ROSECURIFY
Subscribe
~/ seclog/ #14

Seclog - #14

31 curated links

g3n3r4l23

  1. Account Takeover in Canvas Apps served in Comet due to failure in Cross-Window-Message Origin validation – Youssef Sammouda (ysamm.com)
  2. Account takeover of Facebook/Oculus accounts due to First-Party access\token stealing – Youssef Sammouda (ysamm.com)
  3. DOM-XSS in Instant Games due to improper verification of supplied URLs – Youssef Sammouda (ysamm.com)
  4. How I Hacked my Car Part 3: Making Software :: Programming With Style (programmingwithstyle.com)
  5. Secure Software Development Lifecycle Basics (snikt.net)
  6. HTTP Header Security (snikt.net)
  7. Security Advisory: Remote Command Execution in binwalk - ONEKEY (onekey.com)
  8. Unserializable, but unreachable: Remote code execution on vBulletin (ambionics.io)
  9. Prototype Pollution vulnerability found in mastodon (huntr.dev)
  10. Learning eBPF exploitation (stdnoerr.github.io)
  11. Jira Service Management Server and Data Center Advisory (CVE-2023-22501) | Atlassian Support | Atlassian Documentation (confluence.atlassian.com)
  12. Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI – Assetnote (blog.assetnote.io)
  13. Google Online Security Blog: Taking the next step: OSS-Fuzz in 2023 (security.googleblog.com)
  14. A Hacker’s Mind News - Schneier on Security (schneier.com)
  15. how to completely own an airline in 3 easy steps (maia.crimew.gay)
  16. Phishing with GitHub (form3.tech)
  17. What happened to CVE-2022-23529? And what can we learn from it? (secureideas.com)
  18. Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails – Assetnote (blog.assetnote.io)
  19. The Good, Bad and Compromisable Aspects of Linux eBPF - Pentera (pentera.io)
  20. (Web-)Insecurity Blog | SSO Gadgets: Escalate (Self-)XSS to ATO (security.lauritz-holtmann.de)
  21. VMware Workstation update addresses an arbitrary file deletion vulnerability (CVE-2023-20854) (vmware.com)
  22. Curio: Documentation (curio.sh)
  23. Ronin 2.0.0 finally released! (ronin-rb.dev)

y0utube1

  1. DEF CON 29 - Guillaume Fournier, Sylvain Afchain, Sylvain Baubeau - eBPF, I thought we were friends! (youtube.com)

g1thub7

  1. A-poc/RedTeam-Tools: Tools and Techniques for Red Team / Penetration Testing (github.com)
  2. GhostManager/Ghostwriter: The SpecterOps project management and reporting engine (github.com)
  3. ThePorgs/Exegol: Fully featured and community-driven hacking environment (github.com)
  4. bmarsh9/gapps: Security compliance platform - SOC2, CMMC, ASVS, ISO27001, HIPAA, NIST CSF, NIST 800-53, SSF tracking (and soon other frameworks) (github.com)
  5. adityatelange/bhhb: Tool to view HTTP history exported from Burp Suite Community Edition (github.com)
  6. duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC: CVE-2022-44268 ImageMagick Arbitrary File Read - Payload Generator (github.com)
  7. Esonhugh/sshd\backdoor: /root/.ssh/authorized\keys evil file watchdog with ebpf tracepoint hook. (github.com)
← All Seclogs