Information Security
@sec_nerd_en
415
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
415 subscribers
Information Security
https://yxw21.github.io/2020/06/05/Account-Takeover-Via-PostMessage/
Information Security
https://twitter.com/CyberRaiju/status/1269197833179000838
Twitter
Jai Minton
Found a service running as SYSTEM from the public folder. This by default grants permissions to everyone. Makes it trivial to use for privesc and persistence. May want to check, will show MS FW rules also. reg query HKLM\SYSTEM\CurrentControlSet\services…
Information Security
https://medium.com/@odayalhalbe1/how-i-earned-500-from-google-by-change-one-character-8350d2b618e5
Medium
How i earned $500 from google by change one character .
Greetings,
Information Security
https://github.com/ahussam/url-tracker
GitHub
GitHub - al-sultani/url-tracker: Change monitoring app that checks the content of web pages in different periods.
Change monitoring app that checks the content of web pages in different periods. - al-sultani/url-tracker
Information Security
https://medium.com/@hbothra22/xss-to-database-credential-leakage-database-access-story-of-total-luck-77c990be8ab2
Medium
XSS to Database Credential Leakage & Database Access — Story of total luck!
Reflected Cross-Site Scripting happens when you provide a malicious javascript code to some input parsing functionality and due to lack of…
Information Security
https://www.rapid7.com/research/report/metasploit-development-diaries-q2-2019/
Rapid7
Metasploit Dev Diaries: How Vulns Become Metasploit Modules
Metasploit’s Development Diaries series sheds light on how Rapid7’s offensive research team analyzes vulnerabilities as potential candidates for inclusion in Metasploit Framework.
Information Security
https://medium.com/@shantanukhande/red-team-using-sharpchisel-to-exfil-internal-network-e1b07ed9b49
Medium
Red Team: Using SharpChisel to exfil internal network
During many Red Team Assessment, we use multiple agents to connect to our target network infrastructure. These agents connect to different…
Information Security
https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
Sonar Community
[Tech Story] Apache Kylin 3.0.1 Command Injection Vulnerability
Apache Kylin is an open source, distributed Analytical Data Warehouse for Big Data written in Java. It was originally developed by eBay and is used by global enterprises such as Cisco, Baidu and Xiaomi to analyze extremely large datasets. After a SQL injection…
Information Security
https://www.synacktiv.com/posts/reverse-engineering/a-journey-in-reversing-uefi-lenovo-passwords-management.html
Information Security
https://hakin9.org/pwncat-netcat-on-steroids-with-firewall-ids-ips-evasion-bind-and-reverse-shell-self-injecting-shell-and-port-forwarding-magic-and-its-fully-scriptable-with-python-pse/
Information Security
https://medium.com/bugbountywriteup/rce-p-xss-reverse-shell-through-file-uploads-8faae5204cf2
Information Security
https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
HACKINGISCOOL
Cmd Hijack - a command/argument confusion with path traversal in cmd.exe
This one is about an interesting behavior
🤭
I identified in cmd.exe in result of many weeks of intermittent (private time, every now and then) research in pursuit of some new OS Command Injection attack vectors.
So I was mostly trying to:
* find an encoding…
Information Security
https://github.com/Microsvuln/cve-2019-1458_POC
GitHub
GitHub - Microsvuln/cve-2019-1458_POC: POC for cve-2019-1458
POC for cve-2019-1458. Contribute to Microsvuln/cve-2019-1458_POC development by creating an account on GitHub.
Information Security
https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
Artem Kondratenko
CVE-2017-3881 Cisco Catalyst RCE Proof-Of-Concept
Digging deep into CIA Vault 7 documents to craft Proof-Of-Concept remote code execution for Cisco Catalyst switches
Information Security
http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/
Information Security
https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html
Blogspot
Reverse Engineering Cisco ASA for EXTRABACON Offsets
Update Sept. 24: auxiliary/admin/cisco/cisco_asa_extrabacon is now in the Metasploit master repo. There is support for the original ExtraBa...
Information Security
https://blog.talosintelligence.com/2020/05/dynamic-data-resolver-1-0.html
Cisco Talos Blog
Dynamic Data Resolver (DDR) — IDA Plugin 1.0 beta
10/20/20 Update: A new version of this software and associated blog can be found here
Executive summary Static reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a…
Information Security
https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/
www.thirtythreeforty.net
Hacking Reolink cameras for fun and profit
Dragging Reolink, kicking and screaming, into the light of the open-standards day
Information Security
https://www.youtube.com/watch?v=4urMITJKQQs
YouTube
Reverse engineering with #Ghidra: Breaking an embedded firmware encryption scheme
In this video we will look at reverse engineering and hacking the firmware encryption used on Moxa industrial control gateways using Ghidra.
Links:
Twitter: https://twitter.com/ghidraninja
Moxa W2150A: https://www.moxa.com/en/products/industrial-edge-co…
Information Security
https://cjhackerz.net/posts/writeup-first-ever-real-like-simulated-iot-security-challenge/
cjhackerz.net
WriteUp: First ever real like simulated IoT security challenge
This is technical writeup for personal CTF challenge I create to show off my understading in hardware/IoT security testcases
