Information Security
@sec_nerd_en
414 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
414 subscribers
Information Security
https://github.com/aemkei/katakana.js/
GitHub
GitHub - aemkei/katakana.js: Write JavaScript alert(1) with Katakana characters only
Write JavaScript alert(1) with Katakana characters only - aemkei/katakana.js
108 views
Information Security
https://blog.aisecureme.com/application-security-test-cases-for-xxe-ssrf/
Aisecureme
Application Security Test Cases for XXE & SSRF:
Google Dorking is most important tool and sometimes it leads to bigger results sometimes it lead to remote code execution or XXE injection. Let's check it out, how it gathers the information and leads to XXE injection.



Suppose we are playing...
118 views
Information Security
https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
Adamcaudill
Exploiting the Jackson RCE: CVE-2017-7525
Earlier this year, a vulnerability was discovered in the Jackson data-binding library, a library for Java that allows developers to easily serialize Java objects to JSON and vice versa, that allowed an attacker to exploit deserialization to achieve Remote…
121 views
Information Security
https://pmatias.me/2019-02/fixing-airline-app-fun-profit/
pmatias.me
Fixing an airline app bug for fun and profit
From electrons to ideas: random thoughts about anything computable
118 views
Information Security
https://omespino.com/write-up-private-bug-bounty-usd-rce-as-root-on-marathon-instance/
117 views
Information Security
https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a
Medium
How i found a 1500$ worth Deserialization vulnerability
Note before you start.
121 views
Information Security
https://medium.com/swlh/hacking-the-web-with-unicode-73d0f0c97aa
120 views
Information Security
JavaScript Obfuscation
https://habr.com/ru/post/112530/
Хабр
Обфускация JavaScript
В статье собраны всем известные методы и предельно извращенные. Эту статью я решил написать после недавнего прочтения поста в блоге Badass JavaScript и решил её...
121 views
Information Security
https://www.alphabot.com/security/blog/2017/java/Misconfigured-JSF-ViewStates-can-lead-to-severe-RCE-vulnerabilities.html
Alphabot
Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Alphabot Security
tl;dr ViewStates in JSF are serialized Java objects. If the used JSF implementation in a web application is not configured to encrypt the ViewState the web a...
114 views
Information Security
https://www.usenix.org/system/files/sec20summer_niakanlahiji_prepub.pdf
108 views
Information Security
https://posts.specterops.io/designing-peer-to-peer-command-and-control-ad2c61740456
Medium
Designing Peer-To-Peer Command and Control
In this post we will discuss the design and implementation of peer-to-peer command and control protocols in general, as well as the…
114 views
Information Security
https://github.com/xairy/vmware-exploitation
GitHub
GitHub - xairy/vmware-exploitation: A collection of links related to VMware escape exploits
A collection of links related to VMware escape exploits - xairy/vmware-exploitation
110 views
Information Security
https://www.blackhat.com/docs/eu-17/materials/eu-17-Mandal-The-Great-Escapes-Of-Vmware-A-Retrospective-Case-Study-Of-Vmware-G2H-Escape-Vulnerabilities.pdf
107 views
Information Security
https://github.com/devanshbatham/ArchiveFuzz
GitHub
GitHub - devanshbatham/ArchiveFuzz: Hunt down the secrets from the WebArchives for Fun and Profit
Hunt down the secrets from the WebArchives for Fun and Profit - devanshbatham/ArchiveFuzz
116 views
Information Security
Some Blogs for iot penetration test
http://iotpentest.com
https://blog.attify.com
https://payatu.com/blog/
http://jcjc-dev.com
https://w00tsec.blogspot.in
http://devttys0.com
https://rtl-sdr.com
https://keenlab.tencent.com/en/
https://courk.cc
https://iotsecuritywiki.com
Iotpentest
IoT Pentesting | Mr-IoT
134 views
Information Security
Server Side Request Forgery via HTML injection in PDF download
https://blog.appsecco.com/server-side-request-forgery-via-html-injection-in-pdf-download-90ee4053e911

OTP Bypass on India’s Biggest Video Sharing Site
https://link.medium.com/dkdKvYCSC5

Exploiting an SSRF: Trials and Tribulations by @abugzlife1

https://link.medium.com/eUqLk4Bzu5

#bugbounty #bubgountytips
Medium
Journey of a security bug — From a naive-looking PDF Download to SSRF via HTML Injection in AWS
A post about how I approached a novel security issue and now I feel I achieved an important milestone in my journey as a pentester.
122 views
Information Security
http://blog.orange.tw/2018/08/how-i-chained-4-bugs-features-into-rce-on-amazon.html
Orange Tsai
How I Chained 4 Bugs (Features?) into RCE on Amazon Collaboration System
Hi! This is the case study in my Black Hat USA 2018 and DEFCON 26 talk, you can also check slides here: Breaking Parser Logic! Take Your Path Normalization Off and Pop 0days Out In past two yea
116 views
Information Security
https://github.com/devanshbatham/ParamSpider
GitHub
GitHub - devanshbatham/ParamSpider: Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing
Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing - GitHub - devanshbatham/ParamSpider: Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/f...
114 views
Information Security
Grep hostnames from ssl certificate

echo | openssl s_client -connect example\.com | openssl x509 -noout -text | grep DNS

#infosec #pentest #bugbounty
130 views
Information Security
https://github.com/orangetw/My-CTF-Web-Challenges
GitHub
GitHub - orangetw/My-CTF-Web-Challenges: Collection of CTF Web challenges I made
Collection of CTF Web challenges I made. Contribute to orangetw/My-CTF-Web-Challenges development by creating an account on GitHub.
124 views