While browsing a SharePoint instance recently, I came across an interesting URL in the form https:///_layouts/FormServer.aspx?XsnLocation=https:///resource/Forms/template.xsn. The page itself displayed a web form that submitted…
A new malware botnet was discovered targeting Realtek SDK, Huawei routers, and Hadoop YARN servers to recruit devices into DDoS (distributed denial of service) swarm…
This year I released a challenge for the Full Stack Web Attack class: Whilst several people had solved the challenge, no one seemed to have…
When Assetnote Continuous Security (CS) monitors your attack surface, one of the things it looks for are instances of WebPageTest. WebPageTest is a website performance…
This writeup walks you through the full process as to how I found a pretty bad Insecure Direct Object Reference (IDOR) in New Relic. In…
After a long day of trying and failing to find vulnerabilities on the Verizon Media bug bounty program I decided to call it quits and…
Slides Supplemental Serverless Toolkit available here: https://github.com/ropnop/serverless_toolkit Source link
From time to time we see postMessage bug in H1 hacktivity, some write ups mentioning the word postMessage, but do you really know what is…
Unfortunately, my thought process wasn’t that complex when I suddenly had to talk to a federal agent on my phone about what I’d posted to…
Recently, Microsoft released a series of patches to address around 80 security vulnerabilities, including two zero-day exploits. One of the critical zero-day exploits, CVE-2023-23397, is…
INTERVIEW WITH @_BASE_64 : 19 Y/o | TOP 150 WORLDWIDE on H1 | METHODOLOGY, MINDSET & MORE… Source link
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Samsung, Vivo, Google phones open to remote compromise without user…
