Archive

A Qt and C++ GUI for radare2 reverse engineering framework - radareorg/cutter

Install macOS in a VirtualBox machine on Ubuntu. GitHub Gist: instantly share code, notes, and snippets.

Google Code-in is an online programming competition for students hosted by Google that takes place every year. When I was signing up for a second time, I put a payload into all the text fields. I didn…

We identified a new exploit kit we named Novidade that targets home or small office routers by changing their Domain Name System (DNS) settings via cross-site request forgery (CSRF), enabling attacks …

This talk was presented at bugSWAT. Video of the talk is at https://youtu.be/B5ZyYTKp4gc Talk features: Password manager issue with iframe/CSP sandbox https://crbug.com/825258, https://bugzilla.mozill…

During our first security investigation for critical vulnerabilities affecting Microsoft, we came across multiple vulnerabilities that, when chained together, allow an attacker to take over any Micros…

A Fuzzing Drill Hits the Motherlode Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities repor…

This is the story of how I was able to get remote code execution on Hubspot 's servers by exploiting a vulnerability in HubL expression la...

[ WebAsm OOB ArrayBuffer ] WebAsm instance builder reads imports from an attacker-controlled object in v8/src/wasm/wasm-module.cc:1625 ProcessImports(). Imports can be getters, which run while the ins…

Disclaimer: This blog represents my personal ideas and experiences and not my employer. tl;dr MSBuild.exe and all its parts are absolutely...

it works on iOS 12.1.1, meaning every iOS version since 12.0 is vulnerable

André Baptista - Reverse engineer, exploitation researcher and bug bounty hunter.

分享奇虎360公司的技术，与安全的互联网共同成长。

A new type of malicious MS Office document has appeared: a PowerPoint document that executes a PowerShell command by hovering over a link with the mouse cursor (this attack does not involve VBA macros…

Last week a new exploitation technique for PHP applications was announced at the BlackHat USA conference. Find out everything you need to know in this blog post.SummaryThe security researcher Sam Thom…

Hello Everyone!

Hello Everyone,

As part of our platform research in Zimperium zLabs, I have recently disclosed a critical vulnerability affecting multiple high-privileged Android services to Google. Google designated it as CVE-2018-…

Bypassing CSP with Google Analytics

tl;dr There was a remote code execution vulnerability on packagist.org, the default package server behind Composer, a PHP package manager. Packagist currentl...

Speaker: Grant Jordan WiseCrack Tools Every time you look at your inbox, there it is... SPAM! Your penis needs enlargement, a horny single girl from Russia "...

NES-style CSS Framework | ファミコン風CSSフレームワーク

“Why isn't Google immediately dropping such apps from the Play store and advising users to uninstall them?” one analyst asked.

This is a follow up post to How Hacker News ranking algorithm works. This time around I will examine how Reddit’s story and comment…

Большинство разработчиков знают и любят github pages. На случай, если вы не встречались с ними — этот сервис даёт возможность создать статический сайт из...

In DIMVA 2018

Blind-XSS is a powerful attack, now i will talk about a technique i have used in Bug Bounty programs to find it..

Surveillance takes on different character when it trickles down to more ordinary, everyday users. The significance and threat from IMSI-catchers is multiplied when a lot more people can deploy one usi…