Wawa Security Links 346

Mardi 27 Octobre 2026


GoogleNCR / Twitter
Hacking tutos / Facebook


Code injection in Workflows leading to SharePoint RCE (CVE-2020-0646) – MDSec
https://blog.grimm-co.com/post/analyzing-the-linux-kernel-in-userland-with-afl-and-klee/
GitHub - furiousMAC/continuity: Apple Continuity Protocol Reverse Engineering and Dissector
LandGrey's Blog
Kraken Identifies Critical Flaw in Trezor Hardware Wallets | Kraken Blog
https://www.hackingarticles.in/view2akill-vulnhub-walkthrough/
Avocent IP KVM Hacking: use SIP from any OEM on Dell 1082DS (and probably others) | kitor.pl blog
https://medium.com/notsoshant/a-not-so-blind-rce-with-sql-injection-13838026331e
Abusing DLL Misconfigurations — Using Threat Intelligence to Weaponize R&D | FireEye Inc
RATs in the Library
Buffer overflow when pwfeedback is set in sudoers
Expanding the Attack Surface: React Native Android Applications – Assetnote
An authentication protocol based on chaos and zero knowledge proof | SpringerLink
Netgate SG-1100 Review – Trenches of IT
Obfuscated javascript, scam emails, and American Express - JonLuca's Blog
Cloudflare + Remote Browser Isolation
Reversing XignCode3 Driver - Part 4.1 - Registering Notify and Callback Routines - Niemand - Cyber Security
Hardware Debugging for Reverse Engineers Part 1: SWD, OpenOCD and Xbox One Controllers
https://medium.com/renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b
Krister Walfridsson’s blog: Watching for software inefficiencies with Valgrind

Deanonymizing Tor Circuits - The Hacker Factor Blog
GitHub - hfiref0x/KDU: Kernel Driver Utility
Place where polar bears dwell: Chasing polar bears: part two
Memory Lane - Direct Memory Access Attacks | Eclypsium
GitHub - cryptolok/AES-REX: AES-ni Registers kEy eXtractor
GadgetToJScript, Covenant, Donut
GitHub - maqp/tfc: Tinfoil Chat - Onion-routed, endpoint secure messaging system
Actual XSS in 2020 · Xentropy's Hackventures
GitHub - mufeedvh/CVE-2019-8449: CVE-2019-8449 Exploit for Jira v2.1 - v8.3.4
GitHub - LinusHenze/Fugu: Fugu is the first open source jailbreak based on the checkm8 exploit
Warzone: Behind the enemy lines - Check Point Research
Pointer Compression in V8
https://www.darkoperator.com/blog/2020/1/14/getting-dns-client-cached-entries-with-cimwmi
STARK-Friendly Hash Challenge
GitHub - xairy/unlockdown: Disabling kernel lockdown on Ubuntu without physical access
GitHub - bitsadmin/fakelogonscreen: Fake Windows logon screen to steal passwords
DKOM – Now with Symbolic Links! – Winsider Seminars & Solutions Inc.
https://isc.sans.edu/forums/diary/Analysis of a tripleencrypted AZORult downloader/25768/
Dufflebag: Uncovering Secrets in Exposed EBS Volumes
TeamViewer - WhyNotSecurity

Heap Overflow in F-Secure Internet Gatekeeper · Doyensec's Blog
Firefox Spidermonkey JS Engine Exploitation.pdf - Google Drive
OpendoorCDN Skimmer Analysis Continued | GoggleHeadedHacker
GitHub - 0xb0bb/karkinos: A thorough library database to assist with binary exploitation tasks.
Red Teamer's Cookbook: BYOI (Bring Your Own Interpreter) - Black Hills Information Security
https://blog.talosintelligence.com/2020/02/vuln-spotlight-mini-snmpd-feb-2020.html
GitHub - parsiya/eslinter: Manual JavaScript Linting is a Bug
Write-up for #h1415’s CTF challenge
Dropbox bug bounty program has paid out over $1,000,000 | Dropbox Tech Blog
https://securitylab.github.com/research/fuzzing-challenges-solutions-1
https://www.perimeterx.com/tech-blog/2020/whatsapp-fs-read-vuln-disclosure/
Frans Rosén Keynote at BSides Ahmedabad
The return of the spoof part 2: Command line spoofing – NVISO Labs
DOUBLEPULSAR RCE 2: An RDP Story
Full disclosure: 0day vulnerability (backdoor) in firmware for HiSilicon-based DVRs, NVRs and IP cameras / Habr
GitHub - georgek42/inlinec: Effortlessly write inline C functions in Python
GitHub - wgnet/befw: BEFW
GitHub - gaul/awesome-ld-preload: List of resources related to LD_PRELOAD, a mechanism for changing application behavior at run-time
Swift.org - Introducing Swift Crypto
A new hash algorithm for Git [LWN.net]

Exploiting Insecure Firebase Database! - Security Breached Blog
https://posts.specterops.io/detecting-attacks-within-azure-bdc40f8c0766
CPR-Zero: CVE-2019-1372
Persistence – WaitFor | Penetration Testing Lab
Adding a Backdoor to AD in 400 Milliseconds
Hexacorn | Blog Stay positive Lolbins… not!
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
https://medium.com/mobile-stacks-and-networks-security/introduction-to-mobile-network-intrusions-from-a-mobile-phone-9a8e909cc276
https://0xkasper.com/articles/hacktm-ctf-2020-qualifiers-write-up
Realtek HD Audio Driver Package - DLL Preloading and Potential Abuses (CVE-2019-19705)
Ghost in the shell: Investigating web shell attacks - Microsoft Security
Don't Cross Me! Same Origin Policy and all the "cross" vulns: XSS, CSRF, and CORS - Speaker Deck
checkra1n
My First Joyride With SILENTTRINITY - Black Hills Information Security
GitHub - llamasoft/polyshell: A Bash/Batch/PowerShell polyglot!
CVE-2019-12180 – ReadyAPI & SoapUI command execution via malicous project file | @Mediaservice.net Technical Blog
https://medium.com/sushiwushi2/hijacking-shared-report-links-in-google-data-studio-75eab320c391
From CSRF to RCE and WordPress-site takeover: CVE-2020-8417 - WPSec
Responsible Disclosure: Breaking out of a Sandboxed Editor to perform RCE - Weblog of JD
GitHub - outlandnish/poc-vpn-detection: Proof of Concept for simple Javascript based VPN detection


Translate / Map
Wikipedia [ENG] / GIT

Metasploit / ExploitDB
Converter / Project 0

Hotmail / Gmail / ODA
eprint.iacr / Youtube