Seclog - #25

g3n3r4l21

1. A $1,000,000 bounty? The KuCoin User Information Leak (corben.io)
2. Real World Crypto 2023 Recap | Trail of Bits Blog (blog.trailofbits.com)
3. Why is OAuth still hard in 2023? (nango.dev)
4. PassGAN: A Deep Learning Approach for Password Guessing (arxiv.org)
5. How to fix a ReDoS | The GitHub Blog (github.blog)
6. Cyberowl | CyberOwl (cyberowl.org)
7. SLSA • SLSA specification (slsa.dev)
8. CS:GO: From Zero to 0-day — Neodyme (neodyme.io)
9. Privilege Escalations through Integrations (blog.stratumsecurity.com)
10. Introducing resocks - An Encrypted Back-Connect SOCKS Proxy for Network Pivoting (blog.redteam-pentesting.de)
11. Bypass IIS Authorisation with this One Weird Trick - Three RCEs and Two Auth Bypasses in Sitecore 9.3 (blog.assetnote.io)
12. Dependabot Confusion: Gaining Access to Private GitHub Repositories using Dependabot (giraffesecurity.dev)
13. Azure DevOps CICD Pipelines - Command Injection with Parameters, Variables and a discussion on Runner hijacking (pulsesecurity.co.nz)
14. Automating C2 Infrastructure with Terraform, Nebula, Caddy and Cobalt Strike (blog.malicious.group)
15. 0VIX Exploit Post-Mortem & Steps to Recovery (0vixprotocol.medium.com)
16. Remediating AWS IMDSv1 (docs.google.com)
17. Cross Site Smallish Scripting (XSSS) (trustedsec.com)
18. Russian Hacker “Wazawaka” Indicted for Ransomware – Krebs on Security (krebsonsecurity.com)
19. Google Online Security Blog: New Android & Google Device Vulnerability Reward Program Initiatives (security.googleblog.com)
20. Testing Zero Touch Production Platforms and Safe Proxies (blog.doyensec.com)
21. Security-by-Design and -Default (cisa.gov)

y0utube2

1. Prompt Injection, explained (youtube.com)
2. DEF CON 23 - Dennis Maldonado - Are We Really Safe? - Bypassing Access Control Systems (youtube.com)

g1thub3

1. Fizzadar/pyinfra (github.com)
2. racepwn/racepwn (github.com)
3. GyulyVGC/sniffnet (github.com)