https://shazzer.co.uk/vectors/667b4120d631543fa1c420a5
Please open Telegram to view this post
VIEW IN TELEGRAM
shazzer.co.uk
HTML entities that create ASCII characters inside a JavaScript URL - Shazzer
This vector loops through all entities and assigns them to a JavaScript URL and checks if they decode to ASCII characters.
https://x.com/ThePollLady/status/1805912910687793244
Please open Telegram to view this post
VIEW IN TELEGRAM
X (formerly Twitter)
The Poll Lady (@ThePollLady) on X
10 most controversial exposé by WikiLeaks founded by Julian Assange.
Thread🧵
Thread🧵
cKure Red
This media is not supported in your browser
VIEW IN TELEGRAM
Statement on disinformation and lies by Mr. Julian Assange
This media is not supported in your browser
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
Previous Rockyou-2021 had 8.4 billion passwords, and the new version has 1.5 billion (added by hacker 'ObamaCare'), making it a 10 billion word-list.
Please open Telegram to view this post
VIEW IN TELEGRAM
BlastRADIUS
Critical vulnerability in the RADIUS protocol leaves networking equipment open to attack.
https://www.helpnetsecurity.com/2024/07/09/blastradius-radius-protocol-vulnerability/
Help Net Security
Critical vulnerability in the RADIUS protocol leaves networking equipment open to attack
A critical vulnerability in the RADIUS protocol, dubbed BlastRADIUS, leaves most networking equipment open to Man-in-the-Middle attacks.
p25.pdf
593.2 KB
It can be used to trace users and target them for ads by the ISP or their associated vendors. And if the API key 🔑 is leaked through a vendor or ISP itself.
Scenarios:
1. The token can be used by anyone in a get request to fetch the end-user's phone number. This request can be posted via QR-codes of restaurant menus where there will be HTTP-302 (redirection) to the actual menu or by injecting 💉.js in a vulnerable website (viz. XSS); which is famous (like some blog or forum).
2. A user sharing hotspot from their phone, the hotspot client can acquire the phone number. In addition to this, if the HE enables authentication. This would lead to 0-click account takeover.
● I had tested systems for this implementation for a telco. The telco without informing users (IMHO) was sharing data to third parties.
-Admin cKure
Source: https://conferences.sigcomm.org/sigcomm/2015/pdf/papers/hotmiddlebox/p25.pdf
Please open Telegram to view this post
VIEW IN TELEGRAM
DYK most VPN services can actually make you less secure? Today x.com/PET_Symposium, Benjamin Mixon-Baca will present research done in collaboration with the Citizen Lab about how VPNs can enable an attacker to act as an in-path router between you and the VPN server. The study identifies a new vulnerability called a “port shadow”.https://petsymposium.org/popets/2024/popets-2024-0070.pdf
Please open Telegram to view this post
VIEW IN TELEGRAM
X (formerly Twitter)
PETS (@PET_Symposium) on X
Official account of the Privacy Enhancing Technologies Symposium. Next event: PETS 2025, July 14-19, Washington, DC and Online.
mastodon: @PET_Symposium@infosec
mastodon: @PET_Symposium@infosec
This media is not supported in your browser
VIEW IN TELEGRAM
https://www.mobile-hacker.com/2024/07/23/whatsapp-trick-android-malware-can-impersonate-pdf-file/
Please open Telegram to view this post
VIEW IN TELEGRAM
Includes credentials, registrant IP, and last login IP, among other details.
https://bf.based.re/
Please open Telegram to view this post
VIEW IN TELEGRAM
https://anatomic.rip/abusing_rcu_callbacks_to_defeat_kaslr/
Please open Telegram to view this post
VIEW IN TELEGRAM
a place of anatomical precision
Abusing RCU callbacks with a Use-After-Free read to defeat KASLR
Introduction In this article, I will be walking you through a clever technique that can be used to leak addresses and defeat KASLR in the Linux Kernel when you have a certain type of Use-After-Free by abusing RCU callbacks. It is by no means a novel technique…
Please open Telegram to view this post
VIEW IN TELEGRAM
https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/
Please open Telegram to view this post
VIEW IN TELEGRAM
GMO Flatt Security Research
Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit
Introduction
Hello, I’m RyotaK (@ryotkak
), a security engineer at Flatt Security Inc.
In 2023, James Kettle
of PortSwigger published an excellent paper
titled Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced…
Hello, I’m RyotaK (@ryotkak
), a security engineer at Flatt Security Inc.
In 2023, James Kettle
of PortSwigger published an excellent paper
titled Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced…
Cyber-Warfare
📍Apparently the Jew ✡️ (Israel) used sonic booms 💥 of fighter jets (apparently F-35s) in Beirut, Lebanon 🇱🇧 and nearby areas during the telecast of Hizbollah chief Hassan Nasrallah's speech to get his location in a corelation attack (had it been live).
https://x.com/Lonewolf8ier/status/1820825946212978816
Please open Telegram to view this post
VIEW IN TELEGRAM
0.0.0.0 Day
https://www.bleepingcomputer.com/news/security/18-year-old-security-flaw-in-firefox-and-chrome-exploited-in-attacks/
Please open Telegram to view this post
VIEW IN TELEGRAM
BleepingComputer
18-year-old security flaw in Firefox and Chrome exploited in attacks
A vulnerability disclosed 18 years ago, dubbed "0.0.0.0 Day", allows malicious websites to bypass security in Google Chrome, Mozilla Firefox, and Apple Safari and interact with services on a local network.
It’s becoming increasingly apparent that security research is not enough to end the era of zero days.Natalie Silvanovich
https://duo.com/decipher/project-zero-it-will-take-all-of-us-to-end-the-era-of-zero-days
Please open Telegram to view this post
VIEW IN TELEGRAM