Archive

Posted by James Forshaw, abusing symbolic links like it’s 1999. For the past couple of years I’ve been researching Windows elevation of ...

Die neuesten Tweets und Antworten von Casey Smith (@subTee). Offline

Intro С большим удовольствием хочу представить новую версию Intercepter-NG 0.9.10, которая, на мой взгляд, в значительной степени расширяет область применения...

This post revolves around a remote code execution vulnerability that I found in Shopify Before I start I'd inform you that the vulnerability I found was reported to Shopify, as a part of their bug bounty program in early July and has been fixed. This vulnerability was in the subdomain

Last month, Stefan Esser blogged about a zero-day vulnerability in OS X, without having informed Apple about the problem first. Unfortunately, today has brought the discovery of the first known exploit.

От переводчика: Совсем недавно узнал про эту довольно интересную базу данных и как раз наткнулся на свежую статью. На Хабре нет почти ни слова о RethinkDB, в...

It turned out that the extension corruption issue was reported in a separate report and by the time I reported the combination of the two issues, the fix for the corruption issue was already out in Chrome Beta! Both issues are now fixed in the latest stable version.

babun - Babun - a Windows shell you will love!

TL;DR

What is being disclosed today?

On August 11, 2015 Microsoft released 14 security fixes, including an SMB Server fix. In this post I'll explain how I triggered the SMB Server bug. Microsoft Security Bulletin MS15-083: Of all the available patches, I focused in this one: Server Message Block Memory Corruption Vulnerability - CVE-2015-2474

Using Formula Injection to attack users and steal spreadsheet contents:

TL;DR

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability  (and more general a user interface spoofing). Apple released security u...

Hey! The videos from AppSec 2015 are now online, and the Service Workers talk is too. Anyway, this post is about another of the slides in...

Brute force attacks are one of the oldest and most common types of attacks that we still see on the Internet today. If you have a server online, it's most likely being hit right now.

I would like to share IE XSS Filter bypass with escape sequence of HZ-GB-2312 encoding. To use this vector, we need the target page's Cont...

TL;DR

In our previous post , we looked at a bug that allowed malware running on OS X to make calls on a ...

vBulletin is a commercial forum and blog platform developed by vBulletin Solutions, Inc. It was created over 10 years ago and is written in PHP. It is the world’s most popular forum platform, powering ~78% out of the forums in the top 100K web-sites. Currently there are estimated to be over 40,000 live sites using…

How An XSS in (Hipchat Native OSX application) can lead to remote code execution. Two issues exist in Atlassian’s HipChat desktop client that allow an attack...

Common Windows Privilege Escalation Vectors Imagine this scenario:  You've gotten a Meterpreter session on a machine (HIGH FIVE!), and you opt for running getsystem in an attempt to escalate your privileges... but what that proves unsuccessful?  Should you throw in the towel? Only if you're a quitter... but you're not, are you?  You're a champion!!!  :) In this post I will walk us through common privilege escalation techniques on Windows, demonstrating how to "manually" accomplish each task as well as talk about any related Metasploit modules.  While most techniques are easier to exploit...

Early last year Gareth Heyes unveiled a fascinating new technique for attacking web applications by exploiting path-relative stylesheet imports, and dubbed it ‘Relative Path Overwrite’. This attack tr