NEW BOT Телеграм, страница - 97799967

HackerOne

11K subscribers

644 photos

31 videos

79 files

2.74K links

Community : @Sec0x01
@Bug0x

Download Telegram

About

Blog

Apps

Platform

11K subscribers

Telegram bug bounties: XSS, privacy issues, official bot exploitation and more…

https://davtur19.medium.com/telegram-bug-bounties-xss-privacy-issues-official-bot-exploitation-and-more-5277fa78435

2.97K viewsAdeL, 20:01

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data.

https://cve.reconshell.com/cve/CVE-2021-31546

3.1K viewsAdeL, edited 07:28

https://twitter.com/1rpwn/status/1387082353206599685

Testing SAML integrations? Make sure to check - document/assertion signing - XSW attacks - self-signing document - replay protection - document expiration time - relay state open redirect - originating IP validation - XXE - XSLT Need more input -> docs.oasis…

2.42K viewsAdeL, 16:35

https://www.ironnet.com/blog/iranian-cyber-attack-updates

Analysis of the Iranian cyber attack landscape

Updated to include recent activity by the APT Agrius

2.35K viewsAdeL, 17:00

Researchers Uncover Stealthy Linux Malware That Went Undetected for 3 Years. RotaJakiro

https://thehackernews.com/2021/04/researchers-uncover-stealthy-linux.html

The Hacker News

Researchers Uncover Stealthy Linux Malware That Went Undetected for 3 Years

Researchers Uncover Stealthy Linux Malware That Went Undetected for 3 Years

2.42K viewsAdeL, 17:01

https://github.com/Ondrik8/start

GitHub - Ondrik8/start

Contribute to Ondrik8/start development by creating an account on GitHub.

2.38K viewsAmir Kiani, 11:57

https://ds3summit.github.io/#introduction

2.35K viewsAdeL, 20:03

https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/

News, Techniques & Guides

Exploiting memory corruption vulnerabilities on Android

In today's blog, we'll discuss memory corruption vulnerabilities in Android apps and how they can be exploited. At the end of the article, we'll show how we found such a vulnerability in PayPal apps and what the result could be.

2.68K viewsAdeL, 20:11

Automatic and platform-independent unpacker for Windows binaries based on emulation

https://github.com/unipacker/unipacker

GitHub - unipacker/unipacker: Automatic and platform-independent unpacker for Windows binaries based on emulation

Automatic and platform-independent unpacker for Windows binaries based on emulation - unipacker/unipacker

2.63K viewsAdeL, edited 15:22

2.66K viewsAmir Kiani, 23:38

https://security.humanativaspa.it/fox-fix-objectivec-xrefs-in-ghidra/

FOX - Fix Objective-C XREFs in Ghidra - hn security

Hi! This is my first article […]

2.88K viewsAdeL, 11:14

https://www.youtube.com/watch?v=_E0PWQvW-14

How the Apple AirTags were hacked

On Saturday, I managed to dump the firmware of the newly released Apple AirTags - and in this video I'll show how I did it.

I won't share firmware dumps or so, so please don't ask :)

Links:
- Colin on Twitter: http://twitter.com/colinoflynn
- Colin on YouTube:…

2.49K viewsAmir Kiani, 02:30

https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/

Krebs on Security

A Closer Look at the DarkSide Ransomware Gang

The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack that caused Colonial Pipeline to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on…

2.49K viewsAdeL, 16:41

Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316) https://shenaniganslabs.io/2021/04/13/Airstrike.html

Shenanigans Labs

Airstrike Attack - FDE bypass and EoP on domain joined Windows workstations (CVE-2021-28316)

By default, domain joined Windows workstations allow access to the network selection UI from the lock screen.

An attacker with physical access to a locked device with WiFi capabilities (such as a laptop or a workstation) can abuse this functionality to force…

2.97K viewsAdeL, 13:51

HTTP Protocol Stack Remote Code Execution Vulnerability

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-CVE-2021-31166

2.6K viewsMmD, edited 12:00

https://twitter.com/brokep/status/1389314362561777665

Peter Sunde Kolmisoppi

Maybe you heard that the domain dark.fail (@DarkDotFail ) got hijacked. Here's the story on how it happened. A thread! (I've pieced together the data I have so I might have some small errors in this thread, FYI.)

2.57K viewsAmir Kiani, 05:21

HTTP Protocol Stack Remote Code Execution Vulnerability http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-CVE-2021-31166

CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability

https://github.com/0vercl0k/CVE-2021-31166

GitHub - 0vercl0k/CVE-2021-31166: Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. - 0vercl0k/CVE-2021-31166

2.81K viewsAdeL, 10:23

Lazarus APT conceals malicious code within BMP image to drop its RAT https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/

2.67K viewsAdeL, 17:22

https://github.com/Findomain/Findomain

GitHub - Findomain/Findomain: The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP…

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, ...

2.39K viewsAmir Kiani, 10:21

https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530

Just Gopher It: Escalating a Blind SSRF to RCE for $15k — Yahoo Mail

2.19K viewsAmir Kiani, 18:55

Malware Analysis: Ragnarok Ransomware https://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware/

2.14K viewsAdeL, 17:51