Archive

## Summary: `brave://` protocol was introduced as a replacement for `AsarProtocolHandler`(or something like that) in `brave/muon` after #375329. However, fix for #375329 introduced a new much...

## Summary: ### `chrome://brave` is available for navigation Navigation to `chrome://brave` + `` requires local file at ``. The file loaded in this context has...

Research by the Avast threat intelligence team reveals details about new botnet targeting IoT devices

A call to the String.prototype.localeCompare method can be inlineed when it only takes one argument. There are two versions of String.prototype.localeCompare, one [1] is written in JavaScript and the …

1. Content process -> Privileged content process (first_stage.js) When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::Ge…

Уже из названия понятно, что headless-браузер — это нечто без головы. В контексте фронтенда — это незаменимый инструмент разработчика, с помощью которого можно...

While I was reading about Payment Handler API , I came across one sentence. Chrome also supports a non-standard feature we call just-in-ti...

Sentry is a log collection web application, written in Python with the Django framework

CVE-2018-15685 Electron WebPreferences Remote Code Execution Finding

Uber’s subdomain takeover

HackerOne's Hacktivity feed — a curated feed of publicly-disclosed reports — has seen its fair share of subdomain takeover reports. Since Detectify's fantastic series on subdomain takeovers, the bug b…

Commonly, malware will fingerprint the host it executes on, in an attempt to discover more about its environment and act accordingly. Part of this process is quite often dedicated to analyzing spec…

clickjacking in google and…

Error-Prone x86/x64 CPU "Feature" can be Abused to Achieve Local Privilege Escalation on Many Operating Systems

This was the P90_Rush_B challenge from Real World CTF Qualifiers - 2018, in which we participated as perfect blue This challenge was solved by @j0nathanj and @VoidMercy_pb. Unfortunately we did not ma…

1 августа 2018 года была опубликована статья "Тёмные паттерны Amazon", мало того, что переводная, так и кроме этого содержащая крайне мало фактических данных,...

When IOfficeAntiVirus::Scan method is called by the programs (or internally via IAttachmentExecute) the system enumerates the Registry, collects info about all components implementing IOfficeAntiVirus, and stores them inside the following location

This summary is provided by the researcher who submitted this report, @alexbirsan ....

on | | | | | | Twitter: @teh_h3ck Email: vag[d0t]mourikis[@]gmail.com Open URL Redirection definition, quoted by OWASP: "An open redirect is an application that takes a parameter and redirects a user …

“feature” added to Windows to support Edge accessing the loopback network interface. For referenc...

Vulnerability Credit Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team 1. Vulnerability Description CVE：CVE-2018-6120 Affected versions：Chrome Version < 66.0.3359.170 2. Vulnerability analysis 2.1 Vulner…

Building and using the RFID Thief v2.0 for long range RFID cloning

Атака Meltdown открыла новый класс атак на процессоры, использующий архитектурные состояния для передачи информации. Но спекулятивное исполнение, которое было...

A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

Tweets metadata scraper & activity analyzer

Stalk your Friends. Find their Instagram, FB and Twitter Profiles using Image Recognition and Reverse Image Search.