Recently, I was repeatedly awarded $2,000 bounty for subdomain takeover on Starbucks. In this post, I explain the step-by-step process for the proof-of-concept.

Subdomain takeover possible on one of Starbucks's subdomain. The subdomain pointed to Microsoft Azure Traffic Manager which was no longer registered under Azure.

Detailed write-up:...

Academics and private sector researchers have revealed details today about three new vulnerabilities affecting Intel CPUs.

Firefox SSL lock spoof, writeup soon. https://t.co/nVg7bW7KcW

CSS XSS came back for a bit which lead to an unusual uXSS

In this paper I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems

Common methods AD administrators use to protect their environments can easily be exploited. Here's how.

We fuzzed BSP map files for Counter Strike: Global Offensive leading to the discovery of a stack-based buffer overflow. Through some reverse engineering and source code analysis, we discovered that the vulnerability can lead to remote code execution.

HTTP Botnet Project. Contribute to UBoat-Botnet/UBoat development by creating an account on GitHub.

Hello HackerOne team,

this is probably going to be a *different* kind of report than what you are used to: it looks to me this is more of an internal, operational security best-practice that you...

Ethan Robish // WebSockets Overview WebSockets is a technology to allow browsers and servers to establish a single TCP connection and then asynchronously communicate in either direction. This is great […]

We write about Windows Internals, Hypervisors, Linux, and Networks.

HackenProof is Vulnerability Disclosure & Bug Bounty Platform. By working with the community of security researchers we help companies uncover security vulnerabilities.

Normally, a call to `https://duckduckgo.com/iu` contains a query parameter (`u`) with some path using the domain `yimg.com`. This call will succeed in most cases.
{F337121}

And if we change that...

HTTP file upload scanner for Burp Proxy. Contribute to PortSwigger/upload-scanner development by creating an account on GitHub.