A centralized resource for previously documented WDAC bypass techniques - bohops/UltimateWDACBypassList

An attacker can bypass the HEY.com HTML sanitizer and inject arbitrary unsafe HTML in emails.

To reproduce the bug you have to send raw HTML-formatted email. You can do it e.g. with the Sendmail...

Hello,

## Who we are :

We’re two French security researchers and our respective names are Brice Augras and
Christophe Hauquiert, we worked and found the vulnerability together.

Brice Augras from...

Update 25.01.2021: Added Google engineers exploit method for getting access token.   Google Cloud Monitoring (formerly called Stackdriver)...

Version en español: acá

I used “app” keyword in place of application name as it was private program.

"Use ImageMagick® to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) includ...

Hi guys, this is my first english write-up, so I’m sorry for my bad english grammar.

I just want to write a check list for myself. This article includes various vulnerability discovery method bypass methods. I hope you can…

S

📧 Subscribe to BBRE Premium: https://bbre.dev/premium
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw

This video is about an RCE vulnerability in Github pages. The report on hackerone was rewarded $25,000.…

As many of you may know, a Web Application Firewall is a firewall that sits in front of our web applications, and filters, analyzes and…

Hello everyone, I am Marx Chryz and I am new to bug bounty hunting even though I do web penetration testing for more than a year.

Blog Location changed to here : https://blog.s1r1us.ninja/research/cookie-tossing-to-rce-on-google-cloud-jupyter-notebooks

Firstly, its nice to publish my last write-up this year. In June of this year, I found a Reflected XSS vulnerability in a video-game company. Then, I realized that this server is caching the weak parameters value. In this way, I incresead the…

A report from @francisbeaudoin showed that it was possible to bypass Shopify's email verification for a small subset of Shopify user accounts. Doing so would have allowed a user to access accounts...

Introduction