Did you know that the CPU vuln "Zenbleed" 🩸 (CVE-2023-20593) was found through fuzzing?
I was able to talk to @taviso and learned about his novel approach 🤯 it is so clever!!
🎯 "After some research; [...] we had to conclude that this was unknown to the public and that it could potentially be an unintentional bug in MSSQL."
Read our latest blog ⬇
https://t.co/UppnOYryxE
#cybersecurity#AWS#Amazon#EthicalHacking
Achieved first blood jackpotting the ATM at @NorthSec_io#nsec2023 CTF this weekend! The most insane and thrilling hack I've pulled off at a CTF so far, it certainly caught the eyes of everyone in the room and the event organizers, describing it "straight out of a movie"!
It's now to late to register (the training session started today) but here's a funny video @h3xstream made about my training...
https://t.co/CHARfxjvnx
Fun fact: during my first @NorthSec_io training session years ago, both @h3xstream and @el_d33 were in the room! 😓
Chrome has removed the path property from events in version 109. We've updated our article about bypassing CSP with AngularJS to reflect this. The workaround is to use the composedPath() function.
https://t.co/vPcoz9c4Go
Nominations are now open for the Top 10 web hacking techniques of 2022! You can view the current nomination list and submit your favourite new techniques here:
https://t.co/w8BO7NgAE2
I just published Exploring the World of ESI Injection
Feedbacks are appreciated , let me know if you liked it or not :)
Special thanks to @nytr0gen_
https://t.co/DE2uH3Lp4c
Over a month ago Apache Struts submitted fixes for
CVE-2021-31805. Not sure everyone noticed, but there were multiple RCEs fixed in this. Here was another: https://t.co/LfCbUnMZi8
If you see two guys wearing Synacktiv t-shirts with big antennas, you should turn around with your @Tesla! 0-click RCE demonstration on a real vehicle, with CAN messages sent to switch on headlights, wipers and trunk 😎 #Pwn2Own
"Abusing HTTP hop-by-hop request headers" by @nj_dav was nominated as a top web hacking technique back in 2019, and has just blossomed into an F5 BIG-IP unauth RCE!
https://t.co/8WYT6JNOhh
https://t.co/tdQzM1OG5L
https://t.co/ZPVrMVxDkr
Finding #Java gadgets chains has never been so easy with the help of #CodeQL. Checkout our latest article, in which @hugow_vincent demonstrates a new technique to leverage the power of CodeQL to find new gadgets:
https://t.co/RJTzjJTufH
QLinspector:
https://t.co/PeqYoaaQUl
I wrote an article about small privacy leaks prevalent in web applications. These are not the most critical vulnerability patterns, but it was still a lot of fun to document.
Are you aware of these common pitfalls that can compromise #applicationsecurity and leak private user information? Our latest blog illustrates 6 hard to find but important #privacy risks for developers to consider. https://t.co/7yw38uSReG #appsec