TL;DR The TP-Link M7350 (V3) is affected by a pre-authentication (CVE-2019-12103), and a few post-authentication (CVE-2019-12104) command injection vulnerabilities. These injections can be exploited remotely, if the attacker is on the same LAN or otherwise…

a vulnerable GraphQL application . Contribute to 0xbigshaq/hackmegraph development by creating an account on GitHub.

Research about the Zend Engine. Contribute to 0xbigshaq/php7-internals development by creating an account on GitHub.

A story about how I Finally could use an AD account that unenrolled to MFA, by using an EWS Misconfiguration to Access Email Inbox and…

Dynamic Binary Instrumentation (DBI) Primer with Intel PIN for Reverse Engineering Part 1/4

The tracer utility is available here : https://github.com/shsirk/proctracer

Full Tutorial Series here :
https://www.youtube.com/watch?v=1-q7LaNhGVM&list=PLKwU…

I hope you all are doing well in this lockdown. I kinda have a hard time concentrating on bug bounty for now cause of staying home all the…

How I hacked Pornhub for fun and profit

This is the third post in the “Offensive IoT Exploitation” blog post series. In the previous one, we learned about how we can get started with analyzing firmware‍ and extracting file systems. In this post, we will take it a step further by analyzing

Hello everyone! Here’s a quick guide on reversing firmware w/ radare. Or, rather, loading firmware into radare; the process of reversing software in any disassembler is a little beyond the scope of any one blog post.

MindShaRE is our periodic look at various reverse engineering tips and tricks. The goal is to keep things small and discuss some everyday aspects of reversing. You can view previous entries in this series here .

Is it possible to install IDA Pro without kowning installation password? Linux or MacOS version can find the password directly; Windows version only need 10 minutes to calculate the password. The following is the detailed process.

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage. - lanjelot/patator

shodan search org:"Target" http.favicon.hash:116323821 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do ffuf -u http://$host/FUZZ -mc 200 -w spring-boot.txt ;done #bugbountytips #bugbountytip

This post is about how I and my friend got roughly 2500$ from Cafebazaar bug bounty program.