ROSECURIFY
Subscribe
~/ seclog/ #128

Seclog - #128

17 curated links

g3n3r4l10

  1. Dom-Explorer (yeswehack.github.io)

    A handy interactive tool to inspect DOM-based XSS vectors with practical exploration examples.

  2. Puny-Code Vulnerabilities & Account Takeover (blog.voorivex.team)

    A fascinating case of 0-click account takeover using puny-code encoding abuse.

  3. Offensive Threat Intelligence (blog.zsec.uk)

    Discussing how to leverage offensive capabilities for enhanced CTI operations.

  4. Remote Prompt Injection in GitLab Duo (legitsecurity.com)

    An attack method leading to source code exfiltration via LLM prompt injection.

  5. BadSuccessor (dMSA Abuse in AD) (akamai.com)

    Escalating privileges in Active Directory via delegation misconfigurations.

  6. Commit Stomping (blog.zsec.uk)

    A clever way to manipulate Git history for stealthy backdoors.

  7. Persistent WeChat Client-Side Attack (darknavy.org)

    Exploiting a single WeChat message for long-term client-side compromise.

  8. GitHub MCP Exploited (invariantlabs.ai)

    Critical vulnerability allowing access to private GitHub repos via MCP.

  9. XSSing TypeErrors in Safari (thespanner.co.uk)

    A deep dive into an unusual XSS vector using TypeErrors in Safari.

  10. Preventing AI Hallucinations (thecloudcast.net)

    The Cloudcast podcast explores strategies to reduce LLM hallucinations. Listen Here

X3

  1. Gareth Heyes on Safari XSS Vector (@garethheyes)

    Can you spot the Safari-only XSS vector before checking the solution? Watch Here

  2. Today In Infosec – "Realm of the Hackers" Documentary (2003) (@todayininfosec)

    The story of Australian teen hackers Electron & Phoenix. Watch Here

  3. Today In Infosec – "Hackers: Heroes" Book Anniversary (2010) (@todayininfosec)

    Throwback to the iconic 1984 hacker culture publication.

y0utube1

  1. Abusing Historical DNS Records (youtube.com)

    Mustafa walks through how DNS history can be weaponized in red teaming. Watch Here

g1thub3

  1. OperantAI/woodpecker (github.com)

    A red teaming toolkit focusing on AI and cloud environments. Explore on GitHub

  2. silverhack/monkey365 (github.com)

    All-in-one security auditing for Microsoft 365, Azure, and Entra ID. Explore on GitHub

  3. macalbert/envilder (github.com)

    A secure CLI for managing environment variables via AWS SSM. Explore on GitHub

← All Seclogs