Information Security
@sec_nerd_en
415 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
415 subscribers
Information Security
https://shubs.io/exploiting-markdown-syntax-and-telescope-persistent-xss-through-markdown-cve-2014-5144/
shubs
Exploiting Markdown Syntax and Telescope Persistent XSS through Markdown (CVE-2014-5144)
Exploiting Markdown Syntax

Markdown is wonderful. In fact, this blog post itself is written in Markdown. I don't need to use lengthy uneccessary HTML for simple things like links, tables, code blocks and lists. Nor do I need to go out of my way to do simple…
126 views
Information Security
https://www.exploit-db.com/docs/english/46515-file-transfer-skills-in-the-red-team-post-penetration-test.pdf
119 views
Information Security
https://nathandavison.com/blog/corsing-a-denial-of-service-via-cache-poisoning
123 views
Information Security
https://github.com/cloudfuzz/android-kernel-exploitation
GitHub
GitHub - cloudfuzz/android-kernel-exploitation: Android Kernel Exploitation
Android Kernel Exploitation. Contribute to cloudfuzz/android-kernel-exploitation development by creating an account on GitHub.
121 views
Information Security
https://www.reddit.com/r/graphql/comments/ea7zdj/new_security_risk_graphql_batching_attack/
reddit
New Security Risk: GraphQL Batching Attack
One of these documented but not commonly used behaviors is the ability to send multiple queries with a single GraphQL request, a.k.a....
120 views
Information Security
https://superevr.com/blog/2011/three-semicolon-vulnerabilities
Superevr
Three Semicolon Vulnerabilities — Superevr
I have three new web bugs to demonstrate. Each of them take advantage of how a semicolon character is interpreted by a web server or browser. Each of these bugs can be demonstrated on the latest release of Apache Tomcat 7.0.22, and the latest browsers. Exploitation…
128 views
Information Security
https://blog.yappare.com/2012/04/advance-oracle-blind-sql-injection.html
Yappare
Advance Oracle Blind SQL Injection
Had a job to test an application few days back. Its an application using java applet. Hurm..when I heard its an application via java applet...
124 views
Information Security
https://insomniasec.com/blog/auth0-jwt-validation-bypass
123 views
Information Security
https://github.com/appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training
GitHub
GitHub - appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training: Course content, lab setup instructions and documentation…
Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training! - appsecco/breaking-and-pwning-apps-and-servers...
127 views
Information Security
https://blog.cm2.pw/exploiting-post-based-xssi/
132 views
Information Security
https://blog.yappare.com/2017/06/from-js-to-another-js-files-lead-to.html
Yappare
From JS to another JS files lead to authentication bypass
This was found in a private bug bounty. The scope is limited to a few of features that available to the public. Based on the previous repor...
137 views
Information Security
DNS Rebinding Filter Bypass

https://hackerone.com/reports/632101
HackerOne
GitLab disclosed on HackerOne: Server Side Request Forgery...
### Summary

This vulnerability allows attacker to send arbitrary requests to local network which hosts GitLab and read the response. This is possible due to flawed DNS rebinding protection.

The...
145 views
Information Security
https://updatefaker.com/
Updatefaker
Update Faker
Update Faker (updatefaker.com) is a harmless website to prank your friends, family or colleagues when they leave their computer unattended! It doesn't matter if they use Microsoft Windows, Apple OSX, or an older operating system, we've got you covered!
153 views
Information Security
https://www.notsosecure.com/exploiting-vlan-double-tagging/
NotSoSecure
Exploiting VLAN Double Tagging
We have all heard about VLAN double tagging attacks for a long time now. There have been many references and even a single packet proof of concept for VLAN double tagging attack but none of them
144 views
Information Security
https://hackking.net/open-redirect-bypasser/
147 views
Information Security
https://github.com/ShutdownRepo/shellerator
GitHub
GitHub - ShutdownRepo/shellerator: Simple CLI tool for the generation of bind and reverse shells in multiple languages
Simple CLI tool for the generation of bind and reverse shells in multiple languages - ShutdownRepo/shellerator
149 views
Information Security
https://medium.com/@ozguralp/google-maps-api-not-the-key-bugs-that-i-found-over-the-years-781840fc82aa
Medium
Google Maps API (Not the Key) Bugs That I Found Over the Years
After publishing my blog post Unauthorized Google Maps API Key Usage Cases, and Why You Need to Care and scanner script for it, I got…
138 views
Information Security
https://medium.com/@sp2417487/a-story-of-rs-10k-bounty-within-minutes-67045a574f42
Medium
A Story of Rs.10k Bounty within minutes
Hello everyone i hope you guys are doing great in this quarantine i decided to write small blog post about my months older bug please have…
136 views
Information Security
https://ahussam.me/intigriti-easter-xss-challenge/
ahussam.me
Intigriti Easter XSS Challenge Write-up • Abdullah Hussam
Hey all,
131 views
Information Security
Open Redirect Bypass
?redirect=https://test.target.com > accepts any subdomain of target to redirect
?redirect=https://google.comğ.target.com > "Ğ" is a Turkish character, server can't render it and changes it to "?"
So it redirects to http://google.com/?target.com
#bugbounty #bugbountytip
221 views
Information Security
https://www.securify.nl/advisory/SFY20200419/cisco-anyconnect-elevation-of-privileges-due-to-insecure-handling-of-path-names.html
www.securify.nl
Securify - We provide reality checks
Securify provides reality checks to lower security risks and build up resilience against threats. Agile Security, Pentesting (scenario-based) and Red Teaming.
133 views