Information Security
@sec_nerd_en
408
subscribers
157
photos
5
videos
9
files
2.28K
links
Information Security News
we are
@sec_nerd
twin brother
Download Telegram
Join
Information Security
408 subscribers
Information Security
https://zenn.dev/ooooooo_q/books/rails_deserialize
Zenn
Deserialization on Rails
Ruby on Railsで使われているDeserializeとその危険性について調べたものをまとめました。
Information Security
https://blog.s1r1us.ninja/research/PP
blog.s1r1us.ninja
s1r1us - Prototype Pollution
Introduction
Information Security
https://medium.com/@_ip_/300-000-rce-wordpress-29700ad6a993
Information Security
https://zero-s4n.hashnode.dev/fuzzing-websocket-messages-on-burpsuite
Sandeep Wawdane
Fuzzing WebSocket messages on Burpsuite
Hi everyone, in this article, I'll explain how to fuzz WebSocket messages using Burpsuite. I'll try to explain all things in detail yet more clearly.
This article will cover:
🚪
Introduction to WebSocket
⚙️
DVWS lab setup
📜
Ws-Harness script
⚙️
...
Information Security
https://dsec.ru/wp-content/uploads/2020/12/final_pres_media_files_hack.pdf
Information Security
https://swarm.ptsecurity.com/winrars-vulnerable-trialware-when-free-software-isnt-free/
PT SWARM
WinRAR’s vulnerable trialware: when free software isn’t free
In this article we discuss a vulnerability in the trial version of WinRAR which has significant consequences for the management of third-party software. This vulnerability allows an attacker to intercept and modify requests sent to the user of the application.…
Information Security
https://attackerkb.com/topics/VrYz48szMN/cve-2021-38648
AttackerKB
CVE-2021-38648 | AttackerKB
Open Management Infrastructure Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-38645, CVE-2021-38649
Information Security
https://posts.specterops.io/mimidrv-in-depth-4d273d19e148?gi=7a6660661a50
Medium
Mimidrv In Depth: Exploring Mimikatz’s Kernel Driver
Mimikatz provides the opportunity to leverage kernel mode functions through the included driver, Mimidrv. Mimidrv is a signed Windows…
Information Security
https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
EmberSec
CVE-2019-1378: Exploiting an Access Control Privilege Escalation Vulnerability in Windows 10 Update Assistant (WUA)
Introduction Windows 10 is an incredibly feature rich Operating System (OS). In the last four years, the innovative folks at Microsoft have continued to introduce and expand functionality as well...
Information Security
https://secreltyhiddenwriteups.blogspot.com/2021/11/becoming-super-admin-in-someone-elses.html
Blogspot
Becoming A Super Admin In Someone Elses Gsuite Organization And Taking It Over
Hello All! Long time since I have posted here :) As most of you know I am planning on writing up a lot of my research I have done through M...
Information Security
https://github.com/zeronetworks/rpcfirewall
GitHub
GitHub - zeronetworks/rpcfirewall
Contribute to zeronetworks/rpcfirewall development by creating an account on GitHub.
Information Security
https://www.intruder.io/research/practical-http-header-smuggling
www.intruder.io
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond
Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning...
Information Security
https://ajxchapman.github.io/security/2021/11/10/practical-security-recommendations-for-startups.html
Alex Chapman’s Blog
Practical Security Recommendations for Start-ups with Limited Budgets
Hi, my name is Alex, I’ve been an IT security professional since 2007 and I’ve recently entered the start-up world with my project bughuntr.io. In putting together this project, security has been a primary concern for me. This is both due to my background…
Information Security
https://zerodayengineering.com/projects/slides/ZDE2021_AdvancedSimplePwn2Own2021.pdf
Information Security
https://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels/
Information Security
https://securityonline.info/skrull-run-malware-on-the-victim-using-the-process-ghosting-technique/
Cybersecurity News
Skrull: run malware on the victim using the Process Ghosting technique
Skrull is a malware DRM. It generates launchers that can run malware on the victim using the Process Ghosting technique
Information Security
https://haxx.in/posts/pwning-tipc/
https://github.com/ohnonoyesyes/CVE-2021-43267
haxx.in
Exploiting CVE-2021-43267
Exploiting a heap overflow in the TIPC subsystem of the Linux kernel. In this post we’ll exploit a N-day vulnerability (CVE-2021-43267) originally discovered by Max van Amerongen.
Information Security
https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/
Bill Demirkapi's Blog
Abusing Windows’ Implementation of Fork() for Stealthy Memory Operations
Note: Another researcher recently tweeted about the technique discussed in this blog post, this is addressed in the last section of the blog (warning, spoilers!). To access information about a running process, developers generally have to open a handle to…
Information Security
http://archive.volgactf.ru/volgactf_2021/slides/VolgaCTF_2021_Stupin_Bobrov.pdf
Information Security
https://www.lunasec.io/docs/blog/log4j-zero-day/
