Java is known for its backward-compatibility and modern projects use a wide range of old libraries. However, such libraries are often left unsupported by maintainers for a long time and highly insecure.

Hello everyone, I would like to share a riveting issue regarding XSS (Cross-Site Scripting ) I endured a few months ago. Cross-site scripting (XSS) is a type of security vulnerability typically fou…

Home of Nikhil SamratAshok Mittal. Posts about Red Teaming, Offensive PowerShell, Active Directory and Pen Testing.

Sebastian Bergmann explains why PHPUnit must not be installed on a webserver.

:cherry_blossom: A command-line fuzzy finder. Contribute to junegunn/fzf development by creating an account on GitHub.

DNS zone transfers using the AXFR protocol are the simplest mechanism to replicate DNS records across DNS servers. To avoid the need to edit information on multiple DNS servers, you can edit information on one server and use AXFR to copy information to other…

Most API developers are well aware of curl, but did you realize just how many features it has? We uncover the hidden features behind curl, HTTP’s Swiss Army Knife.

Information on how to recon on shodan

Payloads with localhost

XML and ZIP - A Tale as Old As Time While researching a bug bounty target, I came across a web application that processed a custom file ...

browser pwn, main work now. Contribute to ray-cp/browser_pwn development by creating an account on GitHub.

Though we’re now almost to March, I’m still spending my free time working though VMware pwning as part of my 2019 advent calendar. I’d given myself 3 VMware challenges to look at, including one CTF challenge from Real World CTF Finals in 2018, and two n-days…

This is for educational purposes only.

We engaged Doyensec to perform a security assessment of our firmware, v3.0.1 at the time of testing. During a 10 person/days project, Doyensec discovered and reported 3 vulnerabilities in our firmware. While two of the issues are considered informational…

Over the course of an investigation, it is sometimes helpful to sketch out a network of involved parties so that you can understand who is linked to what.

I want to tell you the story of a service account which lost all its powers (a.k.a. privileges). Windows world is getting increasingly ruthless and when the system considers you are not worthy, this is what happens. Fortunately for our service account, all…

IIOP协议导致的反序列化。