Archive

In our previous post , we looked at a bug that allowed malware running on OS X to make calls on a ...

vBulletin is a commercial forum and blog platform developed by vBulletin Solutions, Inc. It was created over 10 years ago and is written in PHP. It is the world’s most popular forum platform, powering ~78% out of the forums in the top 100K web-sites. Currently there are estimated to be over 40,000 live sites using…

How An XSS in (Hipchat Native OSX application) can lead to remote code execution. Two issues exist in Atlassian’s HipChat desktop client that allow an attack...

Common Windows Privilege Escalation Vectors Imagine this scenario:  You've gotten a Meterpreter session on a machine (HIGH FIVE!), and you opt for running getsystem in an attempt to escalate your privileges... but what that proves unsuccessful?  Should you throw in the towel? Only if you're a quitter... but you're not, are you?  You're a champion!!!  :) In this post I will walk us through common privilege escalation techniques on Windows, demonstrating how to "manually" accomplish each task as well as talk about any related Metasploit modules.  While most techniques are easier to exploit...

Early last year Gareth Heyes unveiled a fascinating new technique for attacking web applications by exploiting path-relative stylesheet imports, and dubbed it ‘Relative Path Overwrite’. This attack tr

By @breenmachine Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012 … and a new network attack How it works Hot Potato (aka: Potato) takes advantage of known issues in Windows t…

On the 8th December 2015, Microsoft released Security Bulletin MS15-130 [1] to fix a vulnerability in Unicode Scripts Processor component found by Secunia Research [2]. The Common Vulnerabilities and…

From Crash to Exploit: CVE-2015-6086 - Out of Bound Read/ASLR Bypass

Sometime back, FireEye discovered a 0day attack using docx file format Two for One: Microsoft Office Encapsulated PostScript and Wind...

Theori, Inc.

The Scriptless Scriptlet - Or how to execute JavaScript from CSS in MSIE11 without using Scripts · GitHub

Attention, the method works not as well as it should There is a possibility to find out a vendor of AV installed on a user's PC. Remotely and without detection from the user. This information could be useful for us if we want to attack the user. The method is based on two main features. The first feature. The most of modern AVs can detect malware analyzing network traffic. Usually, http and smtp/pop3/imap protocols are analyzed. However, as TLS is used more and more often, then an AV actually has to perform a man in the middle attack against a user application and a remote server. To byp...

We recently discovered two zero-day vulnerabilities in Adobe Reader. Adobe has since released a patch (on October 6, 2016) to fix these vulnerabilities, which are named CVE-2016-6957 and CVE-2016-6958. These vulnerabilities could allow an attacker to compromise Adobe Reader by bypassing restrictions on JavaScript API execution (CVE-2016-6957) and security provisions that prevent arbitrary execution of scripts such as those written in Python (CVE-2016-6957). In this blog post, I will provide a technical walkthrough of these vulnerabilities, how they can be exploited, and how Palo Alto Networ...

This blog post shows how to create a reliable and realistic-looking malicious USB key that can be used in a drop attack.

A simple way for detection the remote user's antivirus :

Windows Metafiles An Analysis of the EMF A1ack Surface & Recent Vulnerabili;es Mateusz “j00ru” Jurczyk PacSec, Tokyo 2016

Phrack staff website.

This presentation by Sergey Shekyan and Bei Zhang discusses offensive use of headless browsers tools, and how to counteract them in practice.

Всем привет! Я Максим Андреев, программист бэкенда Облака Mail.Ru. В свободное время я люблю искать баги. В сегодняшнем посте я хочу рассказать об одной...