Home Classic Look

👩‍💻IW Weekly #74: RCE through Dependency Confusion, 2FA bypass in Meta, Client side Prototype pollution and its prevention, Paywall bypass, SSRF tricks and many more..

Welcome to the #IWWeekly74 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Ite...

Aug 28, 2023 newsletter, ssrf, rce, bypass, 2fa

Leaking File Contents with a Blind File Oracle in Flarum

Introduction Flarum is a free, open source PHP-based forum software used for everything from gaming hobbyist sites to cryptocurrency discussion. A quick survey on Shodan suggests there are over 120...

Aug 27, 2023

Advisory: Flarum LFI - CVE-2023-40033

Summary An attacker with a basic user forum account can specify a malicious avatar URL that discloses the contents of arbitrary local files on the file system. Impact An attacker can read the conte...

Aug 27, 2023 cve, lfi

Bug Bytes #209 – The only graphQL wordlist you need, ML bug hunting and VDP submissions

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-u...

Aug 23, 2023 newsletter, graphql

👩‍💻IW Weekly #73: ATO in Shopify Stores, CVE-2023-36809, Risks in Cross-Chain Bridges, Bypassing Firewalls, Hacking iOS Apps, Uncovering Zenbleed and many more..

Welcome to the #IWWeekly73 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Ite...

Aug 21, 2023 newsletter, cve, bypass, ios, app

👩‍💻IW Weekly #72: GraphQL Hacking, SSO Vulnerabilities, Race Condition Vulnerabilities, SQLMap & Server Side Request Forgery Tips, Sandwich Attack and many more..

Welcome to the #IWWeekly72 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

Aug 14, 2023 newsletter, graphql

Smashing the state machine: the true potential of web race conditions

For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hid...

Aug 9, 2023 web

Finding and Exploiting Citrix NetScaler Buffer Overflow (CVE-2023-3519) (Part 3)

Introduction A lot has been written about the recent Citrix NetScaler buffer overflow. In the initial rush to get information and platform checks out to customers, some details may not have been fu...

Aug 8, 2023 cve, exploit

👩‍💻IW Weekly #71: Introduction to AD pentesting, XSS via exported activity, using HOTW to leak CSRF token, full access to airline points, SSRFs and many more..

Welcome to the #IWWeekly71 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

Aug 7, 2023 newsletter, xss, csrf, ssrf

Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform

Between March 2023 and May 2023, we identified multiple security vulnerabilities within points.com, the backend provider for a significant portion of airline and hotel rewards programs. These vulne...

Aug 3, 2023

1
...
16
17
18
...
34
17 / 34