Archive

How to use browser features to help find DOM XSS. The invisible Messages of Gmail Last year, I looked for DOM XSS in Gmail website. Instead of using url params or the emails themselves as the source o

Всем привет! Сегодня мы бы хотели рассказать об одной старой и почти всеми забытой атаке под названием DNS rebinding. Первые разговоры о ней начались еще в 2007...

This is a special post because I fully based on another researcher, s1guza’s 0day. All of this story began from the following tweet: Siguza told us that his 0day was patched in the iOS 13.5 beta3. So this is actually a sandbox escape 0day for the newest, non-beta iOS version (13.4.1). In this post, I’ll show you how I reproduced that bug and wrote a malicious application that uses that 0day to steal the iMessage history!

Overview As our first article addressing the various methods of detecting the presence of VMMs, whether commercial or custom, we wanted to be thorough and associate it with our research on popular anti-cheat vendors. To kick off the article it’s important for those outside of the game hacking arena to understand the usage of hypervisors for cheating, and the importance of anti-cheats staying on top of cheat providers using them. This post will cover a few standard detection methods that can be used for both Intel/AMD; offering an explanation, a mitigation, and a general rating of efficacy. ...

turn server - into something you can - see - through 🏙 - trichimtrich/turnproxy

Introduction In this post I'm going to try to explain a new obfuscation technique I've come up with (at least I have not seen it before, pl...

Сооснователь сервиса, Роман Прокофьев, в колонке для MC Today рассказал о главных ценностях компании, которые они ищут в своих потенциальных сотрудниках. Думаем, вам тоже стоит поискать их в своих

TL;DR You can run an arbitrary command on a VMware Fusion guest VM through a website without any priory knowledge. Basically VMware Fusion is starting up a websocket listening only on the localhost. You can fully control all the VMs (also create/delete snapshots, whatever you want) through this websocket interface, including launching apps. You need to have VMware Tools installed on the guest for launching apps, but honestly who doesn’t have it installed.

Период самоизоляции – хорошее время для приобретения новых знаний. Новинка издательства «Альпіна Паблішер» «Как создать крутой рекламный текст. Принципы выдающегося американского копирайтера» как раз

Twitter — достаточно старый, но при этом все еще популярный у широкой аудитории сервис микроблогов, которым активно пользуются как рядовые пользователи, так и...

Настроили и запустили контекстную рекламу, а показов нет… Или они были, но пропали. Не спешите пинать техподдержку рекламных систем — пройдитесь по чек-листу. С...

This research started around summer time in 2019, when everything settled down after my talk in 2019, where I detailed how did I gained root privileges via a benign App Store application, that I developed. That exploit used a symlink to achieve this, so I though I will make a more general approach and see if this type of vulnerability exists in other places as well on macOS systems. As it turns out it does exists, and not just on macOS directly but also on other apps, it appears to be a very fruitful of issue, without too much effort I found 5 exploitable bugs on macOS, 3 in Adobe installer...

К концу этой статьи вы сможете понять, как на самом деле работает внимание, и превратить посетителей вашего сайта или приложения в потенциальных клиентов

I mostly wanted to share this post not because it’s a novel and unique attack, but to show the thought process of attacking this…

xdavidhu's bug bounty writeups.

Оценка степени конкуренции по ключевому запросу является одной из сакральных задач поисковой оптимизации. Надежда обнаружить незамеченный конкурентами запрос с...

With some luck and a couple of XSS bugs I was able to break the new Edge

A curated list of delightful Unicode tidbits, packages and resources. Foreword Unicode is Awesome! Prior to Unicode, international communication was grueling- everyone had defined their separate extended character set in the upperhalf of ASCII (called Code Pages) that would conflict- Just think, German speakers coordinating with Korean speakers over which

This is a blog post about how I found three vulns and chained them to get RCE in the Microsoft AttackSurfaceAnalyzer (ASA moving forward) GUI version. ASA uses Electron.NET which binds the internal Kestrel web server to 0.0.0.0. If permission is given to bypass the Windows OS firewall (or if used on an OS without one), a remote attacker can connect to it and access the application. The web application is vulnerable to Cross-Site Scripting (XSS). A remote attacker can submit a runID with embedded JavaScript that is executed by the victim using the ASA Electron application. Electron.NET does ...

Anti-fraud solutions reverse engineering

At Fighting Abuse @Scale 2019, speakers from Facebook, Google, LinkedIn, Microsoft, and YouTube discussed review systems, detection, mitigation, and more.