Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://labs.detectify.com/2021/02/18/middleware-middleware-everywhere-and-lots-of-misconfigurations-to-fix/
Labs Detectify
Middleware everywhere and misconfigurations to fix - Labs Detectify
We found some interesting middleware misconfigurations and potential exploits affecting Nginx web servers, load balancers, and proxies.
Information Security
https://sprocketfox.io/xssfox/2021/01/18/pipeline/
sprocketfox.io
Build Pipeline Security
Security concerns with PR build systems
Information Security
https://alephsecurity.com/2021/02/16/apport-lpe/
Alephsecurity
Exploiting crash handlers: LPE on Ubuntu
Information Security
https://www.secjuice.com/enterprise-powershell-protection-logging/
Information Security
https://pentestmag.com/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/
Pentestmag
Local Privilege Escalation in Rapid7’s Windows Insight IDR Agent - Pentestmag
Local Privilege Escalation in Rapid7’s Windows Insight IDR Agent by Florian Bogner With Insight IDR Rapid7 has created a very powerful, yet …
Information Security
https://github.com/PalindromeLabs/Java-Deserialization-CVEs
GitHub
GitHub - PalindromeLabs/Java-Deserialization-CVEs: Compiled dataset of Java deserialization CVEs
Compiled dataset of Java deserialization CVEs. Contribute to PalindromeLabs/Java-Deserialization-CVEs development by creating an account on GitHub.
Information Security
https://twitter.com/elfsixtyfour/status/1365149410787799050?s=20
Twitter
✨
elfsixtyfour
💫
POC: CVE-2021-69420 https://t.co/kcfNl2ys1L https://t.co/n7PCGE3nsd
Information Security
https://medium.com/@metnew/you-better-not-make-an-electron-app-to-wrap-a-website-dd3fe876481b
#Electron
Medium
You better not make an Electron app to “wrap” a website
TL;DR: Why investing in Electron apps might be a waste of time.
Information Security
https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred
Information Security
https://microsoftedge.github.io/edgevr/posts/yet-another-uaf/
Microsoft Browser Vulnerability Research
Yet another RenderFrameHostImpl UAF
Introduction Back in 2020 while reviewing Chromium code, I found issue 1068395, a Use-After-Free in Browser Process that can be used to escape the Chromium sandbox on Android Devices. This is an interesting vulnerability as it’s a bug pattern that keeps happening…
Information Security
https://btlr.dev/blog/how-to-find-vulnerabilities-in-code-bad-words
Information Security
https://github.com/neex/http2smugl
GitHub
GitHub - neex/http2smugl
Contribute to neex/http2smugl development by creating an account on GitHub.
Information Security
https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred
Information Security
https://github.com/zigoo0/JSONBee
GitHub
GitHub - zigoo0/JSONBee: A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.
A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites. - zigoo0/JSONBee
Information Security
https://medium.com/@taha.karim/how-to-extract-python-source-code-from-py2app-packed-mach-o-binaries-4da244e54c88
Medium
How to extract Python source code from Py2App packed Mach-O Binaries
I got many requests after my last tweet on the discovery of a backdoored Electrum wallet, that was notarized by Apple !
Information Security
https://meliot.me/2021/03/06/securing-amazon-s3-presigned-urls/
Information Security
https://redhuntlabs.com/blog/dependency-confusion-attack-what-why-and-how.html
RedHunt Labs
Dependency Confusion Attack - What, Why, And How? - RedHunt Labs
In the dependency confusion attacks, a user can be tricked into installing a malicious dependency/library instead of the one they intended to install.
Information Security
https://github.com/secfigo/Awesome-Fuzzing
GitHub
GitHub - secfigo/Awesome-Fuzzing: A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials…
A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Develo...
Information Security
https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred
Information Security
https://github.com/masatokinugawa/filterbypass/wiki/Browser's-XSS-Filter-Bypass-Cheat-Sheet
GitHub
Browser's XSS Filter Bypass Cheat Sheet
Browser's XSS Filter Bypass Cheat Sheet. Contribute to masatokinugawa/filterbypass development by creating an account on GitHub.
