Hack crypto secrets from heap memory to exploit Android application
https://secureitmania.medium.com/hack-crypto-secrets-from-heap-memory-to-exploit-android-application-728097fcda3

Route SSH Connections with HAProxy
https://www.haproxy.com/blog/route-ssh-connections-with-haproxy/

How I Found My First Ever ZeroDay (In RDP)
https://www.malwaretech.com/2020/12/how-i-found-my-first-ever-zeroday-in-rdp.html

NTFS Remote Code Execution (CVE-2020-17096) Analysis
https://blog.zecops.com/vulnerabilities/ntfs-remote-code-execution-cve-2020-17096-analysis/

PIDRILA: Python Interactive Deepweb-oriented Rapid Intelligent Link Analyzer is really fast async web path scanner  prototype developed by BrightSearch team for all ethical netstalkers.
https://www.kitploit.com/2021/01/pidrila-python-interactive-deepweb.html

Pretty cool. SolarWinds hackers put malware on the build systems which would hijack the compile process and quietly insert the backdoor into the code every time the devs compiled it.
https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

Researching new ways to detect 0-day exploits in the wild
Part 1 - Introduction
https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html
Part 2 - Chrome Infinity Bug
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-infinity-bug.html
Part 3 - Chrome Exploits (PoC for CVE-2017-5070, CVE-2020-6418, CVE-2019-5782, CVE-2019-13764)
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-exploits.html
Part 4 - Android Exploits
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-android-exploits.html?
Part 5 - Android Post-Exploitation
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-android-post-exploitation.html
Part 6 - Windows Exploits (PoC for CVE-2020-0938, CVE-2020-1020, CVE-2020-1027)
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-windows-exploits.html

#RedTeam
Pentesting the #ELK (#Elasticsearch, #Logstash, #Kibana) Stack
https://insinuator.net/2021/01/pentesting-the-elk-stack

First reconftw official release is out, it has a lot of changes and bug fixes along some new or improved functionalities, also the installer is compatible with most distros and extra gift: recon mindmap, check it out!!
https://github.com/six2dez/reconftw

Using Spotify Playlists as Malware CDN(!) | C2Tify
https://kaganisildak.com/2021/01/14/using-spotify-playlists-as-malware-cdn-c2tify/

Pentester Swiss Army Knife is a Docker Image with a suite of the most used tools for Hacking and Pentesting.
https://github.com/leoanggal1/P-SAK

CISCO CVE-2020-3452 Scanner & Exploiter

https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter

https://secret.club/2021/01/14/vbox-escape.html

This post is about a #VirtualBox escape for the latest currently available version (VirtualBox 6.1.16 on #Windows). The vulnerabilities were discovered and exploited by our team Sauercl0ud as part of the RealWorld #CTF 2020/2021.

Beginner-friendly post about some of the basics related to code coverage in #fuzzing, just going over terminology, common strats, and some tooling.
https://h0mbre.github.io/Fuzzing-Like-A-Caveman-5/#

How to use Ghidra to Reverse Engineer Mobile Application
https://medium.com/bugbountywriteup/how-to-use-ghidra-to-reverse-engineer-mobile-application-c2c89dc5b9aa

Exploiting Error Based SQL Injections & Bypassing Restrictions
https://medium.com/bugbountywriteup/exploiting-error-based-sql-injections-bypassing-restrictions-ed099623cd94

Gaining access to arbitrary* Content Providers
https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/

Backdooring MSBuild
https://www.a12d404.net/ranting/2021/01/17/msbuild-backdoor.html