила всех в разработке инструментов для проектирования сложных веб-сайтов. Сейчас эти технологии...

Перед запуском контекстной рекламы полезно посмотреть на ключевые слова и объявления конкурентов. Так вы пополните семантику и получите новые идеи для текстов о...

OnlineHashCrack is a powerful hash cracking and recovery online service for MD5 NTLM Wordpress Joomla SHA1 MySQL OSX WPA, PMKID, Office Docs, Archives, PDF, iTunes and more!

TL;DR Встроенные средства macOS позволяют выполнить некоторые атаки на Wi-Fi-сети. В статье описывается, как с помощью встроенного в Macbook Wi-Fi адаптера Air...