ROSECURIFY
Subscribe
~/ seclog/ #63

Seclog - #63

29 curated links

g3n3r4l22

  1. LOTP - Living Off the Pipeline (boostsecurityio.github.io)

    strategies for software development without a traditional CI/CD pipeline.

  2. pico.sh (pico.sh)

    minimalistic, server-side scripting environment for streamlined web development.

  3. AI's Best Friend eBook by Robert Hansen (amazon.com)

    Dive into the evolving relationship between AI and humans in this insightful eBook.

  4. De-google-ify Internet (degooglisons-internet.org)

    Learn about initiatives to reduce reliance on Google's ecosystem for a more diversified internet.

  5. Learn and Test DMARC (dmarctester.com)

    Enhance email security and prevent phishing with DMARC testing tools.

  6. We Hacked Google A.I. for $50,000 - Lupin & Holmes (landh.tech)

    An account of how Lupin & Holmes successfully hacked Google's AI, claiming a $50,000 reward.

  7. Kali Linux 2024.1 Release (Micro Mirror) (kali.org)

    Announcement and details about the latest release of Kali Linux, version 2024.1.

  8. Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (cisa.gov)

    Official playbooks from CISA for responding to cybersecurity incidents and vulnerabilities.

  9. Exploiting CSP Wildcards for Google Domains (attackshipsonfi.re)

    A technical exploration of exploiting CSP (Content Security Policy) wildcards in Google domains.

  10. Security: Arbitrary JavaScript Code Execution in "devtools://devtools" - Chromium (issues.chromium.org)

    A security report detailing how attackers can execute arbitrary JavaScript code in a privileged Chromium origin.

  11. Unauthenticated Email Enumeration via API Fuzzing - Jineesh AK (jineeshak.github.io)

    An exploration of how API fuzzing can be used to enumerate email addresses without authentication.

  12. Using Open Source Tools to Monitor a Sanctioned Russian Bank - bellingcat (bellingcat.com)

    A case study on monitoring a Russian bank using open-source internet routing tools.

  13. Preventing AWS Subdomain Takeover - Sena Yakut (senayakut.com)

    Strategies and case studies for enhancing security and preventing AWS subdomain takeover.

  14. Session Timeout Vulnerabilities & Extension - Burp Suite (whiteoaksecurity.com)

    Discussion of vulnerabilities related to session timeouts and how to extend sessions using Burp Suite.

  15. V8 Sandbox - External Pointer Sandboxing - Google Docs (docs.google.com)

    A document detailing the sandboxing of external pointers in the V8 JavaScript engine.

  16. The State of ABAC on AWS (2024) - High Signal Security (ramimac.me)

    An analysis of Attribute-Based Access Control (ABAC) on AWS as of 2024.

  17. Joomla: Multiple XSS Vulnerabilities - Sonar (sonarsource.com)

    A report on multiple XSS vulnerabilities introduced by a PHP bug in Joomla.

  18. Server-Side Prototype Pollution Gadgets Scanner - Doyensec's Blog (blog.doyensec.com)

    Introduction of a scanner for detecting server-side prototype pollution gadgets.

  19. Monitor Certificate Expiry via RSS - Raphting (raphting.dev)

    A guide on monitoring SSL/TLS certificate expiry using RSS feeds.

  20. Type Confusion in V8 WebAssembly Leading to RCE - Chromium (issues.chromium.org)

    A security issue in V8 WebAssembly that could lead to remote code execution.

  21. Advanced Fuzzing Techniques Applied to cURL - Trail of Bits Blog (blog.trailofbits.com)

    An overview of how advanced fuzzing techniques were applied to the cURL tool.

  22. MeshCentral Cross-Site Websocket Hijacking Vulnerability (praetorian.com)

    Examine the cross-site WebSocket hijacking vulnerability in MeshCentral.

X1

  1. π•―π–’π–Žπ–™π–—π–ž π•Ύπ–’π–Žπ–‘π–žπ–†π–“π–Šπ–™π–˜ on (@ddd1ms)

    X: Discussing "LockBit releases a long read of what happened."

y0utube2

  1. The 5 Week Program: IDOR Q&A + Labs (youtube.com)

    A comprehensive guide and Q&A on IDOR vulnerabilities, accompanied by practical labs. Watch Here

  2. The Integration Cyber Security and Insurance: The Journey of Cysurance (youtube.com)

    Exploring the integration of cybersecurity and insurance through the journey of Cysurance. Watch Here

g1thub4

  1. beigeworm/BadUSB-Files-For-FlipperZero (github.com)

    A collection of over 60 scripts tailored for the BadUSB function on FlipperZero. Explore on GitHub

  2. moom825/xeno-rat (github.com)

    Xeno-RAT, a comprehensive open-source remote access tool developed in C, featuring HVNC, live microphone, reverse proxy, and more. Explore on GitHub

  3. sea-erkin/log-snare (github.com)

    LogSnare, a versatile tool for testing, preventing, and logging IDOR vulnerabilities. Explore on GitHub

  4. latiotech/LAST (github.com)

    Utilize AI to scan your code for security issues and code smells from the command line. Explore on GitHub

← All Seclogs