Archive

Finding, exploiting and leveraging vulnerabilities in Apple's Call Relay protocol to build a spy program. CVE: 2016-4635, 2016-4721, 2016-4722, 2016-7577

CVE-2017-8759 - A vulnerability in the SOAP WDSL parser.

В этой серии статей я расскажу о внутреннем устройстве Android  —  о процессе загрузки, о содержимом файловой системы, о Binder и Android Runtime, о том, из...

Webkit uxss exploit (CVE-2017-7089)

Today, I'm going to blog about PWA (Progressive Web Apps)🙂 These days, web is getting bit secure by the help of CSP, which turns XSS i...

Our guest blogger and Detectify Crowdsource hacker Peter Jaric explains how Selenium Grid could be exploited to read files on the server.

Microsoft Office has a security feature called Protected View.

> Preface Note: As always the following is just a digest of all the things I could observe by working on printers myself or facts from stuff I read about recently. Since this thread about the HP printer promo videos caught some attention I will try to shed some light onto the field which was displayed there. First of all we should keep in mind this was a promo video made by a company. So always ask yourself this: “How real are the displayed scenarios, or are these just ‘Hollywood fabrications...

Easy Bugs for Hard Cash

UPDATE: The Next Web wrote a story about my findings…

Chrome < 62 uxss exploit (CVE-2017-5124)

Analysis of the S8 data line locator

I recently found myself prototyping an experimental scanning technique using JXBrowser, a library for using a PhantomJS-like browser in Java applications. Whilst creating a JavaScript to Java bridge

RESOLVED (dholbert) in Core - SVG. Last updated 2017-03-29.

Thanks to RTL-SDR.com reader 'flatflyfish' for submitting information on how to get Martin Marinov's TempestSDR up and running on a Windows system. If you didn't already know by definition "TEMPEST" refers to techniques used by some spy agencies to eavesdrop on electronic equipment via their unintentional radio emissions (as well as via sounds and vibrations). All electronics emit …

As a penetration tester or a bug bounty hunter, most of the times you are given a single domain or a set of domains when you start a…

bucket-stream - Find interesting Amazon S3 Buckets by watching certificate transparency logs.

Chaining a few bugs to gain remote code execution, via hard work & recon.

XXE Out of Band testing, explaining how to execute XXE OOB attacks over HTTP & FTP. Additional explanation on XXE RCE.

During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Tra…

Introduction NTLM authentication is the de-facto standard in corporate networks running Windows. There are a plethora of well-understood local attacks that take advantage of the way Windows perform automatic NTLM authentication, and abusing this feature is undoubtedly on the playbook of every penetration tester and red teamer. Here at Blaze