With some luck and a couple of XSS bugs I was able to break the new Edge

Image credit: Powershell Magazine
Introduction
This time I’ll be taking a look at the Windows Powershell, and how it can be used during the exploitation and post exploitation phases of a penetration test. I’ll also be looking at the relationship b...

A repository of my completed writeups, along with the samples themselves. - itsKindred/malware-analysis-writeups

PoC for CVE-2019-19844(https://www.djangoproject.com/weblog/2019/dec/18/security-releases/) - ryu22e/django_cve_2019_19844_poc

Resources about network security, including: Proxy/GFW/ReverseProxy/Tunnel/VPN/Tor/I2P, and MiTM/PortKnocking/NetworkSniff/NetworkAnalysis/etc。More than 1700 open source tools for now. Post incomin...

It was a weird and smoky afternoon in San Francisco. My downstairs neighbors had apparently never heard of vaporizers, and the Sierra Nevada was on fire. I had planned to spend the rest of the day attacking the user-location features of popular dating apps.…

Motivation Diving straight into reverse-engineering iOS apps can be daunting and time-consuming. While wading into the binary can pay of...

Credentials gathering tool automating remote procdump and parse of lsass process. - aas-n/spraykatz

Extract credentials from lsass remotely. Contribute to Hackndo/lsassy development by creating an account on GitHub.

Contribute to masahiro331/CVE-2019-10758 development by creating an account on GitHub.

A bug chain of HTTP Request Smuggling that led to account takeover

For clarity and brevity, the code referenced below has been distilled to simplest form.  The complete versions which were actually used for...

A list of resources for those interested in getting started in bug bounties - nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it. - vaib25vicky/a...

In this post, I’m going to reveal the fastest, easiest P1 that I’ve ever reported – multiple times! It’s the sort of oversight that seems so simple to avoid, but surprisingl…

We demonstrate how one can recover mt_rand()'s seed with only two outputs and without any bruteforce.

We found malicious apps that work together to compromise devices and collect user data. One of the apps, called Camero, exploits CVE-2019-2215, a flaw that exists in Binder. This is the first instance in the wild that exploits said UAF vulnerability.