Archive

Hello Everyone,

We delve a bit deeper into WebExtension security featuring 5 bugs

A Pwn2Own exploit chain. Contribute to saelo/pwn2own2018 development by creating an account on GitHub.

Relatively recently, I switched from searching vulnerabilities on random sites to Bug Bounty sites, and for many people this choice seems…

This is a little nifty trick for detecting virtualization environments. At least, some of them. Anytime you restore the snapshot of your virtual machine your guest OS environment will usually run some…

Awesome XSS stuff. Contribute to s0md3v/AwesomeXSS development by creating an account on GitHub.

The shortage of proficient cyber operators in a world now dependent on connectivity and information has left nations scrambling to build capabilities in a vo...

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code. Attackers could use this for malicious purposes such as phishing, as the do…

This past Patch Tuesday , Microsoft released an update for Internet Explorer (IE) to address CVE-2018-8460 . The vulnerability exists in IE 11 on all supported versions of Windows. It falls into the g…

We all love Markdown, right? It’s a fast and user-friendly way to beautify our documentation. Well, all that glitters is not gold, in this case not for system administrators.

While doing my preperation for the OSCE i found an exploit for the coolpalyer+ version 2.19.1 from 2009. I decided to check this vulnerability in the recent software version (2.19.6) on my Windows 10 …

I’ve learned recently that the iOS 11 camera app will now automatically scan QR codes and interpret them. This is pretty cool, until now you needed special apps to do that for you on iOS. When scannin…

Explanation of hidden messages in JavaScript property names

(CVE-2018-8495) Chaining small bugs together to achieve RCE

“Hitting and kicking” the bundled App of their widest European distribution company.

Vulnerabilities Summary A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. T…

The number of Flash Player exploits has recently declined, due to Adobe’s introduction of various measures to strengthen Flash’s security. Occasionally, however, an exploit still arises. On January 31…

Testing

new Web attack vector abusing the Edge Side Include (ESI) features common in caching services and product. We will explain the conditions required for exploitation along with 3 example…

When exploiting real world software or devices, achieving arbitrary code execution on a system may only be the first step towards total compromise. For high ...

Welcome to the XSS Challenge Wiki! Contribute to cure53/XSSChallengeWiki development by creating an account on GitHub.

Detecting a hypervisor on Windows 10 is relatively simple, but due to the simplistic nature of the currently published detection vectors it’s likely that they are also relatively simple to spoof or…

В статье разбираются популярные мифы и сценарии мошенничества с бесконтактными системами оплаты на примере настоящего POS-терминала, карт PayPass/payWave и...

Here’s a cool trick: try downloading this picture and looking at it in your file browser: If your computer is like mine, the output picture should look pretty different! Here’s what I see: So what hap…

Планировал ли я попасться? Конечно! Если вы посещали домашнюю страницу Steam в воскресенье вечером, вы могли заметить новую игру: «Смотрим на высыхание...

Привет, Хабр! Сегодня я расcкажу за что же Valve заплатила наибольшие баунти за историю их программы по вознаграждению за уязвимости. Добро пожаловать под кат!...

Introduction A few months ago Will Dormann of CERT/CC published a blog post [1] describing a technique where an adversary could abuse Microsoft Outlook together with OLE objects, a feature of Microsoft Windows since its early days, to force the operating system to leak Net-NTLM hashes. Last year we

## Summary: `brave://` protocol was introduced as a replacement for `AsarProtocolHandler`(or something like that) in `brave/muon` after #375329. However, fix for #375329 introduced a new much...