cvebase retweeted
New blog post! An overview of the important changes Proof-of-Stake will bring to Ethereum post-merge, and what developers should be aware of to secure their smart contracts. Read it here:
blog.zellic.io/2022/07/07/et…
cvebase retweeted
So here's the first CVE of my #BugBounty collection: It's an unauth XSS affecting SAP Knowledge Warehouse aka CVE-2021-42063.
The bug itself isn't super thrilling, but the advisory tells you why I'll no longer disclose #security vulns to SAP.
seclists.org/fulldisclosure/…
(1/2)
cvebase retweeted
smap - Shodan meets Nmap😎🤙
Right now this setup:
- scans 5 hosts/second
- gives vulnerability + service data (cpe+protocol+name)
- can mimic nmap as shown in the video
cvebase retweeted
If you have ever wished you could run your Nmap, nuclei, OpenVAS and Tsunami from a single command and access all the results in a single place. You should check this new open-source tool.
blog.ostorlab.co/ostorlab-op…
#OpenSource #CyberSecurity
cvebase retweeted
Now, you can see the Hall of Fame of the Samsung Mobile Security Rewards Program.
security.samsungmobile.com/h…
cvebase retweeted
Releasing our latest project, CVEs! A constantly updated collection of 𝘢𝘭𝘮𝘰𝘴𝘵 every publicly available CVE PoC.
👉 Browse, find a PoC, and test away!
👉 Search for a specific product.
👉 Watch the repo to be notified when new PoCs go public!
github.com/trickest/cve
cvebase retweeted
If anyone wants practice with packet analysis, here’s a lab I give to my Security class each semester. Includes a real PCAP from @defcon #PcapsOrItDidntHappen github.com/tuftsdev/DefenseA…
cvebase retweeted
I just posted a write-up on how I leaked uninitialized memory (e.g., other users' HTTP requests/responses) from Fastly using a bug in the H2O webserver. Also, there you can learn a fraction of how HTTP/3 + QUIC works)
medium.com/@emil.lerner/leak…
cvebase retweeted
Infosec chap: I found a way to hijack your web accounts, turn on your webcam from Safari – and Apple gave me $100k go.theregister.com/feed/www.…
cvebase retweeted
You're a better hacker if you know how to build the thing you're trying to hack. Create labs, install stuff, configure it, breake it from the inside. Then apply that knowledge when attacking from the outside. You'll see clear flaws once you really know how it works.
Bought this course and it’s a steal at $50… This is a full-transparency walkthrough of how @HusseiN98D approaches his bug bounty targets and packed with practical tips. Get it while the sale is still live!
It's finally live - I'm sorry for the time this took!
The workshop I gave at @THREAT_CON is now live on Udemy for a discounted price. The price will go back to $149 at the end of the week . More details to follow.
udemy.com/course/bug-bounty-…
cvebase retweeted
Our team took apart Solarwinds Web Help Desk to discover some serious issues (hardcoded credentials, arbitrary HQL evaluation) - CVE-2021-35232 - we explain the discovery and exploitation process in our blog post:
blog.assetnote.io/2022/01/23…
cvebase retweeted
Registration for Insomni'hack 2022 online TEASER is now OPEN: teaser.insomnihack.ch/accoun…
Teaser will run for 24 hours, starting Jan. 29th @ 12:00 UTC. #INS22 #CTF
Just received this handy CTF cheatsheet/book by @bishopfox @AndyDoering "Pocket Guide for Friendly Remote Admins". Thanks!
cvebase retweeted
I made another video. This time a run down on cyber, cyberwar, and cyber war. Is cyberwar war? And what is “war” anyway? All these are addressed in the video. Enjoy!
youtube.com/watch?v=hLu1FnBf…
cvebase retweeted
Today I'm releasing my JavaScript/v8 Fuzzer JS Raider. I developed the fuzzer for my master thesis and later improved the code for the "Fuzzilli Research Grant Program". You can find the source code, results and my key learnings in my blog post at: apt29a.blogspot.com/2022/01/…
cvebase retweeted
A few months ago, we discovered a post-auth SSRF in VMWare Workspace One Access - CVE-2021-22056 - which allowed you to steal an admin JWT via CSRF or request arbitrary URLs. Check out our blog post! blog.assetnote.io/2022/01/17…
cvebase retweeted
New blog post: Why I broke your subdomain recon pipeline last night
(or why tls.bufferover.run is moving from free to free*)
blog.erbbysam.com/index.php/…
CVE-2021-27205: Telegram fails in handling self-destructing messages by @RandomDhiraj inputzero.io/2020/12/telegra…
1
2