World Of Security

■■■■□ HTTPX: Use the -screenshot (-ss) option to capture screenshots of specific URLs, pages, or endpoints, including the rendered DOM!

https://github.com/projectdiscovery/httpx

GitHub

GitHub - projectdiscovery/httpx: httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp…

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library. - projectdiscovery/httpx

👍3🔥1

1.42K views21:27

World Of Security

https://hackerone.com/reports/1864188

HackerOne

EXNESS disclosed on HackerOne: SSRF in graphQL query (pwapi.ex2b.com)

SSRF in one of the graphQL parameters.

👍3

1.32K views05:23

World Of Security

Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR.

https://www.mobilehackinglab.com/blog/damn-exploitable-android-app-abusing-info-leaks-to-bypass-aslr

Mobilehackinglab

Damn Exploitable Android App - Abusing Info Leaks to bypass ASLR

Dive into our latest blog to learn a clever technique for exploiting format string vulnerabilities to bypass ASLR, revealing key memory addresses and targeting the Damn Exploitable Android App.

🔥3👍2

1.62K views06:21

World Of Security

https://soroush.me/blog/2023/08/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-36899/

1.58K views06:46

World Of Security

https://ophionsecurity.com/blog/shopify-acount-takeover

👍3❤1

1.49K views06:48

World Of Security

https://5stars217.github.io/2023-08-08-red-teaming-with-ml-models/

Threlfall hax

Model Confusion - Weaponizing ML models for red teams and bounty hunters

How I hacked a bunch of companies via machine learning attacks.

👍1

1.47K views05:12

World Of Security

ATO | How I exploited security issue to take over admin account.

https://ar1fshaikh.medium.com/1st-ato-how-i-exploited-security-issue-to-take-over-admin-account-e0ae309dc356

Medium

ATO | How I exploited security issue to take over admin account

Few days ago I came across one bug bounty program of an booking website lets call https://redacted.com, it was interesting website with…

1.54K views06:46

World Of Security

Making the Cloudflare WARP VPN leak DNS requests.

https://www.mathyvanhoef.com/2023/08/making-cloudflare-warp-vpn-leak-dns.html

Mathyvanhoef

Making the Cloudflare WARP VPN leak DNS requests

Cloudflare offers a free VPN client called Cloudflare WARP . I found that its Windows client can be tricked into leaking all DNS requests . ...

👍2

1.47K views05:31

World Of Security

https://hackerone.com/reports/2032842

HackerOne

Internet Bug Bounty disclosed on HackerOne: HTTP Request Smuggling...

The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is...

👍1

1.41K views04:30

World Of Security

2023 OWASP Top-10 Series: API6:2023 Unrestricted Access to Sensitive Business Flows.

https://lab.wallarm.com/api62023-unrestricted-access-to-sensitive-business-flows/

Wallarm

API6:2023 Unrestricted Access to Sensitive Business Flows - OWASP

APIs that expose sensitive business flows without proper authorization can be exploited by attackers to cause significant damage.

👍1

1.58K views06:00

World Of Security

JWT Authentication Bypass via Algorithm Confusion

https://www.youtube.com/watch?v=d-X9CmpnJdE

YouTube

JWT Authentication Bypass via Algorithm Confusion

👩‍🎓👨‍🎓 Learn about JSON Web Token (JWT) vulnerabilities. This lab uses a JWT-based mechanism for handling sessions. It uses a robust RSA key pair to sign and verify tokens. However, due to implementation flaws, this mechanism is vulnerable to algorithm confusion…

1.41K views05:07

World Of Security

Forwarded from Meisam Monsef

👍8👎3❤2

1.36K views08:13

World Of Security

https://medium.com/@garkolym/uncovering-a-critical-vulnerability-in-samsung-mobile-security-a-bug-bounty-journey-95d614ba1841

Medium

Uncovering a Critical Vulnerability in Samsung Mobile Security: A Bug Bounty Journey

Introduction

👍3❤1

1.47K views04:10

World Of Security

JWT Attacks

https://juba-notes.notion.site/JWT-attacks-4f62b2b641a84032bc624f8e8432345d

juba-notes on Notion

JWT attacks | Notion

By Mahmoud Hawash → reach me on LinkedIn

👍2❤1

1.33K views07:53

World Of Security

How it is possible to get persistent reverse shell from Android app without visible permissions to make device unusable via annoying DoS
https://www.mobile-hacker.com/2023/09/27/get-persistent-reverse-shell-from-android-app-without-visible-permissions-to-make-device-unusable/

Mobile Hacker

Get persistent reverse shell from Android app without visible permissions to make device unusable Mobile Hacker

This blog will introduce you how it is possible to write a persistent reverse shell app on Android without any user requested and visible permissions. Since such application has no permissions, it shouldn’t be able to perform any task. Well, that isn’t true.…

👍2❤1

1.31K views05:08

World Of Security

https://sklnhunt.github.io/posts/xpathinjectionerrorbased/

Krunal Savaliya

XPATH Injection - Exploiting Error-based SQL Injection

Hey hackers!! Today, I’m explaining the exploitation of the error-based SQL injection via XPATH injection. This vulnerability was discovered during a private pen-test engagement.

👍3

1.12K views16:39

World Of Security

Use silent SMS messages to track LTE users’ locations
https://mandomat.github.io/2023-09-21-localization-with-silent-SMS/

Home

Using silent SMS to localize LTE users

Proof of concept implementation

👍2

1.13K views04:59

About

Blog

Apps

Platform