ROSECURIFY
Subscribe
~/ seclog/ #80

Seclog - #80

22 curated links

g3n3r4l18

  1. The CloudSec Engineer (engineer.cloudsecbooks.com)

    Resources and articles for cloud security engineers. -

  2. Entities allowed between function calls - Shazzer (shazzer.co.uk)

    Analysis of security implications of entities allowed between function calls. -

  3. Putting the C2 in C2loudflare | JUMPSEC LABS (labs.jumpsec.com)

    An exploration of using Cloudflare for C2 infrastructure. -

  4. Why I attack (nicholas.carlini.com)

    Insights into the motivations behind security attacks. -

  5. The security prioritization paradox (beaglesecurity.substack.com)

    Discussing the challenges in prioritizing security tasks. -

  6. Hacking Amazon's eero 6 (part 2) | Markuta (markuta.com)

    Part two of the series on hacking Amazon's eero 6. -

  7. 17 vulnerabilities in Sharp Multi-Function Printers - IT Security Research by Pierre (pierrekim.github.io)

    Detailed analysis of vulnerabilities in Sharp printers. -

  8. Exploiting GCP Cloud Build for Privilege Escalation (blog.pwnedlabs.io)

    Techniques for escalating privileges in GCP Cloud Build. -

  9. Polyfill.io (threatmon.io)

    Supply Chain Attack: How Over 100,000 Websites Were Compromised and What You Need to Know - ThreatMon Blog - Examination of a significant supply chain attack. -

  10. Reddit & HackerOne Bug Bounty Announcement : r/redditsecurity (reddit.com)

    Announcement of Reddit's bug bounty program. -

  11. Holograph exploited for more than $1.2 million (web3isgoinggreat.com)

    Details on the Holograph exploit incident. -

  12. Breaking caches and bypassing Istio RBAC with HTTP response header injection | Snyk (snyk.io)

    Techniques for cache breaking and RBAC bypass. -

  13. Publicly Exposed AWS SSM Command Documents – High Signal Security – YAIB (Yet Another Infosec blog) (ramimac.me)

    Discussion on exposed AWS SSM command documents. -

  14. Project Zero: Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models (googleprojectzero.blogspot.com)

    Evaluating LLMs for offensive security. -

  15. Zip Slip meets Artifactory: A Bug Bounty Story | Karma(In)Security (karmainsecurity.com)

    Bug bounty story involving Zip Slip and Artifactory. -

  16. 1-click Exploit in South Korea's biggest mobile chat app | stulle123's Blog (stulle123.github.io)

    Account takeover exploit in KakaoTalk. -

  17. Kubernetes Cluster Security - Nuclei Templates v9.9.0 🎉 (blog.projectdiscovery.io)

    Latest templates for Kubernetes security. -

  18. Under the Hood: Exploring the Architecture and Security Risks of Large Language Models (docs.google.com)

    Presentation on the security risks of LLMs. -

g1thub4

  1. domain-protect/domain-protect: OWASP Domain Protect - prevent subdomain takeover (github.com)

    A tool to prevent subdomain takeover. - Explore on GitHub

  2. Trigii/MacHawkEye: Engine for analyzing binaries on macOS systems to identify potential vulnerabilities (github.com)

    Tool for analyzing macOS binaries for vulnerabilities. - Explore on GitHub

  3. FLOCK4H/AtomDucky: WiFi Rubber Ducky with a web interface using CircuitPython (github.com)

    WiFi Rubber Ducky with a web interface. - Explore on GitHub

  4. VolkanSah/GPT-Security-Best-Practices: The purpose of this document is to outline the security risks and vulnerabilities that may arise when implementing ChatGPT in web applications and to provide best practices for mitigating these risks. (github.com)

    Security best practices for implementing ChatGPT in web applications. - Explore on GitHub

← All Seclogs