Information Security
@sec_nerd_en
416 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
416 subscribers
Information Security
https://medium.com/bugbountywriteup/exploiting-post-message-to-steal-users-cookies-7df43a00289a
Medium
Exploiting post message to steal user’s cookies
132 views
Information Security
https://www.hahwul.com/2020/05/vulnerability-of-postmessage.html?m=1
Hahwul
Vulnerability of postMessage and postMesasge-tracker browser extension
126 views
Information Security
https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang
www.agwa.name
Preventing Server Side Request Forgery in Golang
130 views
Information Security
https://twitter.com/hackerscrolls/status/1261224450827190272
Twitter
Hack3rScr0lls
You suffer from Firefox telemetry requests in Burp, don't you? Here is the solution — use this config file for Firefox: gist.github.com/AetherEternity… It disables most of telemetry features. Trick by @AetherEternity #BugBountyTip
134 views
Information Security
https://github.com/SecureAuthCorp/impacket/pull/857
129 views
Information Security
https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html
byt3bl33d3r.github.io
Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes) // byt3bl33d3r // /dev/random > blog.py
byt3bl33d3r, /dev/random > blog.py
128 views
Information Security
https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/
SSD Secure Disclosure
SSD Advisory - MyLittleAdmin PreAuth RCE - SSD Secure Disclosure
TL;DR Find out how we managed to execute arbitrary commands on MyLittleAdmin management tool using unauthenticated RCE vulnerability.  Vulnerability Summary MyLittleAdmin is a web-based management tool specially designed for MS SQL Server. It fully works…
138 views
Information Security
https://www.ezequiel.tech/p/36k-google-app-engine-rce.html
www.ezequiel.tech
$36k Google App Engine RCE
Website of Ezequiel Pereira, Uruguayan security enthusiast and student.
119 views
Information Security
https://www.ezequiel.tech/p/10k-host-header.html
www.ezequiel.tech
$10k host header
Website of Ezequiel Pereira, Uruguayan security enthusiast and student.
117 views
Information Security
“Bypassing csrf token” by Amyrahm https://link.medium.com/jENSXSHxy6
Medium
Bypassing csrf token
***************************************************************.
115 views
Information Security
“The complete subdomain Enumeration Guide” by Shifa cyclewala https://link.medium.com/rD1chmKyy6
Medium
The complete subdomain Enumeration Guide
Hello Everyone, as we know Information gathering or sometimes also known as Reconnaissance or simply recon is the first and foremost step…
132 views
Information Security
“Bug Bounty Hunting All you will need” by Hazem Mohamed https://link.medium.com/j2gr6CWyy6
Medium
Bug Bounty Hunting All you will need
The Question All ask is How to start as a Bug Hunter ? and the following links are tell you how :) BUG BOUNTY How to start  BUG BOUNTY…
140 views
Information Security
https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot
GitHub
Unleashing an Ultimate XSS Polyglot
A container repository for my public web hacks! Contribute to 0xSobky/HackVault development by creating an account on GitHub.
122 views
Information Security
https://medium.com/@bilalmerokhel/chained-bugs-account-takeover-ceff67d1d55a
Medium
Chained Bugs [ Account TakeOver ]
Assalam-O-Alaikum fellas hope you all are fine, it has been a while I've not contributed to the community so, today I will share chained…
119 views
Information Security
https://twitter.com/PascalSec/status/1261703706464202753
Twitter
Pascal S
Just learned today that you can actually end a SQL query with "\G" as in e.g. "SELECT * FROM yourAwesomeTable \G" 🤯 Try it out and don't be shocked by what you will find 🧐😅 #sql #magic
122 views
Information Security
https://ardern.io/2019/06/20/payload-bxss/
128 views
Information Security
“Exploiting PHP deserialization” by Vickie Li https://link.medium.com/nrxP3xw5z6
Medium
Exploiting PHP deserialization
Intro to PHP object injection vulnerabilities
126 views
Information Security
https://doddsecurity.com/312/xml-external-entity-injection-xxe-in-opencats-applicant-tracking-system/
Dodd Security
XML External Entity Injection (XXE) in OpenCats Applicant Tracking System - Dodd Security
Vendor’s Vulnerability Announcement CVE-2019-13358 Internet Facing OpenCats: Google Dork OpenCats is an open-sourced applicant tracking system that is used to track job applicants. Versions before 0.9.4-3 suffer from a XML External Entity Injection vulnerability…
153 views
Information Security
https://labs.integrity.pt/articles/xxe-all-the-things-including-apple-ioss-office-viewer/index.html
144 views
Information Security
https://www.sans.org/blog/exploiting-xxe-vulnerabilities-in-iis-net/
www.sans.org
SANS Penetration Testing | Exploiting XXE Vulnerabilities in IIS/.NET | SANS Institute
SANS Penetration Testing blog pertaining to Exploiting XXE Vulnerabilities in IIS/.NET
163 views