Archive

Example of a simple homemade JavaScript obfuscator applied on a security fingerprinting script.

Application security issues found by Assetnote

👋🏼 introduction: This is a short write-up of how I progressed from discovering a Jenkins instance to getting shells on 8 Adobe Experience Manager servers and gaining edit access to a company’s main …

I've posted a writeup of this exploit and others using the same technique at https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn

This is 🍊 speaking

In December 2018, Amnesty International documented widespread targeted phishing attacks against human rights defenders (HRDs) in the Middle-East and North Africa, in the report "When Best Practice Isn…

Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while b…

Detect if the browser is running in Private mode (Promise based) - is-private-mode.js

Google has released Chrome 76 to the Stable desktop channel, with new features and 43 security fixes, with five of them being marked as High severity.

Hi Guys,

A few months ago, a contact reached out to me with an irresistible offer. I would be given the opportunity to experiment with an insanely rare, prototype development kit PlayStation Vita. The only ask…

Potentially dangerous files. Contribute to Bo0oM/fuzz.txt development by creating an account on GitHub.

Read More ›

Introduction I spent three months working on VLC using Honggfuzz, tweaking it to suit the target. In the process, I found five vulnerabilities, one of which was

Всем привет! Сегодня мы бы хотели рассказать об одной старой и почти всеми забытой атаке под названием DNS rebinding. Первые разговоры о ней начались еще в 2007...

Сегодня я совершенно случайно обнаружил, что личный кабинет Ростелекома занимается совершенно вредоносной деятельностью, а именно, сканирует локальные сервисы на...

Security issue that I found on a "https://Samy.pl" which is famous within the information security researchers. Samy Kamkar is an American privacy and security researcher, computer hacker, entrepreneu…

本文是对我在Bluehat Shanghai 2019演讲内容的一个拓展性总结。在本文中，我将总结2010年到2018年出现的Office相关0day/1day漏洞。我将对每种类型的漏洞做一次梳理，并对每个漏洞的相关分析文章进行引用和归类。

Пост пикабушника violentbunny

Take a look into how custom URI schemes can be used to leverage underlying vulnerabilities in applications.

On the last day of 2018, I discovered a type confusion vulnerability in Internet Explorer that yields a clean write-what-where primitive. It patched this April as CVE-2019-0752 . As an exercise, I wro…

Jaroslav Lobačevski Joplin ElectronJS based Client: from XSS to RCE

Using IDA’s Android debugger to dump secrets and encryption keys from a running app’s memory.

Taking a look at Instagram traffic by circumventing SSL Pinning protection in place using IDA Pro to reverse engineer Instagram imported libraries.

Use publicly available tools to quickly start fuzzing browsers.

Tips & Tricks to make your life easier as a pentester & bug bounty hunter