Archive

Disclaimer: This blog represents my personal ideas and experiences and not my employer. tl;dr MSBuild.exe and all its parts are absolutely...

it works on iOS 12.1.1, meaning every iOS version since 12.0 is vulnerable

André Baptista - Reverse engineer, exploitation researcher and bug bounty hunter.

分享奇虎360公司的技术，与安全的互联网共同成长。

A new type of malicious MS Office document has appeared: a PowerPoint document that executes a PowerShell command by hovering over a link with the mouse cursor (this attack does not involve VBA macros…

Last week a new exploitation technique for PHP applications was announced at the BlackHat USA conference. Find out everything you need to know in this blog post.SummaryThe security researcher Sam Thom…

Hello Everyone!

Hello Everyone,

As part of our platform research in Zimperium zLabs, I have recently disclosed a critical vulnerability affecting multiple high-privileged Android services to Google. Google designated it as CVE-2018-…

Bypassing CSP with Google Analytics

tl;dr There was a remote code execution vulnerability on packagist.org, the default package server behind Composer, a PHP package manager. Packagist currentl...

Speaker: Grant Jordan WiseCrack Tools Every time you look at your inbox, there it is... SPAM! Your penis needs enlargement, a horny single girl from Russia "...

NES-style CSS Framework | ファミコン風CSSフレームワーク

“Why isn't Google immediately dropping such apps from the Play store and advising users to uninstall them?” one analyst asked.

This is a follow up post to How Hacker News ranking algorithm works. This time around I will examine how Reddit’s story and comment…

Большинство разработчиков знают и любят github pages. На случай, если вы не встречались с ними — этот сервис даёт возможность создать статический сайт из...

In DIMVA 2018

Blind-XSS is a powerful attack, now i will talk about a technique i have used in Bug Bounty programs to find it..

Surveillance takes on different character when it trickles down to more ordinary, everyday users. The significance and threat from IMSI-catchers is multiplied when a lot more people can deploy one usi…

This is 🍊 speaking

Hello Everyone,

We delve a bit deeper into WebExtension security featuring 5 bugs

A Pwn2Own exploit chain. Contribute to saelo/pwn2own2018 development by creating an account on GitHub.

Relatively recently, I switched from searching vulnerabilities on random sites to Bug Bounty sites, and for many people this choice seems…

This is a little nifty trick for detecting virtualization environments. At least, some of them. Anytime you restore the snapshot of your virtual machine your guest OS environment will usually run some…

Awesome XSS stuff. Contribute to s0md3v/AwesomeXSS development by creating an account on GitHub.

The shortage of proficient cyber operators in a world now dependent on connectivity and information has left nations scrambling to build capabilities in a vo...

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code. Attackers could use this for malicious purposes such as phishing, as the do…