Archive

This XSS cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of ...

In December of 2018, we received a report of a vulnerability in Microsoft Office from Andrea Micalizzi, also known as rgod, who is one of our frequent contributors. It was patched this April as CVE-20…

CVE-2019-1208, a use-after-free vulnerability, could corrupt valid data, crash a process, and enable arbitrary or remote code execution.

分享奇虎360公司的技术，与安全的互联网共同成长。

We show that security controls put in place by iot device manufacturers are insufficient against attacks carried out by remote adversaries. This research project aimed to uncover and leverage new tech…

Server-Side Template Injection isn't exactly a new vulnerability in the world of web applications. It was made famous in 2015 by James Kettle in his famous blogpost on PortSwigger blog. In this post, …

Revisiting Helpviewer.app to hack Parallels for Mac

Using JavaScript and frameworks like Tensorflow.js is a great way to get started and learn more about machine learning. In this article, Charlie Gerard covers the three main features currently available using Tensorflow.js and sheds light onto the limits of using machine learning in the frontend.

Это longread будет друзья и довольно откровенный, но я чего-то не видел подобных статей. Тут масса опытных ребят в части Интернет-магазинов (разработки и продв...

Example of a simple homemade JavaScript obfuscator applied on a security fingerprinting script.

Application security issues found by Assetnote

👋🏼 introduction: This is a short write-up of how I progressed from discovering a Jenkins instance to getting shells on 8 Adobe Experience Manager servers and gaining edit access to a company’s main …

I've posted a writeup of this exploit and others using the same technique at https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn

This is 🍊 speaking

In December 2018, Amnesty International documented widespread targeted phishing attacks against human rights defenders (HRDs) in the Middle-East and North Africa, in the report "When Best Practice Isn…

Virtual Machine (VM) detection is nothing new. Malware has been doing it for over a decade now. Over time the techniques have advanced as defenders learned new ways of avoiding VM detection. A while b…

Detect if the browser is running in Private mode (Promise based) - is-private-mode.js

Google has released Chrome 76 to the Stable desktop channel, with new features and 43 security fixes, with five of them being marked as High severity.

Hi Guys,

A few months ago, a contact reached out to me with an irresistible offer. I would be given the opportunity to experiment with an insanely rare, prototype development kit PlayStation Vita. The only ask…

Potentially dangerous files. Contribute to Bo0oM/fuzz.txt development by creating an account on GitHub.

Read More ›

Introduction I spent three months working on VLC using Honggfuzz, tweaking it to suit the target. In the process, I found five vulnerabilities, one of which was

Всем привет! Сегодня мы бы хотели рассказать об одной старой и почти всеми забытой атаке под названием DNS rebinding. Первые разговоры о ней начались еще в 2007...

Сегодня я совершенно случайно обнаружил, что личный кабинет Ростелекома занимается совершенно вредоносной деятельностью, а именно, сканирует локальные сервисы на...

Security issue that I found on a "https://Samy.pl" which is famous within the information security researchers. Samy Kamkar is an American privacy and security researcher, computer hacker, entrepreneu…

本文是对我在Bluehat Shanghai 2019演讲内容的一个拓展性总结。在本文中，我将总结2010年到2018年出现的Office相关0day/1day漏洞。我将对每种类型的漏洞做一次梳理，并对每个漏洞的相关分析文章进行引用和归类。

Пост пикабушника violentbunny