Wawa Security Links 352

Dimanche 18 Octobre 2026


GoogleNCR / Twitter
Hacking tutos / Facebook


https://media.cert.europa.eu/static/SecurityAdvisories/2020/CERT-EU-SA2020-010.pdf
https://www.elastic.co/blog/how-to-prevent-elasticsearch-server-breach-securing-elasticsearch
Using BPF to Transform SSH Sessions into Structured Events
Phishytics - Machine Learning for Detecting Phishing Websites - Securitics
https://medium.com/lerner98/car-key-hacking-not-really-b60873cd18a
What to Look for When Reverse Engineering Android Apps - NowSecure
Mac adware is more sophisticated and dangerous than traditional Mac malware | Malwarebytes Labs
https://medium.com/tobinmshields/qdpm-v9-1-authenticated-rce-exploit-f4b84e19df00
Persistence via Shims | liberty shell
GitHub - deepbindiff/DeepBinDiff
CPR evasion encyclopedia: The Check Point evasion repository - Check Point Research
https://thephp.cc/news/2020/02/phpunit-a-security-risk
A Fundamental Tool in the Toolkit: Evasive Shellcode Launchers – Part 1 | Nagarro Security
Interesting Recon Script
GitHub - hessandrew/CVE-2020-9442: OpenVPN Connect for Windows (MSI) - 3.1.0.361 - Privilege Escalation
SensePost | Intro to chrome’s v8 from an exploit development angle
https://www.chaitin.cn/en/ghostcat
From 0 to 1337. brief security analysis of a large service provider
Scripting in Ghidra, Patching MacOS Image2Icon
Trickbot Delivery Method Gets a New Upgrade Focusing on Windows 10

Hack the Box (HTB) machines walkthrough series — Gitlab
Roaming Mantis, part V | Securelist
https://blog.talosintelligence.com/2020/02/new-research-paper-prevalence-and.html
https://isc.sans.edu/forums/diary/Show me Your Clipboard Data/25846/
Securing Memory at EPYC Scale
AWS Automated Remediation - Part 2: S3 Buckets | @me - Nathan Getty Blog
Cache poisoning DoS in CloudFoundry gorouter (CVE-2020-5401) - nathandavison.com
SMB is Dead, Long Live SMB! - Microsoft Tech Community - 1185401
https://bento.dev/blog/2020/bento-check-unescaped-template-extensions-in-flask/
GitHub - bruce30262/libprotobuf-mutator_fuzzing_learning: Learn how to combine libprotobuf-mutator with libfuzzer & AFL++
https://ray-cp.github.io/archivers/browser-pwn-cve-2020-6418????
secret club
GitHub - Ridter/cve-2020-0688: cve-2020-0688
GitHub - Jumbo-WJB/CVE-2020-0688: CVE-2020-0688 - Exchange
GitHub - Yt1g3r/CVE-2020-0688_EXP: CVE-2020-0688_EXP Auto trigger payload & encrypt method
GitHub - random-robbie/cve-2020-0688: cve-2020-0688
browser_pwn/cve-2020-6418 at master · ray-cp/browser_pwn · GitHub
GitHub - ANSSI-FR/ADTimeline: Timeline of Active Directory changes with replication metadata
Objective-See's Blog
GitHub - blackarrowsec/mssqlproxy: mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse.

GitHub - projectdiscovery/shuffledns: shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support.
https://medium.com/ozguralp/write-up-aws-document-signing-security-control-bypass-2b13a9c22a4d
Pwning VMware, Part 2: ZDI-19-421, a UHCI bug | nafod
GitHub - laolisafe/CVE-2020-1938: CVE-2020-1938漏洞复现
ViperSoftX - New JavaScript Threat
Facebook OAuth Framework Vulnerability – Amol Baikar
Weblogic CVE-2020-2551 IIOP协议反序列化RCE – Y4er的博客
Ferib: Reversing a Online Webshop for Discounts
Fuzzing python in Python, and doing it fast
A mysterious bug in the firmware of Google's Titan M chip (CVE-2019-9465)
https://medium.com/aseem.shrey/attention-to-details-a-curious-case-of-multiple-idors-5a4417ba8848
GitHub - tasooshi/pentesting-cookbook: A set of recipes useful in fast-paced pentesting / red teaming scenarios
GitHub - m0nad/awesome-privilege-escalation: A curated list of awesome privilege escalation
GitHub - dxa4481/AttackingAndDefendingTheGCPMetadataAPI: This repo gives an overview of some GCP metadata API attack and defend patterns
https://anee.me/reversing-programmable-interface-controllers-e835c0471ebb
Simple Home Camera System – Trenches of IT
GitHub - duasynt/xfrm_poc: Linux kernel XFRM UAF poc (3.x - 5.x kernels)
GitHub - tg-bomze/StyleGAN2-Face-Modificator: Simple Encoder, Generator and Face Modificator with StyleGAN2
Inside the GitHub Load Balancer - HAProxy Technologies
The Vault: SUPERAntiSpyware Backdoor SASKUTIL64

Detecting CVE-2020-0688 Remote Code Execution Vulnerability on Microsoft Exchange Server | TrustedSec
https://null-byte.wonderhowto.com/how-to/scan-fake-attack-wi-fi-networks-with-esp8266-based-wifi-deauther-0193837/
A brief guide to programmable logic controllers. Searching for vulnerabilities in industrial PLC devices – HackMag
GitHub - Pernat1y/vm-automation: VirtualBox VM automation using Python
GitHub - wavestone-cdt/abaddon
Operation cleanup: Eradicating malware with Osquery and Kolide | HoldMyBeer
Leveraging AWS Lambda to notify users about their old access keys
Disclose Full Admin List of any Facebook Applications – Amol Baikar
Determine users with detailed role model on behalf of any Facebook Application – Amol Baikar
Phishing Windows Credentials | Penetration Testing Lab
Hacking Unicode Like a Boss | Bugcrowd
https://surfingattack.github.io/papers/NDSS-surfingattack.pdf
Yet Another Tamper Detection in Android – Darvin's Blog
A Security Review of SharePoint Site Pages – MDSec
Remote File Inclusion (RFI) - Detecting the Undetectable | Imperva
Service Principal Name (SPN) - hackndo
macOS Security Framework and previous CVEs | Yuebin Sun's Blog
Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT
Google Online Security Blog: FuzzBench: Fuzzer Benchmarking as a Service
BSidesSF CTF: Choose your own keyventure: rsa-debugger challenge! » SkullSecurity


Translate / Map
Wikipedia [ENG] / GIT

Metasploit / ExploitDB
Converter / Project 0

Hotmail / Gmail / ODA
eprint.iacr / Youtube