Hola Infosec! Thanks for showing so much love to my previous story. Just like my last writup, today also I am going to share an…

Today I am gonna share a simple but critical vulnerability with you guys. This vulnerability called payment price manipulation, by using…

A vulnerability in Bitdefender Antivirus allowed any website to run arbitrary code with user's privileges. This was caused by issues very similar to ones found in other antivirus products before.

Two days ago, I found a simple, limited XSS, so, I developed it to be a One-click full account takeover.

We propose a new exploit technique that brings a whole-new attack surface to defeat path normalization, which is complicated in implementation due to many implicit properties and edge cases. This complication, being under-estimated or ignored by developers…

Hello Community!

2fa bypass in a private program

Heyyy Everyoneee,

Hi Team

I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by...

Posted by Natalie Silvanovich, Project Zero This is a three-part series on exploiting messenger applications using vulnerabilities in We...

# Summary

With any in-app redirect - logic/open redirect, HTML or javanoscript injection it's possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically...

On June 28th, @say_ch33se reported that it was possible to bypass Shopify's email verification for legacy accounts. Doing so would have allowed a user to access accounts they did not own.

Our...

Introduction to Windows Drivers Exploitation

TL;DR

Pivoting guide for penetrations testers or red team members

Ever come across a system that did so many little things wrong that you were certain you could “get r00t”? You chip away, gradually uncovering the links in the chain, but then you run o…

Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wis...