Wawa Security Links 338

Vendredi 19 Avril 2024


GoogleNCR / Twitter
Hacking tutos / Facebook


GitHub - Te-k/harpoon: CLI tool for open source and threat intelligence
Hack the Box (HTB) machines walkthrough series — Jarvis
Make HID great again | David Sopas - Web Security Researcher
GitHub - seemoo-lab/opendrop: An open Apple AirDrop implementation written in Python
GitHub - FULLSHADE/POPPOPRET-nullbyte-DLL-bypass: A method to bypass a null byte in a POP-POP-RETN address for exploiting local SEH overflows via DLL injection
https://securitylab.github.com/research/ubuntu-whoopsie-daisy-overview
AirDoS: Remotely render any nearby iPhone or iPad unusable
code16: From 0 to 0day - quick fuzzing lesson
https://www.zerodayinitiative.com/blog/2019/12/18/regular-exploitation-of-a-tesla-model-3-through-chromium-regexp
How we developed our simple Harbour decompiler | Securelist
Recent Vulnerabilities in Envoy Explained, Including Impact to Istio
On Linux's Random Number Generation – NCC Group Research
https://medium.com/k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a
An experience with Daimler’s vulnerability reporting program | Eaton Works
GitHub - 0xdidu/Reverse-Engineering-Intel-x64-101: Material for a RE 101 class on Intel x64 binaries
Writing BPF code in Rust - Outbox
Announcing Rust 1.40.0 | Rust Blog
https://isc.sans.edu/forums/diary/More DNS over HTTPS Become One With the Packet Be the Query See the Query/25628/
Using LLDB for reverse engineering
https://posts.specterops.io/war-never-changes-attacks-against-wpa3s-enhanced-open-part-2-understanding-owe-90fdc29126a1

Pwning an outdated Kibana with not so sad vulnerabilities
Arcturus Labs / WordPress DoS: Rediscovering an Unpatched 0-Day
https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chrome-ce17b19dd474
https://www.zerodayinitiative.com/blog/2019/12/19/privilege-escalation-via-the-core-shell-com-registrar-object
Untangling Legion Loader’s Hornet Nest of Malware - Deep Instinct
https://blog.talosintelligence.com/2019/12/ASA-Bug-Attacked-In-The-Wild.html
Why Running a Privileged Container in Docker Is a Bad Idea - TrendLabs Security Intelligence Blog
Well, That Escalated Quickly
Drupal 8 File Upload Vulnerability | Aon's Cyber Labs
Source Code Analysis SQL Injection - Ghostlulz Hacks
Introducing Token-Hunter | GitLab
Building a new Win 3.1 app in 2019 Part 1: Slack client | YKM's corner on the web
oss-sec: VNC vulnerabilities. TigerVNC security update
https://medium.com/sarang6489/root-detection-bypass-by-manual-code-manipulation-5478858f4ad1
GitHub - v-p-b/cve-2019-12750: sploit
Qt gif parsing. Null deref rediscovered.
Objective-See's Blog
https://www.hackingarticles.in/multiple-ways-to-capture-memory-for-analysis/
GitHub - Dewera/Lunar: A lightweight native DLL mapping library that supports mapping directly from memory
https://medium.com/bugbountywriteup/cve-2019-17556-unsafe-deserialization-in-apache-olingo-8ebb41b66817

Here Be Dragons: Reverse Engineering with Ghidra - Part 1 [Data, Functions & Scripts]
https://medium.com/cc1h2e1/bug-bounty-check-list-by-c1-2beb7ae3c116
Pwning VMWare, Part 1: RWCTF 2018 Station-Escape | nafod
https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32
FIC2020 prequals CTF write-up
Unveiling JsOutProx: A New Enterprise Grade Implant – Yoroi Blog
Exploiting Null Byte Buffer Overflow for a $40,000 bounty | Sam Curry
Investigating Google Cast: Disabling device authentication on Android with Xposed
Looking into Attacks and Techniques Used Against WordPress Sites - TrendLabs Security Intelligence Blog
Post | BC Security
Why npm lockfiles can be a security blindspot for injecting malicious modules | Snyk
Out-of-band Attacks [EN] | Omer Citak's Blog | Om3rCitak
GitHub - jthuraisamy/SysWhispers: AV/EDR evasion via direct system calls.
wtfpython/README.md at master · satwikkansal/wtfpython · GitHub
NSA Backdoor Key from Lotus-Notes
Sarah2: A strong pen-and-paper cipher
Write-up: User-After-Free by MalwareTech – mauronz – x86 official language of the blog
ExecutiveCallbackObjects/542875F90F9B47F497B64BA219CACF69 at master · 0xcpu/ExecutiveCallbackObjects · GitHub
Investigating ARM Cortex® M33 core – Dual Core debug tutorial | MCU on Eclipse
https://www.megabeets.net/5-ways-to-patch-binaries-with-cutter/

Recovering the SIM card PIN from the ZTE WF721 cellular home phone | Rip It Apart – Jason's electronics blog-thingy
Microsoft Edge (Chromium) - Elevation of Privilege to Potential Remote Code Execution
https://bertjwregeer.keybase.pub/2019-12-10 - error_page request smuggling.pdf
GitHub - shadow-horse/CVE-2019-17571: Apache Log4j 1.2.X存在反序列化远程代码执行漏洞
https://medium.com/surendirans7777/2fa-bypass-techniques-32ec135fb7fe
https://medium.com/cyberverse/find-secret-api-keys-22cdcc829976
Nexus Intelligence Insights: CVE-2018-5382 Bouncycastle Information Exposure
Mobile device penetration Testing Test Cases - SecureLayer7
Gafgyt Targeting Huawei and Asus Routers and Killing Off Rival IoT Botnets
zoneidentifier.exe | Didier Stevens
Memory Laundering: Is Cleaner Better?
Gone in 30 seconds – a HID cable story tale | David Sopas - Web Security Researcher
Guido Kroon / sr2t · GitLab
Kringlecon 2: Turtle Doves | Kringlecon-2-Turtle-Doves
An Introduction to Arcade Security – Utku Sen - Blog – computer security, programming
Designing My Linux-Powered Business Card • &> /dev/null
https://securitylab.github.com/research/ubuntu-apport-CVE-2019-7307
https://securitylab.github.com/research/ubuntu-apport-CVE-2019-15790
https://securitylab.github.com/research/ubuntu-whoopsie-CVE-2019-11484
Interactive Beginner's Guide to ROP | Nagarro Security


Translate / Map
Wikipedia [ENG] / GIT

Metasploit / ExploitDB
Converter / Project 0

Hotmail / Gmail / ODA
eprint.iacr / Youtube