Information Security
@sec_nerd_en
415
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
415 subscribers
Information Security
https://github.com/Airboi/CVE-2020-17144-EXP
GitHub
GitHub - Airboi/CVE-2020-17144-EXP: Exchange2010 authorized RCE
Exchange2010 authorized RCE. Contribute to Airboi/CVE-2020-17144-EXP development by creating an account on GitHub.
Information Security
https://www.kitploit.com/2020/12/restler-first-stateful-rest-api-fuzzing.html
KitPloit - PenTest & Hacking Tools
RESTler - The First Stateful REST API Fuzzing Tool For Automatically Testing Cloud Services Through Their REST APIs And Finding…
Information Security
https://portswigger.net/research/portable-data-exfiltration
PortSwigger Research
Portable Data exFiltration: XSS for PDFs
Abstract PDF documents and PDF generators are ubiquitous on the web, and so are injection vulnerabilities. Did you know that controlling a measly HTTP hyperlink can provide a foothold into the inner w
Information Security
https://i.blackhat.com/asia-20/Friday/asia-20-Xu-Win-The-0-Day-Racing-Game-Against-Botnet-In-Public-Cloud.pdf
Information Security
https://github.com/RenwaX23/X/blob/master/ctf/asis2020/maskstore.md
GitHub
RenwaX23/X
Playground. Contribute to RenwaX23/X development by creating an account on GitHub.
Information Security
https://staaldraad.github.io/post/2020-12-15-cve-2020-25695-postgresql-privesc/
Staaldraad
CVE-2020-25695 Privilege Escalation in Postgresql
It has been quite a year, I hope everyone is well and staying safe. This is my first and probably only post for the year, and covers a fun privilege escalation vulnerability I found in Postgresql. This affects all supported versions of Postgresql going back…
Information Security
https://vx-underground.org/samples/Exotic/
Information Security
https://twitter.com/enovella_/status/1339508767201914880?s=20
Twitter
Eduardo Novella
Android unpacker powered by #Frida working on all the #Android OS versions (Android 4-11). Defeat Java #packers via #Frida instrumentation
📱
🛠️
github.com/enovella/fridr… //c @fridadotre
Information Security
https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/
Information Security
https://www.adambarth.com/papers/2008/barth-jackson-mitchell.pdf
Information Security
https://twitter.com/h3xstream/status/1341080890018066432?s=20
Twitter
Philippe Arteau
Small #SSTI trick: Blind Template Injection with handling of some sandbox escapes. Payload in the workshop below. #dns #freemarker #pentest #BurpSuite Based on work from @olekmirosh and @pwntester https://t.co/H1YxMeD4o1
Information Security
https://halove23.blogspot.com/2020/12/oh-so-you-have-antivirus-nameevery-bug.html
Information Security
https://github.com/cyberark/shimit
GitHub
GitHub - cyberark/shimit: A tool that implements the Golden SAML attack
A tool that implements the Golden SAML attack. Contribute to cyberark/shimit development by creating an account on GitHub.
Information Security
https://ysamm.com/?p=510
Information Security
https://owasp.org/www-chapter-vancouver/assets/presentations/2020-01_Attacking_and_Securing_JWT.pdf
Information Security
https://www.shielder.it/blog/2020/04/1-click-rce-on-keybase/
Shielder
Shielder - 1-click RCE on Keybase
Keybase client allowed inject arbitrary links with arbitrary protocols. This caused a Remote Command Execution on Windows and MacOS.
Information Security
https://www.betterhacker.com/2021/01/the-burp-extension-no-one-told-you-about.html
Betterhacker
The Burp Extension No One Told You About
Some time last year, I came across a Burp extension on Github that replicates the Invoke Applications functionality from OWASP ZAP in Burp....
Information Security
https://medium.com/bugbountywriteup/the-type-of-recon-that-you-may-skip-on-purpose-but-this-is-why-you-shouldnt-272aa74e08be
Medium
The type of recon that you may skip on purpose, but this is why you shouldn’t
, or why being too quick can lead to a false positive
Information Security
https://www.hackingarticles.in/android-penetration-testing-frida/
Hacking Articles
Android Penetration Testing: Frida
Learn how to use Frida for Android penetration testing, including hooking, injecting, and analyzing Android apps for security vulnerabilities.
Information Security
https://iustin24.github.io/Cache-Key-Normalization-Denial-of-Service
