Archive

The unusual technique invokes the Windows App Installer to deliver malware

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors) - PEASS-ng/linPEAS at master · carlospolop/PEASS-ng

XAR is a file archive format used in macOS, and is part of various file formats, including .xar, .pkg, .safariextz, and .xip files. XAR archives are extracted using the xar command-line utility. XAR was initially developed under open source, however, the original project appears to be no longer maintained. Apple maintains their own branch of XAR for macOS, which is published on the Apple Open Source website. The xar utility suffers from a logical vulnerability which allows files to be extracted outside of the intended destination folder, resulting in arbitrary file write anywhere on the filesystem (permissions allowing).

Александр Слобоженко, основатель медиабаинговой команды «Traffic Devils» и Семён Лавров, руководитель баинга, сделали сухой разбор арбитража трафика в Facebook на примере свежего мощного кейса. Содержание 1. Схема залива в Facebook 2. Возможные проблемы 3. Кейс 4. Аналитика по ГЕО 5. Релевантность крео и прилы 6. Разбор креатива 7. Подходы к крео Схема залива в Facebook...

Security Research & Bug Bounty Hunter

This post is a technical analysis of a recently disclosed Chrome JIT vulnerability (CVE-2021-30632) that was believed to be exploited in the wild. This vulnerability was reported by an anonymous researcher and was patched on September 13, 2021 in Chrome version 93.0.4577.82. I’ll cover the root cause analysis of the bug, as well as detailed exploitation.

Ever since Pointer Authentication Code (PAC) has been introduced, iPhone remained standing for more than two years on various pwn contests until TianfuCup 2020 (Project Zero has reported a remote zero click exploit in 2019). Ant Security and Qihoo 360 used two different bug chains respectively to successfully gained remote code execution with userspace sandbox escape on iPhone 11 with iOS 14.2.

Today i am going to share about `source code disclosure through exposed .git folder in Web Applications / Work environment`, A couple of…

Прелендинг – это история с неожиданными поворотами, трудностями и счастливым концом. И наша задача её не только создать, но и внедрить нативную рекламу, которая не вызовет отторжения. Содержание 1. Ошибка №1: переспам с названием 1.1. Пишем название в подписи под фотографией 1.2. Подзаголовки 1.3. Постскриптум 2. Ошибка №2: фейковые рекомендации 3. Ошибка №3: неправильная подача...

В прошлой статье я рассказал о грубейших ошибках большинства прелендингов. И пообещал сделать подробный разбор трёх реальных прокладок, ведь практика эффективней теории. И держу своё обещание. Содержание 1. Прелендинг средства от гипертонии 1.1. Ошибка №1: нет логотипа в шапке 1.2. Ошибка №2: плохой заголовок 1.3. Ошибка №3: слабое вступление 1.4. Ошибка №4: резкий рекламный переход...

Financially motivatedt threat actor breaks certificate parsing to avoid detection

Список сервисов аренды мобильных приложений под арбитраж трафика, подробное описание, условия, цены, контакты

List of antidebugging techniques applied to JavaScript (focused on browsers)

tl;dr — Abusing the Chromium Devtools Scope Pane to track debugging of specific javascript functions

RCE 0-day for GhostScript 9.50 - Payload generator - GitHub - duc-nt/RCE-0-day-for-GhostScript-9.50: RCE 0-day for GhostScript 9.50 - Payload generator

Last week a friend of mine asked me to debug/RE some phishing emails that had been sent to them. These phishing emails were visually very clever and looked identical to the real site! But as I looked at the javascript I frankly became embarassed for the developer.

Introduction This post describes the work we’ve done on fuzzing the Windows RDP client and server, the challenges of doing so, and some of the results. The Remote Desktop Protocol (RDP) by...

TL;DR With Administrator level privileges and without interacting with the GUI, it’s possible to prevent Defender from doing its job while keeping it alive and without disabling tamper protection by redirecting the \Device\BootDevice NT symbolic link which is part of the NT path from where Defender’s WdFilter driver binary is loaded. This can also be used to make Defender load an arbitrary driver, which no tool succeeds in locating, but does not survive reboots. The code to do that is in APTortellini’s Github repository unDefender. Introduction Some time ago I had a chat with jonasLyk of the Secret Club hacker collective about a technique he devised to disable Defender without making it obvious it was disabled and/or invalidating its tamper protection feature. What I liked about this technique was that it employed some really clever NT symbolic links shenanigans I’ll try to outline in this blog post (which, coincidentally, is also the first one of the Advanced Persistent Tortellini collective :D). Incidentally, this techniques makes for a great way to hide a rootkit inside a Windows system, as Defender can be tricked into loading an arbitrary driver (that, sadly, has to be signed) and no tool is able to pinpoint it, as you’ll be able to see in a while. Grab a beer, and enjoy the ride lads! Win32 paths, NT paths and NT symbolic links When loading a driver in Windows there are two ways of specifying where on the filesystem the driver binary is located: Win32 paths and NT paths. A complete analysis of the subtle differences between these two kinds of paths is out of the scope of this article, but James Forshaw already did a great job at explaining it. Essentially, Win32 paths are a dumbed-down version of the more complete NT paths and heavily rely on NT symbolic links. Win32 paths are the familiar path we all use everyday, the ones with letter drives, while NT paths use a different tree structure on which Win32 paths are mapped. Let’s look at WdFilter’s specific example:

Everyone knows what’s inside a computer isn’t really real. It pretends to be, sure, hiding just under the pixels — but I promise you it…

После публикации предыдущей статьи про отправку тикетов на риск пеймент (РП) при пустом списке рекламных аккаунтов (РА), FB как-то уж быстро начал требовать прикрепленный документ к этой форме, что добавило лишних телодвижений. Я написал скрипт, который парсит у соц акка, все РА с РП и по нажатию одной кнопки отсылает тикеты на разбан РП по...

Про XSS-уязвимости известно давным-давно — казалось бы, нужен ли миру ещё один материал о них? Но когда Иван Румак, занимающийся тестированием безопасности, поделился методологией их поиска на нашей...

Preface:

The "Forgot password?" feature and how DNS vulnerabilities may allow the takeover of user accounts.

This blog post analyzes the Frida and Jailbreak detection in PokemonGO for iOS.

Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this article is not intended to recommend you to perform an unauthorized vulnerability assessment. If you found any vulnerabilities in Cloudflare’s product, please report it to Cloudflare’s vulnerability disclosure program. TL;DR There was a vulnerability in the cdnjs library update server that could execute arbitrary

Introduction Finding DOM XSS can be tricky when it's buried in thousands of lines of code. We recently developed DOM Invader to help tackle this using a combined dynamic+manual approach to vulnerabili

Preface Today we’ll talk about the misuse of .LNK trigger keys as a means of achieving initial access and persistence. I first heard about this topic myself ...

Talawah Solutions

Gaining access to SS7 - Part 1: Finding an access point : https://t.co/6P9EQGMLw1 SCTP/SIGTRAN & SS7 Overview : https://t.co/5uR7rhwwuE Security Pen' Test Framework for the Diameter Protocol: https://t.co/i3T6XBcam3 Signaling Security in LTE Roaming: https://t.co/Uc1kcK3kbo

One of the factors contributing to Counter-Strike Global Offensive’s (herein “CS:GO”) massive popularity is the ability for anyone to host their own community server. These community servers are free to download and install and allow for a high grade of customization. Server administrators can create and utilize custom assets such as maps, allowing for innovative game modes.