Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://cybergibbons.com/reverse-engineering-2/brute-forcing-device-passwords/
Cybergibbons
Brute forcing device passwords
When working with IoT and embedded systems, brute-force password guessing attacks are an effective tool to gain access. Over the years, I’ve learned some tips and tricks to make these attacks…
Information Security
https://blog.securelayer7.net/unauthenticated-file-upload-vulnerability-on-synology-sub-domain/
Penetration Testing and CyberSecurity Solution - SecureLayer7
Unauthenticated File upload Vulnerability on Synology Sub-domain
In this post, you will learn about how I could find the unauthenticated file upload vulnerability in Synology and, according to Synology's highest amount for website security bounty. Start Point to...
Information Security
https://medium.com/bugbountywriteup/what-is-parameter-tampering-5b1beb12c5ba
Medium
What is Parameter Tampering
Parameter Tampering: Special Characters
Information Security
https://github.com/BC-SECURITY/Invoke-ZeroLogon
GitHub
GitHub - BC-SECURITY/Invoke-ZeroLogon: Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller…
Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller itself, and execute remote procedure calls on their behalf. - BC-SECURITY/Invoke-ZeroLogon
Information Security
https://www.youtube.com/c/krypt0muxbugbounty
Information Security
https://speakerdeck.com/harshbothra/broken-cryptography-and-account-takeovers
Speaker Deck
Broken Cryptography & Account Takeovers
Applications still utilize weak cryptography generation methodologies which may lead to severe risk. In the world of Application Security, looking for a…
Information Security
https://github.com/dwisiswant0/go-stare
GitHub
GitHub - dwisiswant0/go-stare: A fast & light web screenshot without headless browser but Chrome DevTools Protocol!
A fast & light web screenshot without headless browser but Chrome DevTools Protocol! - dwisiswant0/go-stare
Information Security
https://ssd-disclosure.com/ssd-advisory-php-spldoublylinkedlist-uaf-sandbox-escape/
SSD Secure Disclosure
SSD Advisory – PHP SplDoublyLinkedList UAF Sandbox Escape - SSD Secure Disclosure
TL;DR Find out how a use after free vulnerability in PHP allows attackers that are able to run PHP code to escape disable_functions restrictions. Vulnerability Summary PHP’s SplDoublyLinkedList is vulnerable to an UAF since it has been added to PHP’s core…
Information Security
https://twitter.com/intigriti/status/1309104069643055111
Twitter
INTIGRITI
Testing for XSS via “javascript:” but it’s blocked by a WAF? Try these bypasses. Thanks for the #BugBountyTip, @SecurityMB! #BugBountyTips #HackWithIntigriti
Information Security
https://medium.com/@datafarm.cybersecurity/exploiting-sigred-cve-2020-1350-on-windows-server-2012-2016-2019-80dd88594228
Medium
Exploiting SIGRed (CVE-2020–1350) on Windows Server 2012/2016/2019
by Worawit Wangwarunyoo , DATAFARM Research Team, Datafarm Company Limited
Information Security
https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142
Medium
The Powerful HTTP Request Smuggling
💪
TL;DR: This is how I was able to exploit a HTTP Request Smuggling in a Mobile Device Management (MDM) servers and send any MDM command to…
Information Security
https://www.gremwell.com/firefox-xss-302
Information Security
https://twitter.com/hunter0x7/status/1312110348841840640?s=20
Twitter
Ahsan Khan
GET /admin HTTP/1.1 Host: https://t.co/kc0BFkaTX3 ... Access is denied GET /test HTTP/1.1 Host: https://t.co/kc0BFkaTX3 X-Original-URL: /admin HTTP/1.1 200 OK
Information Security
https://3os.org/raspberryPi/TOR-Pi/
Information Security
https://medium.com/bugbountywriteup/hacking-the-medium-partner-program-84c0e9fa340
Medium
Hacking the Medium partner program
How my name was added to humans.txt for scoring my first bug bounty, a severity 2 one at that!
Information Security
https://ninetyn1ne.github.io/2020-10-05-open-redir-to-ato/
Home
Watch your requests!
open redirect to a complete account takeover
Information Security
https://mazinahmed.net/uploads/Evading%20All%20Web-Application%20Firewalls%20XSS%20Filters.pdf
Information Security
https://github.com/GainSec/GoldenNuggets-1
GitHub
GitHub - GainSec/GoldenNuggets-1: Burp Extension for easily creating Wordlists
Burp Extension for easily creating Wordlists. Contribute to GainSec/GoldenNuggets-1 development by creating an account on GitHub.
Information Security
http://www.missoumsai.com/google-csrfs.html
Information Security
https://medium.com/@nasbench/a-deep-dive-into-rundll32-exe-642344b41e90
Medium
A Deep Dive Into RUNDLL32.EXE
Understanding “rundll32.exe” command line arguments
