Detailed analysis of attack exploiting Flash Player vulnerability CVE-2018-4878

So you have probably heard of Electron’s remote command injection vulnerability CVE-2018-1000006 in custom protocol handler. It’s not too…

tl;dr Remote code execution via a deserialization vulnerability on rubygems.org, a very popular hosting service for ruby dependencies. A fix was rolled out q...

Recently I took a look at Atom, a text editor by GitHub. With a little bit of work, I was able to chain multiple vulnerabilities in Atom into an actual Remot...

reversing an av engine to compose signatures capable of detecting classified documents

Системы глубокого анализа трафика (Deep Packet Inspection, DPI) — программно-аппаратные комплексы для классификации проходящего интернет-трафика по типу данных...

In this blog post I’m going to explain how to exploit CVE-2017-5123, a bug I found in the Linux kernel, and show how it can be used to escalate privileges, even with SMEP, SMAP and from inside the Chrome sandbox.

This is write up in which I’ll explain a vulnerability I recently found, and reported through Yahoo’s bug bounty program. When testing the security of web applications, doing reconnaiss…

Introduction NTLM authentication is the de-facto standard in corporate networks running Windows. There are a plethora of well-understood local attacks that take advantage of the way Windows perform automatic NTLM authentication, and abusing this feature is undoubtedly on the playbook of every penetration tester and red teamer. Here at Blaze

During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Tra…

XXE Out of Band testing, explaining how to execute XXE OOB attacks over HTTP & FTP. Additional explanation on XXE RCE.

Chaining a few bugs to gain remote code execution, via hard work & recon.

bucket-stream - Find interesting Amazon S3 Buckets by watching certificate transparency logs.

As a penetration tester or a bug bounty hunter, most of the times you are given a single domain or a set of domains when you start a…

Thanks to RTL-SDR.com reader 'flatflyfish' for submitting information on how to get Martin Marinov's TempestSDR up and running on a Windows system. If you didn't already know by definition "TEMPEST" refers to techniques used by some spy agencies to eavesdrop on electronic equipment via their unintentional radio emissions (as well as via sounds and vibrations). All electronics emit …

RESOLVED (dholbert) in Core - SVG. Last updated 2017-03-29.

I recently found myself prototyping an experimental scanning technique using JXBrowser, a library for using a PhantomJS-like browser in Java applications. Whilst creating a JavaScript to Java bridge

Analysis of the S8 data line locator

Chrome < 62 uxss exploit (CVE-2017-5124)

UPDATE: The Next Web wrote a story about my findings…

Easy Bugs for Hard Cash

> Preface Note: As always the following is just a digest of all the things I could observe by working on printers myself or facts from stuff I read about recently. Since this thread about the HP printer promo videos caught some attention I will try to shed some light onto the field which was displayed there. First of all we should keep in mind this was a promo video made by a company. So always ask yourself this: “How real are the displayed scenarios, or are these just ‘Hollywood fabrications...