Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://fellchase.blogspot.com/2019/12/releasing-flumberbuckets-s3-bucket-enumeration-tool.html
Blogspot
Releasing Flumberbuckets: S3 Bucket Enumeration Tool for Bug Hunters
Flumberbuckets is a S3 bucket enumeration tool which helps to streamline and speed up S3 bucket hunting process, with effective visual presentation of vulnerable buckets. It runs several tests on several buckets in tandem to find vulnerable buckets, saving…
Information Security
https://github.com/s0md3v/Silver
GitHub
GitHub - s0md3v/Silver: Mass scan IPs for vulnerable services
Mass scan IPs for vulnerable services. Contribute to s0md3v/Silver development by creating an account on GitHub.
Information Security
https://www.whitehatsec.com/blog/hash-length-extension-attacks/
Application Security Blog
We offer authoritative insight and opinions on software and application security breaking news, analysis, and business intelligence from the leading Software Integrity Group at Synopsys.
Information Security
https://github.com/m0rph-1/CVE-2019-19383/
GitHub
cwinfosec/CVE-2019-19383
FreeFTPd 1.0.8 Post-Authentication Buffer Overflow via SIZE - cwinfosec/CVE-2019-19383
Information Security
https://research.nccgroup.com/2019/12/19/on-linuxs-random-number-generation/
NCC Group Research
On Linux’s Random Number Generation
I have been asked about the usefulness of security monitoring of entropy levels in the Linux kernel. This calls for some explanation of how random generation works in Linux systems. So, randomness …
Information Security
https://support.portswigger.net/customer/portal/articles/1841101-configuring-an-android-device-to-work-with-burp
portswigger.net
Configuring an Android device to work with Burp Suite
You can configure an Android device to proxy HTTP traffic through Burp Suite. This enables you to test Android apps just like ordinary websites. The process ...
Information Security
https://medium.com/@rootxharsh_90844/abusing-feature-to-steal-your-tokens-f15f78cebf74
Medium
Abusing feature to steal your tokens
In mid-2018, Linode private Hackerone program got me engaged because of how well the program was getting managed. I found quite of issues…
Information Security
https://github.com/rvrsh3ll/Misc-Powershell-Scripts
GitHub
GitHub - rvrsh3ll/Misc-Powershell-Scripts: Random Tools
Random Tools. Contribute to rvrsh3ll/Misc-Powershell-Scripts development by creating an account on GitHub.
Information Security
https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass
www.ired.team
Dumping Lsass without Mimikatz with MiniDumpWriteDump | Red Team Notes
Evasion, Credential Dumping
Information Security
https://medium.com/cyberverse/host-header-injection-simplify-bug-bounty-hunting-2a19284da796
Medium
Host-Header Injection Simplify | Bug Bounty Hunting !
In this blog I’ll cover the most asked questions on “Host Header Injection”
Information Security
https://www.youtube.com/watch?v=HaW15aMzBUM
YouTube
Intro to PHP Deserialization / Object Injection
00:50 - Background information, showing variables are point in time
03:40 - Creating a PHP Class and Object
05:40 - Serializing the Object and going over the format
07:40 - Converting the script to accept a PHP Object via WebRequest
09:20 - Explaining PHP…
Information Security
https://github.com/imperva/automatic-api-attack-tool
GitHub
GitHub - imperva/automatic-api-attack-tool: Imperva's customizable API attack tool takes an API specification as an input, generates…
Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output. - imperva/automatic-api-attack-tool
Information Security
https://www.hackingarticles.in/multiple-ways-to-capture-memory-for-analysis/
Hacking Articles
Multiple ways to Capture Memory for Analysis - Hacking Articles
In this article we will be going to learn the how to capture the RAM memory for analysis, there are various ways to do it
Information Security
https://samcurry.net/filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty/
samcurry.net
Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty
I was in San Francisco the few days leading up to me finding this bug with some friends. We’d spent the day hacking before a few of us were traveling to Vegas for DEF CON the next day. Some of them were going on a road trip and I decided to join them at the…
Information Security
https://mauronz.github.io/userafterfree-writeup/
mauronz
Write-up: User-After-Free by MalwareTech
This time I decided to attempt something different from usual: user-after-free is a challenge based on heap exploitation created by MalwareTech. After all, knowing a bit of binary exploitation is useful for malware analysis.
Information Security
http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
Information Security
https://medium.com/bugbountywriteup/cross-site-scripting-on-a-big-banks-payment-gateway-a986a2ba5d7
Information Security
https://github.com/tegal1337/Shelly
GitHub
GitHub - tegal1337/Shelly: Simple Backdoor Manager with Python (based on weevely)
Simple Backdoor Manager with Python (based on weevely) - tegal1337/Shelly
Information Security
https://www.peerlyst.com/posts/powershell-for-exploitation-and-post-exploitation-david-dunmore
Information Security
https://googleprojectzero.blogspot.com/2019/09/windows-exploitation-tricks-spoofing.html
Blogspot
Windows Exploitation Tricks: Spoofing Named Pipe Client PID
Posted by James Forshaw, Project Zero While researching the Access Mode Mismatch in IO Manager bug class I came across an interesti...
