Archive

So you have probably heard of Electron’s remote command injection vulnerability CVE-2018-1000006 in custom protocol handler. It’s not too…

Detailed analysis of attack exploiting Flash Player vulnerability CVE-2018-4878

“Backup Operators” group is an historical Windows built in group. It was designed to allow its members to perform backup and restore operations by granting the SeBackupPrivilege and the…

What is ClickOnce? ClickOnce is a “a Microsoft technology that enables the user to install and run a Windows-based smart client application by clicking a link in a web page” [Wikipedia].  Included …

“Those who rule data will rule the entire world.” - 孫正義

tl;dr; Stored XSSes in Facebook wall by embedding an external video with Open Graph. When a user clicks to play the video, the XSS executes on facebook.com Introduction I reported multiple stored XSS on Facebook wall in April 2017. These stored XSS vulnerabilities were also present in WordPress so I waited for WordPress to patch it before publishing this write-up. The vulnerabilities are now fixed on WordPress! These XSS are a little bit complex because they require multiple steps, but each step by itself is pretty simple to understand. The Open Graph protocol When you add a URL in a Facebo...

This blog was written few weeks ago, since VSCode has been upgraded for a while, I made this public.

Introduction Two weeks ago, I blogged about several “pass-thru” techniques that leveraged the use of INF files (‘.inf’) to “fetch and execute” remote script comp…

As a follow-up to our talk at Ruxcon, 'Make ETW Great Again', we wanted to go into a bit more depth than we could cover in our hour long talk. While our talk consisted of multiple examples of ETW usage, detecting ransomware, USB Keylogging, and sniffing SSL encrypted data from WinINet (our code can be found here: https://github.com/CyberPoint/Ruxcon2016ETW), we wanted to specifically discuss USB Keylogging here. Given the nature and potential impact of our findings, we decided it warranted more explanation especially with regards to mitigation and detection of this technique.

Intro

This article will analyze a UAF vulnerability in win32k Window Manager (User) Subsystem in Window...

al-khaser - Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

Some time ago I discovered a way to inject new lines in a POST request triggered by the Adobe Software/ActiveX. This allows to add new headers or completely modify the created requests. For example you can inject headers like: Referer, Content-Length, Host, Origin etc, which is normally not allowed (eg via XHR) as it can be abused to bypass certain security checks implemented by websites. Additionally it is possible to create a completely new request by abusing HTTP pipelining. One more important information: This injection is not limited to POST requests as you can use a HTTP redirect to c...

This blogpost describes how I got annoyed by vulnerabilities in 3rd party Windows applications, which allowed to execute local files but wi...

Shopify infrastructure is isolated into subsets of infrastructure. @0xacb reported it was possible to gain root access to any container in one particular subset by exploiting a server side request...

Testing

Homepage:

The Bug Hunters Methodology v3(ish) Video: https://www.youtube.com/watch?v=Qw1nNPiH_Go

Earlier this week, I stumbled upon a tweet that caught my interest: