Wawa Security Links 336

Dimanche 18 Octobre 2026


GoogleNCR / Twitter
Hacking tutos / Facebook


Spilling Local Files via XXE When HTTP OOB Fails
James Munns
O(n^2), again, now in WMI | Random ASCII – tech blog of Bruce Dawson
Freelist Heap Exploitation on Docker Alpine Linux Images
Understanding Windows Access Token Manipulation
HotFuzz
GitHub - similarweb/finala: A resource cloud scanner that analyzes and reports about wasteful and unused resources to cut unwanted expenses.
GitHub - ffuf/ffuf: Fast web fuzzer written in Go
Quadratic Payments: A Primer
GitHub - sailay1996/UAC_Bypass_In_The_Wild: Windows 10 UAC bypass for all executable files which are autoelevate true .
REVERSING WITH IDA FROM SCRATCH (P26) | 0day in {REA_TEAM}
OpenPunk
Breaking the chains on HTTP Request Smuggler | PortSwigger Research
Google Online Security Blog: Detecting unsafe path access patterns with PathAuditor
MacOS Filename Homoglyphs Revisited – MDSec
Digital lockpicking - stealing keys to the kingdom
How to Fine-Tune Static Code Analysis - Part 1
Project Zero: SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4
Azure Privilege Escalation via Cloud Shell
GitHub - GuardianFirewall/grandmaster: A simplistic python tool that assists in automating iOS firmware decryption.

Inside Kraken Security Labs: Flaw Found in Keepkey Crypto Hardware Wallet (Part 2) | Kraken Blog
CVE-2019-19248: Local Privilege Escalation in EA’s Origin Client | enigma0x3
https://blog.confiant.com/new-macos-bundlore-loader-analysis-ca16d19c058c
https://www.plundervolt.com/doc/plundervolt.pdf
A Deep Dive Into Samsung's TrustZone (Part 1)
Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium | Securelist
https://blog.talosintelligence.com/2019/12/vuln-spotlight-RDP-Dec-19.html
https://www.thezdi.com/blog/2019/12/10/the-december-2019-security-update-review
https://blog.talosintelligence.com/2019/12/vuln-spotlight-multiple-leadtools-dec-2019.html
Secure process audit
HTTP Protocol with Wireshark
https://blog.talosintelligence.com/2019/12/vuln-spotlight-Adobe-Acrobat-JS-leak.html
Solismed Version 3.3SP1
https://medium.com/tenable-techblog/blink-xt2-camera-system-command-injection-flaws-4768fced9ece
A Guide to Angular Security and Authentication with JSON Web Tokens | GrapeCity
https://limitedresults.com/wp-content/uploads/2019/12/eu-19-LimitedResults-Fatal-Fury-On-ESP32-Time-To-Release-HW-Exploits-1.pdf
https://signal.org/blog/signal-private-group-system/
JSON Compression: Alternative Binary Formats and Compression Methods - Lucidchart
The Nintendo Switch Switch
https://null-byte.wonderhowto.com/how-to/use-hash-identifier-determine-hash-types-for-password-cracking-0200447/

Breaking Down: SHA-1 Algorithm - Pentestmag
GitHub - m0rv4i/SafetyDump: Dump stuff without touching disk
SCshell: Fileless Lateral Movement Using Service Manager | Trustwave
https://isc.sans.edu/forums/diary/Lazy Sunday Maldoc Analysis/25586/
IRC Protocol with Wireshark
Collecting and Crafting User Information from LinkedIn - Black Hills Information Security
Waterbear is Back, Uses API Hooking to Evade Security Product Detection - TrendLabs Security Intelligence Blog
Persistence – Office Application Startup | Penetration Testing Lab
Our Audit of Unbound DNS by X41 D-Sec – Full Results – Open Source Technology Improvement Fund
003_git_submodule/advisory.md · master · GitLab.com / GitLab Security Department / disclosures · GitLab
SetWindowsHookEx Leaks A Kernel Pointer – CVE-2019-1469 « Insanely Low-Level
GitHub - evilmog/ntlmv1-multi: NTLMv1 Multitool
https://vavkamil.cz/wp-content/uploads/2019/12/an-introduction-to-the-router-exploit-kits.pdf
Updating adconnectdump - a journey into DPAPI - dirkjanm.io
Bootstrap XSS Collection · GitHub
Hack the Box (HTB) machines walkthrough series — Nibbles
(Almost) Hollow and Innocent: Monero Miner Remains Undetected via Process Hollowing - TrendLabs Security Intelligence Blog
https://blog.talosintelligence.com/2019/12/vuln-spotlight-linux-w1fi-dos-dec-19.html
https://isc.sans.edu/forums/diary/Code Data Reuse in the Malware Ecosystem/25598/
https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-kakadu-software.html

Cracking LUKS/dm-crypt passphrases – Diverto – Information Security Warriors
KeyWe Smart Lock unauthorized access and traffic interception
https://sajjadium.github.io/files/usenixsec2020wcd_paper.pdf
oss-security - Local Privilege Escalation in OpenBSD's dynamic loader (CVE-2019-19726)
https://zxsecurity.co.nz/wp-content/uploads/2019/12/ZX Security Advisory - Squiz Matrix CMS - Multiple Vulnerabilities.pdf
https://blog.talosintelligence.com/2019/12/apple-safari-SVG-DOS-dec-19.html
abarisani.github.io/research/secure_boot at master · abarisani/abarisani.github.io · GitHub
X41 finished Unbound DNS Server Audit | X41 D-SEC GmbH
https://medium.com/aseem.shrey/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85
GitHub - sepehrdaddev/hashcobra: HashCobra Hash Cracking tool.
A Deep Dive into iOS Code Signing
https://isc.sans.edu/forums/diary/German language malspam pushes yet another wave of Trickbot/25594/
From iPhone to NT AUTHORITY\SYSTEM – Decoder's Blog
https://blog.sucuri.net/2019/12/unmasking-black-hat-seo-for-dating-scams.html
What I Learned from Reverse Engineering Windows Containers
https://medium.com/tenable-techblog/winbox-in-the-wild-9a2ee4946add
Say hello to Bottle Exploit Kit targeting Japan | @nao_sec
Why computers suck and how learning from OpenBSD can make them marginally less horrible – Telegraph
GitHub - KishanBagaria/AirDoS: 💣 Remotely render any nearby iPhone or iPad unusable
New tools to monitor your server and avoid downtime


Translate / Map
Wikipedia [ENG] / GIT

Metasploit / ExploitDB
Converter / Project 0

Hotmail / Gmail / ODA
eprint.iacr / Youtube