I’ve been struggling with reverse engineering rustlang binaries for a while in CTF challenges. So I’m starting a reverse engineering series where I reverse engineer several rustlang binariesa and try to understand how they actually work.

I was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a "backdoor" account on the device, enabling them to send commands…

Offensive Software Exploitation Course. Contribute to ashemery/exploitation-course development by creating an account on GitHub.

MetaOSINT enables open source intelligence ("OSINT") practitioners to jumpstart their investigations by quickly identifying relevant, publicly-available tools and resources, saving valuable time during investigations, research, and analysis.

В этой статье я расскажу вам о том, как ровно год назад я связал в цепочку несколько проблем безопасности для достижения Удаленного выполнения кода ( RCE ) на нескольких серверах компании VK . Я...

Let's take a look back at 2022 and specifically the top 20 bug bounty creators who ruled the bug bounty scene in 2022!

While we were visiting the University of Maryland, we came across a fleet of electric scooters scattered across the campus and couldn't resist poking at the scooter's mobile app. To our surprise, our actions caused the horns and headlights on all of the scooters…

My favorite hacking stories of 2022:

Update: Voting is now closed, and the panel vote is in progress.  Nominations are now open for the top 10 new web hacking techniques of 2022! Every year, security researchers share their latest f

До нового года осталась всего ничего, а значит, пора подвести итоги и вспомнить самые интересные, важные и странные события последних двенадцати месяцев, о которых мы писали на Xakep.ru . Мы выбрали...

> TL;DR The main objective of this research is to prove the possibility of having a variant of Prototype Pollution in other programming languages, including those that are class-based by showing Class Pollution in Python. ⚠️ Warning: This is a topic that…

Auth misconfiguration One afternoon I decided to try my luck on the Red Bull VDP program. I gathered the subdomains and looked at interesting ones in the browser. I opened one of them let’s call it subdomain.redbull.com and I saw some web interface. Which…

Welcome to this bug bounty write-up where I show you how I escalated a Server-Side Request Forgery vulnerability (SSRF) to a Remote Code Execution (RCE).

Hello Hackers,

In this post, I will explain how I fuzz APIs for bugs. This blog is more about how to understand your API and then about what tools I use and where to fuzz?


1. Understanding the API
2. Where to fuzz and how to fuzz?


Understanding the…

#event #pentest #bugbounty #redteam

Записи докладов с NahamCon2022, одной из самых практикоориентированных конференций в ИБ-движухе. Обязательно загляните.👇

Смотреть