Information Security
@sec_nerd_en
414
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
414 subscribers
Information Security
https://www.hackerfactor.com/blog/index.php?/archives/896-Tor-0day-Finding-IP-Addresses.html
Information Security
https://twitter.com/jas502n/status/1305941744656109568?s=20
Twitter
Jas502n
CVE-2020-1472: Zerologon Unauthenticated Domain Controller compromise of the computer account password. https://t.co/Qohp5MFe8j https://t.co/yTvyS1Ozgx
Information Security
https://github.com/microsoft/onefuzz
GitHub
GitHub - microsoft/onefuzz: A self-hosted Fuzzing-As-A-Service platform
A self-hosted Fuzzing-As-A-Service platform. Contribute to microsoft/onefuzz development by creating an account on GitHub.
Information Security
https://research.nccgroup.com/2020/09/18/online-casino-roulette-a-guideline-for-penetration-testers-and-security-researchers/
NCC Group Research Blog
Online Casino Roulette – A guideline for penetration testers and security researchers
Introduction In recent years, the gaming industry has grown significantly, especially casino games and sports betting. Online casinos consolidate their position as one of the main sources of entert…
Information Security
https://www.hackerfactor.com/blog/index.php?/archives/896-Tor-0day-Finding-IP-Addresses.html
Information Security
https://github.com/hiitiger/gelectron
GitHub
hiitiger/gelectron
gameoverlay solution for Electron, Qt and CEF, just like discord game overlay and steam game overlay, inject any app to overlay in your game - hiitiger/gelectron
Information Security
https://cybergibbons.com/reverse-engineering-2/brute-forcing-device-passwords/
Cybergibbons
Brute forcing device passwords
When working with IoT and embedded systems, brute-force password guessing attacks are an effective tool to gain access. Over the years, I’ve learned some tips and tricks to make these attacks…
Information Security
https://blog.securelayer7.net/unauthenticated-file-upload-vulnerability-on-synology-sub-domain/
Penetration Testing and CyberSecurity Solution - SecureLayer7
Unauthenticated File upload Vulnerability on Synology Sub-domain
In this post, you will learn about how I could find the unauthenticated file upload vulnerability in Synology and, according to Synology's highest amount for website security bounty. Start Point to...
Information Security
https://medium.com/bugbountywriteup/what-is-parameter-tampering-5b1beb12c5ba
Medium
What is Parameter Tampering
Parameter Tampering: Special Characters
Information Security
https://github.com/BC-SECURITY/Invoke-ZeroLogon
GitHub
GitHub - BC-SECURITY/Invoke-ZeroLogon: Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller…
Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller itself, and execute remote procedure calls on their behalf. - BC-SECURITY/Invoke-ZeroLogon
Information Security
https://www.youtube.com/c/krypt0muxbugbounty
Information Security
https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers
Speaker Deck
Broken Cryptography & Account Takeovers
Applications still utilize weak cryptography generation methodologies which may lead to severe risk. In the world of Application Security, looking for a…
Information Security
https://github.com/dwisiswant0/go-stare
GitHub
GitHub - dwisiswant0/go-stare: A fast & light web screenshot without headless browser but Chrome DevTools Protocol!
A fast & light web screenshot without headless browser but Chrome DevTools Protocol! - dwisiswant0/go-stare
Information Security
https://ssd-disclosure.com/ssd-advisory-php-spldoublylinkedlist-uaf-sandbox-escape/
SSD Secure Disclosure
SSD Advisory – PHP SplDoublyLinkedList UAF Sandbox Escape - SSD Secure Disclosure
TL;DR Find out how a use after free vulnerability in PHP allows attackers that are able to run PHP code to escape disable_functions restrictions. Vulnerability Summary PHP’s SplDoublyLinkedList is vulnerable to an UAF since it has been added to PHP’s core…
Information Security
https://twitter.com/intigriti/status/1309104069643055111
Twitter
INTIGRITI
Testing for XSS via “javascript:” but it’s blocked by a WAF? Try these bypasses. Thanks for the #BugBountyTip, @SecurityMB! #BugBountyTips #HackWithIntigriti
Information Security
https://medium.com/@datafarm.cybersecurity/exploiting-sigred-cve-2020-1350-on-windows-server-2012-2016-2019-80dd88594228
Medium
Exploiting SIGRed (CVE-2020–1350) on Windows Server 2012/2016/2019
by Worawit Wangwarunyoo , DATAFARM Research Team, Datafarm Company Limited
Information Security
https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142
Medium
The Powerful HTTP Request Smuggling
💪
TL;DR: This is how I was able to exploit a HTTP Request Smuggling in a Mobile Device Management (MDM) servers and send any MDM command to…
Information Security
https://www.gremwell.com/firefox-xss-302
Information Security
https://twitter.com/hunter0x7/status/1312110348841840640?s=20
Twitter
Ahsan Khan
GET /admin HTTP/1.1 Host: https://t.co/kc0BFkaTX3 ... Access is denied GET /test HTTP/1.1 Host: https://t.co/kc0BFkaTX3 X-Original-URL: /admin HTTP/1.1 200 OK
Information Security
https://3os.org/raspberryPi/TOR-Pi/
Information Security
https://medium.com/bugbountywriteup/hacking-the-medium-partner-program-84c0e9fa340
Medium
Hacking the Medium partner program
How my name was added to humans.txt for scoring my first bug bounty, a severity 2 one at that!
