Archive

On the last day of 2018, I discovered a type confusion vulnerability in Internet Explorer that yields a clean write-what-where primitive. It patched this April as CVE-2019-0752 . As an exercise, I wro…

Jaroslav Lobačevski Joplin ElectronJS based Client: from XSS to RCE

Using IDA’s Android debugger to dump secrets and encryption keys from a running app’s memory.

Taking a look at Instagram traffic by circumventing SSL Pinning protection in place using IDA Pro to reverse engineer Instagram imported libraries.

Use publicly available tools to quickly start fuzzing browsers.

Tips & Tricks to make your life easier as a pentester & bug bounty hunter

Video write-up about the Real World CTF challenge "flaglab" that involved exploiting a GitLab 1day. Actually two CVEs were combined to achieve full remote code execution...

Amazon захватила 50% интернет-рынка в Америке. В прошлом году за пятинедельный период со Дня благодарения (22 ноября в США) 89% расходов клиентов крупнейших то...

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

(Please ignore mistakes if any!)

Once I performed pentest for one famous company. The object of testing was a platform for searching, licensing and managing music with…

**Summary:** Lack of proper ticket trick security leads to internal access on Gitlab instances. **I did not use support.gitlab.com instead just using support@gitlab.com email was suffice....

Edge Decided To Use An Undocumented Security Feature. Internet Explorer Didn't Get The Memo. by Mitja Kolsek, the 0patch Team ...

During H1-514, @filedescriptor reported an XSS issue in our Embedded App SDK that allowed for attacking legitimate apps through our platform, due to a missing protocol check on the...

Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi: from zero knowledge to zero-click RCE Introduction and motivation How wireless device works and starts up Interaction between Wi-Fi S…

Ash King - Hacking for fun and profit

TL;DR Persistence can be achieved with Appx/UWP apps using the debugger options. This technique will not be visible by Autoruns. Two different approaches exists (registry keys). Listed below are the t…

When conducting intrusion tests, knowledge of endpoints and exchanged data is mandatory to test targeted applications, devices, and remote servers. If the target provides an Android, or iPhone applica…

For those unfamiliar with modern advertising tech, iFrame Busters are HTML files hosted on publisher sites which allow ad creatives to extend outside of their standard boundaries. These expandable cre…

Recently i discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how i found & exploited it…

Gwendal Le Coguic, web developer and security researcher

In my previous blog post, I discussed different methods used to measure ads viewability. In the end of it, I've mentioned those methods could be spoofed by bad guys, and today I'll show you how. Origi…

In this work we present Picasso: a lightweight device class fingerprinting protocol that allows a server to verify the software and hardware stack of a mobile or desktop client.

We chose Airmail 3 as a target for reverse engineering to gain a better understanding of how MacOS applications work on a low-level.

Tor hidden services and reverse-proxy providers (e.g. CloudFlare) are useless if you are making simple mistakes. This is how you reveal the origin IPs.

## Introduction In Steam and other valve games (CSGO, Half-Life, TF2) there is a functionality to find game servers called the server browser. In order to retrieve the information about these...

IntroductionWhile DNS rebinding was first described nearly two decades ago, it has recently gained a second youth with the proliferation of insecure IoT devices and a series of highly publicized vulne…