Background


Since the Log4J vulnerability was exposed, we see more and more malware jumped on the wagon, Elknot, Gafgyt, Mirai are all too familiar, on February 9, 2022, 360Netlab's honeypot system captured an unknown ELF file propagating through the Log4J…

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication - kgretzky/evilginx2

captcha-killer的修改版，支持关键词识别base64编码的图片，添加免费ocr库，用于验证码爆破，适配新版Burpsuite - f0ng/captcha-killer-modified

Dirty Pipe root exploit for Android (Pixel 6). Contribute to polygraphene/DirtyPipe-Android development by creating an account on GitHub.

Updated: The malware is being spread through an interesting phishing tactic.

Posted by Ian Beer & Samuel Groß  of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit ...

Contribute to Retrospected/spring-rce-poc development by creating an account on GitHub.

An nginx Zero-Day RCE issue was identified in the nginx LDAP-auth daemon implementation, which was briefly leaked.

🕳 bore is a simple CLI tool for making tunnels to localhost - ekzhang/bore

Zero-Day in a Vmware product leads to unauthenticated remote code execution via Web interface.

Vmware is aware about the bug and is patching.

There is no patch to the Zero-Day. However, workarounds include use of WAF and disabling features.

Transition based events without style blocks So, recently, I was updating our XSS cheat sheet to fix certain vectors that had been made obsolete by browser updates. Whilst looking at the vectors, the

Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64. - gojue/ecapture

Posted by Ian Beer, Google Project Zero This blog post is my analysis of a vulnerability found ...