Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://medium.com/datadriveninvestor/api-security-testing-part-1-b0fc38228b93
Medium
API Security Testing(Part 1)
All the information mentioned in this article are of my personal and aren’t the opinions of my past or present employer.
Information Security
https://medium.com/@adeshkolte/how-i-made-1000-at-t-bug-bounty-h1-14e68b284e2f
Medium
How I made 1000$ with AT&T Bug Bounty(H1)
Hello, Guys, I m back with a new Story on bug bounty, I found this bug last year on AT&T bug bounty program (Now its H1 Program), thought…
Information Security
https://medium.com/@pflash0x0punk/how-paypal-helped-me-to-generate-xss-9408c0931add
Medium
How PayPal helped me to generate XSS
So one day I was doing some work with my friend and visited PayPal to get a Pay with PayPal button. I logged in to PayPal and moved to…
Information Security
https://medium.com/@chawdamrunal/what-is-parameter-tampering-5b1beb12c5ba
Medium
What is Parameter Tampering
Parameter Tampering: Special Characters
Information Security
https://blog.deepsec.net/deepsec-2019-talk-whats-wrong-with-websocket-apis-unveiling-vulnerabilities-in-websocket-apis-mikhail-egorov/
DeepSec In-Depth Security Conference
DeepSec 2019 Talk: What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs - Mikhail Egorov
WebSocket protocol is many times more efficient than HTTP. In recent years we can observe that developers tend to implement functionality in the form of WebSocket APIs instead of traditional REST APIs, that use HTTP. Modern technologies and frameworks simplify…
Information Security
https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
Medium
Undetectable C# & C++ Reverse Shells
Technical overview of different way to spawn a reverse shell on a victim machine
Information Security
https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
Shells.Systems
rConfig v3.9.2 authenticated and unauthenticated RCE (CVE-2019-16663) and (CVE-2019-16662) - Shells.Systems
Estimated Reading Time: 6 minutes Summary about rConfig rConfig is an open source network device configuration management utility for network engineers to take frequent configuration snapshots of their network devices. About the exploit I was able two detect…
Information Security
https://mazinahmed.net/blog/breaking-jwt/
Mazin Ahmed
Practical Approaches for Testing and Breaking JWT Authentication
Information Security
https://www.imperva.com/learn/performance/reverse-proxy/
Learning Center
What is a Reverse Proxy Server | Reverse vs. Forward Proxy | CDN Guide | Imperva
What is a reverse proxy, how is it used by CDNs and how does it differ from a forward proxy?
Information Security
command line magic
find . -empty -type d # List of empty subdirectories under current directory.
Information Security
https://0xrick.github.io/hack-the-box/safe/
0xRick's Blog
Hack The Box - Safe
My write-up / walkthrough for Safe from Hack The Box.
Information Security
https://medium.com/@saurabh5392/how-i-earned-by-finding-confidential-customer-data-including-plain-text-passwords-f93c4ce2631
Medium
How I earned $$$$ by finding confidential customer data including plain-text passwords!
How directory indexing and file path traversal led to confidential customer data in plain sight!
Information Security
https://www.exploit-db.com/exploits/47525
Exploit Database
WinRAR 5.80 (x64) - Denial of Service
WinRAR 5.80 (x64) - Denial of Service.. dos exploit for Windows_x86-64 platform
Information Security
https://appio.dev/vulns/clickjacking-xss-on-google-org/
Web Security Blog
Clickjacking DOM XSS on Google.org - Web Security Blog
Getting from a self-XSS vulnerability to a valid DOM XSS with the help of clickjacking on Google.org's Crisis Map.
Information Security
https://appio.dev/vulns/google-csp-evaluator/
Thomas Orlita’s blog
How to use Google's CSP Evaluator to bypass CSP - Thomas Orlita’s blog
Have you ever found an XSS only to find out there’s an active CSP that blocks execution of any scripts?If you want it to work on all browsers, not just IE (which doesn’t support CSP), there’s still a chance to bypass it! Use Google’s CSP Evaluator to find…
Information Security
https://github.com/google/csp-evaluator/tree/master/whitelist_bypasses/json
GitHub
google/csp-evaluator
Contribute to google/csp-evaluator development by creating an account on GitHub.
Information Security
https://github.com/google/csp-evaluator
GitHub
GitHub - google/csp-evaluator
Contribute to google/csp-evaluator development by creating an account on GitHub.
Information Security
https://appio.dev/vulns/googleplex-com-blind-xss/
Web Security Blog
XSSing Google Employees — Blind XSS on googleplex.com - Web Security Blog
A write-up about how it was possible to execute a blind XSS on behalf of a Google Employee and get access to Google's invoices.
Information Security
https://medium.com/swlh/attacking-sites-using-csrf-ba79b45b6efe
Medium
Attacking Sites Using CSRF
From CSRF to user information leak, XSS and full account takeover.
Information Security
https://foxglovesecurity.com/2017/02/07/type-juggling-and-php-object-injection-and-sqli-oh-my/
Foxglovesecurity
Type Juggling and PHP Object Injection, and SQLi, Oh My!
By @jstnkndy While looking for bugs in a target recently I came across a host that was running Expression Engine, a content management platform. This specific application caught my ey…
