Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://blog.br0vvnn.io/pages/blogpost.aspx?id=5
Information Security
https://s0md3v.medium.com/deblurring-images-for-osint-part-2-ba564af8eb5d
Medium
Deblurring images for OSINT — Part 2
Let’s reverse Pixelize blur.
Information Security
https://medium.com/@kingkarankumarpnbe/10-000-for-automatic-email-confirmation-bug-in-microsofts-edge-browser-22f15ceccb4a
Medium
$10,000 for automatic email confirmation bug in Microsoft’s Edge browser
Hey folks, welcome to my first bug bounty writeup, which I found on Microsoft Edge (Chromium) browser.
Information Security
https://research.nccgroup.com/2021/01/21/mssql-lateral-movement/
NCC Group Research Blog
MSSQL Lateral Movement
Using discovered credentials to move laterally in an environment is a common goal for the NCC Group FSAS team. The ability to quickly and reliably use a newly gained set of credentials is essential…
Information Security
https://blog.shoebpatel.com/2021/01/23/The-Secret-Parameter-LFR-and-Potential-RCE-in-NodeJS-Apps/
CaptainFreak
The Secret Parameter, LFR, and Potential RCE in NodeJS Apps
TL;DRIf you are using ExpressJs with Handlebars as templating engine invoked via hbs view engine, for Server Side Rendering, you are likely vulnerable to Local File Read (LFR) and potential Remote Co
Information Security
https://c4ebt.github.io/2021/01/22/House-of-Rust.html
c4e's Blog
Bypassing GLIBC 2.32’s Safe-Linking Without Leaks into Code Execution: The House of Rust
The House of Rust is a heap exploitation technique that drops a shell against full PIE binaries that don’t leak any addresses.
Information Security
https://github.com/veeral-patel/how-to-secure-anything
GitHub
GitHub - veeral-patel/how-to-secure-anything: How to systematically secure anything: a repository about security engineering
How to systematically secure anything: a repository about security engineering - veeral-patel/how-to-secure-anything
Information Security
https://github.com/ea/bosch_headunit_root
GitHub
GitHub - ea/bosch_headunit_root: Documentation and code for rooting and extending a Bosch car head unit (lcn2kai)
Documentation and code for rooting and extending a Bosch car head unit (lcn2kai) - ea/bosch_headunit_root
Information Security
https://www.marketscreener.com/amp/quote/stock/QUALYS-INC-11612572/news/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-32280840
Information Security
https://securitylab.github.com/advisories/GHSL-2020-214_223-onedev
GitHub Security Lab
GHSL-2020-214_223: 10 CVEs in OneDev ranging from pre-auth Remote Code Execution (RCE) to Arbitrary File Read/Write
Multiple vulnerabilities were found in the OneDev project ranging from pre-auth Remote Code Execution (RCE) to Arbitrary File Read/Write
Information Security
https://github.com/cncf/sig-security/blob/master/security-whitepaper/CNCF_cloud-native-security-whitepaper-Nov2020.pdf
#Cloud
Information Security
https://www.intezer.com/blog/research/how-we-hacked-azure-functions-and-escaped-docker/
Information Security
https://blog.0patch.com/2021/01/windows-installer-local-privilege.html
0Patch
Windows Installer Local Privilege Escalation 0day Gets a Micropatch
by Mitja Kolsek, the 0patch Team [Update 2/9/2021: February 2021 Windows Updates included an official fix for this vulnerability and ass...
Information Security
https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html
Blogspot
A Look at iMessage in iOS 14
Posted By Samuel Groß, Project Zero On December 20, Citizenlab published “ The Great iPwn ”, detailing how “Journalists [were] Hacked ...
Information Security
https://www.blackarrow.net/from-n-day-exploit-to-kerberos-eop-in-linux-environments/
Tarlogic Security
BlackArrow - Offensive security services
BlackArrow is the offensive and defensive security services division of Tarlogic Security. A team of high level professionals
Information Security
https://theori.io/research/escaping-chrome-sandbox
#Chrome
#Sandbox
Information Security
https://blog.ret2.io/2019/08/28/sia-coin-dns-rebinding
RET2 Systems Blog
A Cryptocurrency Heist, Starring Your Web Browser
Beneath the surface, the modern web is made possible only through a growing labryinth of technology standards. Standards are designed to govern the interoper...
Information Security
https://blog.blazeinfosec.com/attack-of-the-clones-github-desktop-remote-code-execution/
Information Security
https://github.com/Ruia-ruia/sudoHeapOverflow
GitHub
Ruia-ruia/sudoHeapOverflow
After getting a crash such that rbx was mangled... I spent the weekend adjusting and tweaking the malicious inputs to get it to work. It was honestly just trial n error so nothing clever on my part...
Information Security
https://spaceraccoon.dev/applying-offensive-reverse-engineering-to-facebook-gameroom
spaceraccoon.dev
Applying Offensive Reverse Engineering to Facebook Gameroom
Late last year, I was invited to Facebook’s Bountycon event, which is an invitation-only application security conference with a live-hacking segment. Although participants could submit vulnerabilities for any Facebook asset, Facebook invited us to focus on…
