Reading Uber’s Internal Emails
Uber’s subdomain takeover
A Guide To Subdomain Takeovers
HackerOne's Hacktivity feed — a curated feed of publicly-disclosed reports — has seen its fair share of subdomain takeover reports. Since Detectify's fantastic series on subdomain takeovers, the bug b…
Windows Offender: Reverse Engineering Windows Defender's Antivirus Emulator by Alexei Bulazel
[BLACKHAT US 2018] WebAssembly: A New World of Native Exploits on the Browser by Justin Engler and Tyler Lukasiewicz
Using PoolTags to Fingerprint Hosts
Commonly, malware will fingerprint the host it executes on, in an attempt to discover more about its environment and act accordingly. Part of this process is quite often dedicated to analyzing spec…
Clickjackings in Google worth 12644.7$
clickjacking in google and…
Why so Spurious? (BlackHat 2018) - Final
Error-Prone x86/x64 CPU "Feature" can be Abused to Achieve Local Privilege Escalation on Many Operating Systems
CS:GO RCE 0-day - Real World CTF Qualifiers 2018
This was the P90_Rush_B challenge from Real World CTF Qualifiers - 2018, in which we participated as perfect blue This challenge was solved by @j0nathanj and @VoidMercy_pb. Unfortunately we did not ma…
Светлые паттерны Амазона
1 августа 2018 года была опубликована статья "Тёмные паттерны Amazon", мало того, что переводная, так и кроме этого содержащая крайне мало фактических данных,...
downloaded are being scanned by the antivirus program
When IOfficeAntiVirus::Scan method is called by the programs (or internally via IAttachmentExecute) the system enumerates the Registry, collects info about all components implementing IOfficeAntiVirus, and stores them inside the following location
LFI and SSRF via XXE in emblem editor
This summary is provided by the researcher who submitted this report, @alexbirsan ....
Google Open URL Redirection Vulnerability which does the Social Engineering part too.
on | | | | | | Twitter: @teh_h3ck Email: vag[d0t]mourikis[@]gmail.com Open URL Redirection definition, quoted by OWASP: "An open redirect is an application that takes a parameter and redirects a user …
UWP Localhost Network Isolation and Edge
“feature” added to Windows to support Edge accessing the loopback network interface. For referenc...
Google Chrome pdfium shading drawing integer overflow lead to RCE
Vulnerability Credit Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team 1. Vulnerability Description CVE：CVE-2018-6120 Affected versions：Chrome Version < 66.0.3359.170 2. Vulnerability analysis 2.1 Vulner…
Gerrit Code Review
RFID Thief v2.0
Building and using the RFID Thief v2.0 for long range RFID cloning
Новая техника атак на основе Meltdown. Использование спекулятивных инструкций для детектирования виртуализации
Атака Meltdown открыла новый класс атак на процессоры, использующий архитектурные состояния для передачи информации. Но спекулятивное исполнение, которое было...
Advanced Mobile Malware Campaign in India uses Malicious MDM
A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group
ssrf exploiting url parser in trending programming languages
x0rz/tweets_analyzer
Tweets metadata scraper & activity analyzer
EagleEye
Stalk your Friends. Find their Instagram, FB and Twitter Profiles using Image Recognition and Reverse Image Search.
Ubuntu Pastebin
CVE-2015-3784 Apple iOS Office Viewer XXE vulnerability
1. Vulnerability Properties
Exploiting MS15-076 (CVE-2015-2370)
A few weeks ago (July 14, 2015), Microsoft had a busy patch Tuesday fixing quite a few privilege escalation vulnerabilities. Among these was a bug in DCOM/RPC which allows for an...
CVE-2015-2419 – Internet Explorer Double-Free in Angler EK « CVE-2015-2419 – Internet Explorer Double-Free in Angler EK
The Angler Exploit Kit (EK) recently added support for an Internet Explorer (IE) vulnerability (CVE-2015-2419) that was patched in July 2015.
minimaxir/big-list-of-naughty-strings
big-list-of-naughty-strings - The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
SkypeDestroyer v-0.1 released - Exploits headers and the Skype protocol.
SkypeDestroyer v-0.1 released – Exploits headers and the Skype protocol. | Security List Network™
Research Spotlight: Detecting Algorithmically Generated Domains
This post was authored by Mahdi Namazifar and Yuxi Pan Once a piece of malware has been successfully installed on a vulnerable system one of the first orders of business is for the malware to reach out to the remote command-and-control (C&C) servers in order to receive further instructions, u
Solution for PHP security challenge
Solution for our little PHP security challenge
cure53/H5SC
H5SC - HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors