Information Security
@sec_nerd_en
415
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
415 subscribers
Information Security
http://securityviacode.in/view_article/+MalwinX:+A+framework+for+learning+Malware+and+win32+functions
Information Security
https://github.com/sailay1996/UAC_Bypass_In_The_Wild
GitHub
GitHub - sailay1996/UAC_Bypass_In_The_Wild: Windows 10 UAC bypass for all executable files which are autoelevate true .
Windows 10 UAC bypass for all executable files which are autoelevate true . - GitHub - sailay1996/UAC_Bypass_In_The_Wild: Windows 10 UAC bypass for all executable files which are autoelevate true .
Information Security
https://github.com/SukaraLin/CVE-2019-2890
GitHub
GitHub - l1nk3rlin/CVE-2019-2890
Contribute to l1nk3rlin/CVE-2019-2890 development by creating an account on GitHub.
Information Security
Ppl should be aware about -D options in
#nmap
, decoys are sooooo useful for detection evasion
Information Security
https://know.bishopfox.com/blog/2015/08/coldfusion-bomb-a-chain-reaction-from-xss-to-rce
Bishop Fox
Blog
Listing of Bishop Fox Security Research in the form of technical, security advisories, and industry blog posts.
Information Security
https://github.com/Metnew/telegram-links-nsworkspace-open
GitHub
GitHub - Metnew/telegram-links-nsworkspace-open: Telegram (v4.9.155353) was rendering file:// links + opening them via NSWorkspace.open…
Telegram (v4.9.155353) was rendering file:// links + opening them via NSWorkspace.open -> code execution. - GitHub - Metnew/telegram-links-nsworkspace-open: Telegram (v4.9.155353) was render...
Information Security
https://medium.com/@ss23/php-autloading-local-file-inclusion-by-design-71aafe627877
Medium
PHP Autloading: Local File Inclusion by Design
In the year 2009, PHP 5.3 was released, bringing with it major new features like namespaces and lambda functions. At the time, there was…
Information Security
https://hackerone.com/reports/713
HackerOne
HackerOne disclosed on HackerOne: Upload profile photo from URL
Using this vulnerability users can upload images from any image URL.
Just change upload type using inspect element (from "type=file" to "type=url") , paste URL in text field and hit enter or...
Information Security
https://medium.com/@neerajedwards/reading-internal-files-using-ssrf-vulnerability-703c5706eefb
Medium
Reading Internal Files using SSRF vulnerability
I am hunting on one private program since last 8 months, since it doesn’t allow disclosure i will keep organization REDACT, in requests i…
Information Security
https://medium.com/bugbountywriteup/how-i-was-able-to-remove-your-instagram-phone-number-d346515e79c3
Medium
How I was able to remove your Instagram Phone number
Phone numbers are the most important Out-of-band features in network and security, now a days from phone number we register, login for an…
Information Security
https://medium.com/bugbountywriteup/how-i-was-able-to-bypass-otp-token-requirement-in-razer-the-story-of-a-critical-bug-fc63a94ad572
Medium
How I was able to bypass OTP code requirement in Razer [The story of a critical bug]
A story of turning an Informative bug to critical bug
Information Security
https://www.perched.io/blog/2019/1/3/dns-tunneling-amp-other-hunts-w-rocknsm-bro-amp-elk
Information Security
https://www.slideshare.net/mobile/Insovince/external-service-interaction
www.slideshare.net
External service interaction
External Service Interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server e…
Information Security
https://portswigger.net/kb/issues/00300200_external-service-interaction-dns
portswigger.net
External service interaction (DNS)
The ability to induce an application to interact with an arbitrary external service, such as a web or mail server, does not constitute a vulnerability in its own right. This might even be the intended behavior of the application. However, in some cases, it…
Information Security
https://medium.com/@chawdamrunal/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b
Medium
How i exploit out-of-band resource load (HTTP) using burp suite extension plugin (taborator)
Issue background
Information Security
Jailbreak2019.WhatsUpWithWhatsApp.pdf
2.9 MB
https://vimeo.com/377181218
Information Security
https://pentestmag.com/exploiting-the-entity-xme-xml-external-entity-injection/
Pentestmag
Exploiting The Entity: XXE (XML External Entity Injection) - Pentestmag
History In the recent year, major tech giants, like Google, Facebook, Magento, Shopify, Uber, Twitter, and Microsoft, have undergone XML …
Information Security
https://hackerone.com/reports/506646
HackerOne
Starbucks disclosed on HackerOne: Webshell via File Upload on...
johnstone discovered An arbitrary file upload via the resume functionality at https://ecjobs.starbucks.com.cn which led to arbitrary code execution by uploading a webshell.
@johnstone — thank for...
Information Security
https://medium.com/@johnssimon_6607/getting-access-to-disabled-hidden-features-with-the-help-of-burp-match-and-replace-e1d7b70d131e
Medium
Getting access to disabled/hidden features with the help of Burpsuite Match and Replace settings
A few months ago, During my bug bounty hunting, I came across a Company that lets other developers create API documentation similar to…
Information Security
https://github.com/jreppiks/CVE-2017-12149
GitHub
GitHub - jreppiks/CVE-2017-12149: Jboss Java Deserialization RCE (CVE-2017-12149)
Jboss Java Deserialization RCE (CVE-2017-12149). Contribute to jreppiks/CVE-2017-12149 development by creating an account on GitHub.
