Archive

Microsoft Office has a security feature called Protected View.

> Preface Note: As always the following is just a digest of all the things I could observe by working on printers myself or facts from stuff I read about recently. Since this thread about the HP printer promo videos caught some attention I will try to shed some light onto the field which was displayed there. First of all we should keep in mind this was a promo video made by a company. So always ask yourself this: “How real are the displayed scenarios, or are these just ‘Hollywood fabrications...

Easy Bugs for Hard Cash

UPDATE: The Next Web wrote a story about my findings…

Chrome < 62 uxss exploit (CVE-2017-5124)

Analysis of the S8 data line locator

I recently found myself prototyping an experimental scanning technique using JXBrowser, a library for using a PhantomJS-like browser in Java applications. Whilst creating a JavaScript to Java bridge

RESOLVED (dholbert) in Core - SVG. Last updated 2017-03-29.

Thanks to RTL-SDR.com reader 'flatflyfish' for submitting information on how to get Martin Marinov's TempestSDR up and running on a Windows system. If you didn't already know by definition "TEMPEST" refers to techniques used by some spy agencies to eavesdrop on electronic equipment via their unintentional radio emissions (as well as via sounds and vibrations). All electronics emit …

As a penetration tester or a bug bounty hunter, most of the times you are given a single domain or a set of domains when you start a…

bucket-stream - Find interesting Amazon S3 Buckets by watching certificate transparency logs.

Chaining a few bugs to gain remote code execution, via hard work & recon.

XXE Out of Band testing, explaining how to execute XXE OOB attacks over HTTP & FTP. Additional explanation on XXE RCE.

During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Tra…

Introduction NTLM authentication is the de-facto standard in corporate networks running Windows. There are a plethora of well-understood local attacks that take advantage of the way Windows perform automatic NTLM authentication, and abusing this feature is undoubtedly on the playbook of every penetration tester and red teamer. Here at Blaze

This is write up in which I’ll explain a vulnerability I recently found, and reported through Yahoo’s bug bounty program. When testing the security of web applications, doing reconnaiss…

In this blog post I’m going to explain how to exploit CVE-2017-5123, a bug I found in the Linux kernel, and show how it can be used to escalate privileges, even with SMEP, SMAP and from inside the Chrome sandbox.

Системы глубокого анализа трафика (Deep Packet Inspection, DPI) — программно-аппаратные комплексы для классификации проходящего интернет-трафика по типу данных...

reversing an av engine to compose signatures capable of detecting classified documents

Recently I took a look at Atom, a text editor by GitHub. With a little bit of work, I was able to chain multiple vulnerabilities in Atom into an actual Remot...

tl;dr Remote code execution via a deserialization vulnerability on rubygems.org, a very popular hosting service for ruby dependencies. A fix was rolled out q...