ROSECURIFY
Subscribe
~/ seclog/ #133

Seclog - #133

36 curated links

g3n3r4l19

  1. DNS and IP Intelligence Feed (dnsarchive.net)

    DNSarchive provides easy access to domain data and IP records. It's a repository simplifying searches for DNS intelligence. DNSarchive

  2. OAuth Security Pitfalls and Risks (beaglesecurity.substack.com)

    Skipping state validation enables CSRF attacks, while misconfigured scopes, public secret storage, and permissive redirect URIs create account takeover risks. Emphasizes OAuth is authorization, not authentication.

  3. Malicious MCP Server Prevalence on GitHub (blog.virustotal.com)

    VirusTotal analysis flagged nearly 8% of Model Context Protocol servers as potentially forged or critically vulnerable, highlighting risks from flawed implementations.

  4. Framebusting Intervention Security Enhancement (groups.google.com)

    Mozilla proposal limits cross-origin iframes from navigating top-level contexts unless legitimacy conditions are met, improving web security and compatibility.

  5. Beginner CVE Discovery and Publishing Guide (linkedin.com)

    Outlines methodical steps for novice bug hunters to find and publish CVEs using curiosity and persistence, bypassing elite skill requirements.

  6. Azure Illicit Consent Grant Attacks in 2025 (alteredsecurity.com)

    With Microsoft's MFA enforcement, credential-based attacks lose impact, shifting focus to consent grant exploits for initial access.

  7. llama.cpp Heap Overflow Vulnerability (pwno.io)

    CVE-2025-52566 exposes a subtle integer overflow in tokenizer, leading to heap corruption, undiscovered for over a year.

  8. Akamai CloudTest XXE Injection Flaw (xbow.com)

    XBOW discloses CVE-2025-49493, an XML External Entity injection vulnerability, alongside autonomous vulnerability research strategies.

  9. Reverse Engineering Vercel's BotID System (nullpt.rs)

    Analysis of Vercel's invisible CAPTCHA reveals reliance on client-side signals and Kasada's anti-bot tech for Deep Analysis tier.

  10. Google's Secure AI Agent Framework (research.google)

    Hybrid strategy combines deterministic controls with reasoning-based defenses, enforcing human oversight, action limitations, and observability for AI agents.

  11. Critical RCE in Anthropic MCP Inspector (oligo.security)

    CVE-2025-49596 (CVSS 9.4) enables browser-based exploits via DNS rebinding, allowing remote code execution.

  12. Sudo chroot LPE Vulnerability Impact (stratascale.com)

    CVE-2025-32463 allows attackers to bypass sudoers restrictions via chroot option abuse, escalating to root privileges.

  13. Directory Traversal and CSV Abuse RCE (jineeshak.github.io)

    Chaining exploits in a Django app enabled overwriting wsgi.py for server-side code execution via pandas parser abuse.

  14. Wing FTP Server Null-Based RCE (rcesecurity.com)

    CVE-2025-47812 details a remote code execution vulnerability exploiting NULL byte handling in Wing FTP.

  15. Reproducing WhatsApp Double-Free Vulnerability (ibm.com)

    Walkthrough of CVE-2019-11932 using AFL++ and Frida for on-device fuzzing of native Android libraries.

  16. Persistent XSS in Adobe Experience Manager (slcyber.io)

    Researchers achieved DOM-based XSS on AEM Cloud sites by bypassing built-in security features multiple times.

  17. Slack MCP Server Data Leakage Vulnerability (embracethered.com)

    Unmaintained Anthropic Slack MCP Server allows data exfiltration via link unfurling flaws.

  18. Spyware Account Takeover via SQLi (ericdaigle.ca)

    Compromised 60,000 Catwatchful spyware accounts by exploiting SQL injection in the service's authentication flow.

  19. Exposed JDWP Exploitation in TeamCity (wiz.io)

    Attackers achieved RCE via Java Debug Wire Protocol abuse on CI/CD servers, deploying cryptominers and persistence mechanisms.

X1

  1. Unpatched RCE in Call of Duty WWII (@vxunderground)

    Exploit enables attackers to trigger Notepad popups, shutdowns, and inappropriate content via Xbox PC Game Pass.

y0utube3

  1. Indirect Prompt Injection Attacks Explained (youtube.com)

    Demonstrates practical exploitation of LLM-backend integrations to execute arbitrary actions in victim contexts. Watch Here

  2. Localhost (youtube.com)

    API Exploits from Browsers – Browser-based attacks expose local services via port access flaws, enabling remote network infiltration. Watch Here

  3. JavaScript Desktop App Hacking Techniques (youtube.com)

    Focuses on XSS and RCE in Electron apps, with cross-platform CSP bypasses and security methods. Watch Here

g1thub13

  1. MCP Protocol Security Design Flaws (github.com)

    Alibaba Cloud discloses OAuth mechanism weaknesses increasing phishing risks, urging community consensus on mitigation.

  2. AWS IAM Data Collection Tool (github.com)

    Collects IAM information across AWS organizations, accounts, and resources for security analysis. Explore on GitHub

  3. JAR/WAR/APK Path and Secret Scanner (github.com)

    Discovers URLs, paths, secrets, and generates OpenAPI specs from Java/Android application configs. Explore on GitHub

  4. Kubernetes CEL-Based Cluster Scanner (github.com)

    Uses CEL expressions to detect misconfigurations and vulnerabilities in k8s environments. Explore on GitHub

  5. Self-Hosted Zero Trust Access Platform (github.com)

    FOSS alternative to Teleport/Cloudflare, providing VPN, ZTNA, API gateway, and ngrok-like capabilities. Explore on GitHub

  6. GitHub Secret Scanner for Dangling Commits (github.com)

    Scans GH Archive data to find secrets in overwritten commits from force-push events. Explore on GitHub

  7. Azure Blob Storage SOCKS5 Proxy Tool (github.com)

    Tunnels traffic through Azure Blob Storage when direct connectivity is restricted. Explore on GitHub

  8. Kubernetes Privilege Escalation Toolkit (github.com)

    Automates token theft, secret collection, and cluster takeover techniques for pentesting. Explore on GitHub

  9. Frontend API Key Validation Utility (github.com)

    Tests discovered credentials in-browser via JavaScript without server logging. Explore on GitHub

  10. Electron Security Analysis and Injection Tool (github.com)

    Modern interface for manipulating Electron apps with debugging and exploit features. Explore on GitHub

  11. Malicious Archive Crafting Utility (github.com)

    Generates specially designed archives to test extraction vulnerabilities. Explore on GitHub

  12. LLM-Based Vulnerability Detection Model (github.com)

    FuncVul uses code chunks and LLMs for function-level vulnerability identification. Explore on GitHub

  13. fwd:cloudsec 2025 Talk Summaries (github.com)

    Curated insights and key points from cloud security presentations for time-constrained professionals. Explore on GitHub

← All Seclogs