Information Security
@sec_nerd_en
413 subscribers
157 photos
5 videos
9 files
2.28K links
Information Security News

we are @sec_nerd twin brother
Download Telegram
About
Blog
Apps
Platform
Join
Information Security
413 subscribers
Information Security
Nostromo httpd RCE vulnerability (CVE-2019-16278) #bugbountytips

https://github.com/jas502n/CVE-2019-16278
110 viewsedited  
Information Security
https://medium.com/datadriveninvestor/api-security-testing-part-1-b0fc38228b93
Medium
API Security Testing(Part 1)
All the information mentioned in this article are of my personal and aren’t the opinions of my past or present employer.
100 views
Information Security
https://medium.com/@adeshkolte/how-i-made-1000-at-t-bug-bounty-h1-14e68b284e2f
Medium
How I made 1000$ with AT&T Bug Bounty(H1)
Hello, Guys, I m back with a new Story on bug bounty, I found this bug last year on AT&T bug bounty program (Now its H1 Program), thought…
89 views
Information Security
https://medium.com/@pflash0x0punk/how-paypal-helped-me-to-generate-xss-9408c0931add
Medium
How PayPal helped me to generate XSS
So one day I was doing some work with my friend and visited PayPal to get a Pay with PayPal button. I logged in to PayPal and moved to…
80 views
Information Security
https://medium.com/@chawdamrunal/what-is-parameter-tampering-5b1beb12c5ba
Medium
What is Parameter Tampering
Parameter Tampering: Special Characters
88 views
Information Security
https://blog.deepsec.net/deepsec-2019-talk-whats-wrong-with-websocket-apis-unveiling-vulnerabilities-in-websocket-apis-mikhail-egorov/
DeepSec In-Depth Security Conference
DeepSec 2019 Talk: What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs - Mikhail Egorov
WebSocket protocol is many times more efficient than HTTP. In recent years we can observe that developers tend to implement functionality in the form of WebSocket APIs instead of traditional REST APIs, that use HTTP. Modern technologies and frameworks simplify…
88 views
Information Security
https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
Medium
Undetectable C# & C++ Reverse Shells
Technical overview of different way to spawn a reverse shell on a victim machine
112 views
Information Security
https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
Shells.Systems
rConfig v3.9.2 authenticated and unauthenticated RCE (CVE-2019-16663) and (CVE-2019-16662) - Shells.Systems
Estimated Reading Time: 6 minutes Summary about rConfig rConfig is an open source network device configuration management utility for network engineers to take frequent configuration snapshots of their network devices. About the exploit I was able two detect…
94 views
Information Security
https://mazinahmed.net/blog/breaking-jwt/
Mazin Ahmed
Practical Approaches for Testing and Breaking JWT Authentication
101 views
Information Security
https://www.imperva.com/learn/performance/reverse-proxy/
Learning Center
What is a Reverse Proxy Server | Reverse vs. Forward Proxy | CDN Guide | Imperva
What is a reverse proxy, how is it used by CDNs and how does it differ from a forward proxy?
124 views
Information Security
command line magic

find . -empty -type d # List of empty subdirectories under current directory.
164 views
Information Security
https://0xrick.github.io/hack-the-box/safe/
0xRick's Blog
Hack The Box - Safe
My write-up / walkthrough for Safe from Hack The Box.
104 views
Information Security
https://medium.com/@saurabh5392/how-i-earned-by-finding-confidential-customer-data-including-plain-text-passwords-f93c4ce2631
Medium
How I earned $$$$ by finding confidential customer data including plain-text passwords!
How directory indexing and file path traversal led to confidential customer data in plain sight!
112 views
Information Security
https://www.exploit-db.com/exploits/47525
Exploit Database
WinRAR 5.80 (x64) - Denial of Service
WinRAR 5.80 (x64) - Denial of Service.. dos exploit for Windows_x86-64 platform
115 views
Information Security
https://appio.dev/vulns/clickjacking-xss-on-google-org/
Web Security Blog
Clickjacking DOM XSS on Google.org - Web Security Blog
Getting from a self-XSS vulnerability to a valid DOM XSS with the help of clickjacking on Google.org's Crisis Map.
101 views
Information Security
https://appio.dev/vulns/google-csp-evaluator/
Thomas Orlita’s blog
How to use Google's CSP Evaluator to bypass CSP - Thomas Orlita’s blog
Have you ever found an XSS only to find out there’s an active CSP that blocks execution of any scripts?If you want it to work on all browsers, not just IE (which doesn’t support CSP), there’s still a chance to bypass it! Use Google’s CSP Evaluator to find…
103 views
Information Security
https://github.com/google/csp-evaluator/tree/master/whitelist_bypasses/json
GitHub
google/csp-evaluator
Contribute to google/csp-evaluator development by creating an account on GitHub.
88 views
Information Security
https://github.com/google/csp-evaluator
GitHub
GitHub - google/csp-evaluator
Contribute to google/csp-evaluator development by creating an account on GitHub.
88 views
Information Security
https://appio.dev/vulns/googleplex-com-blind-xss/
Web Security Blog
XSSing Google Employees — Blind XSS on googleplex.com - Web Security Blog
A write-up about how it was possible to execute a blind XSS on behalf of a Google Employee and get access to Google's invoices.
88 views
Information Security
https://medium.com/swlh/attacking-sites-using-csrf-ba79b45b6efe
Medium
Attacking Sites Using CSRF
From CSRF to user information leak, XSS and full account takeover.
86 views