ROSECURIFY
Subscribe
~/ seclog/ #13

Seclog - #13

29 curated links

g3n3r4l20

  1. Publisher’s Weekly Review of A Hacker’s Mind - Schneier on Security (schneier.com)
  2. Pwning the all Google phone with a non-Google bug (github.blog)
  3. Hacking Redis for fun and CTF points (medium.com)
  4. Learn to build it, then break it - EdOverflow (edoverflow.com)
  5. Towards a global framework for cross-border data flows and privacy protection (blog.cloudflare.com)
  6. (DRAFT) Fearless CORS: a design philosophy for CORS middleware libraries (and a Go implementation) (jub0bs.com)
  7. RedTeam Pentesting GmbH - Skyhigh Security Secure Web Gateway: Cross-Site Scripting in Single Sign-On Plugin (redteam-pentesting.de)
  8. Account Takeover in KAYAK (fluidattacks.com)
  9. Errata Security: I'm still bitter about Slammer (blog.erratasec.com)
  10. Using 0days to Protect the United Nations (frycos.github.io)
  11. MyBB <= 1.8.31: Remote Code Execution Chain (swarm.ptsecurity.com)
  12. Finding the right piece of code (bksecurity.org)
  13. 2022 Microsoft Teams RCE (blog.pksecurity.io)
  14. Bitwarden design flaw: Server side iterations (palant.info)
  15. A Look at AWS API Protocols (frichetten.com)
  16. Adding security headers to your SvelteKit application - EdOverflow (edoverflow.com)
  17. Simple Parenting Hacks: Tips and Scripts from a Hacker Dad · rez0 (rez0.blog)
  18. Pashword - Passwords Done Right (pashword.app)
  19. USB Dongle Authentication (dongleauth.com)
  20. Home - Unprotect Project (unprotect.it)

y0utube2

  1. Empathy, Bitwarden, Lexmark, Exchange, Dragonbridge, & Derek Johnson Talks About Hive - SWN 269 (youtube.com)
  2. From zero to 6-digit bug bounty earnings in 1 year - Johan Carlsson - BBRD podcast 3 (youtube.com)

g1thub7

  1. jeffssh/KACE-SMA-RCE: Fully functional exploit for a preauth RCE as root chain demonstrated and discussed at DEFCON 30 (github.com)
  2. praetorian-inc/gato: GitHub Self-Hosted Runner Enumeration and Attack Tool (github.com)
  3. Checkmarx/capital: A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF. (github.com)
  4. s0md3v/Parth: Heuristic Vulnerable Parameter Scanner (github.com)
  5. eddiechu/File-Smuggling: HTML smuggling is not an evil, it can be useful (github.com)
  6. projectdiscovery/pdtm: ProjectDiscovery's Open Source Tool Manager (github.com)
  7. jhy/jsoup: jsoup: the Java HTML parser, built for HTML editing, cleaning, scraping, and XSS safety. (github.com)
← All Seclogs