Testing SAML integrations? Make sure to check - document/assertion signing - XSW attacks - self-signing document - replay protection - document expiration time - relay state open redirect - originating IP validation - XXE - XSLT Need more input -> docs.oasis…

Updated to include recent activity by the APT Agrius

Researchers Uncover Stealthy Linux Malware That Went Undetected for 3 Years

Contribute to Ondrik8/start development by creating an account on GitHub.

In today's blog, we'll discuss memory corruption vulnerabilities in Android apps and how they can be exploited. At the end of the article, we'll show how we found such a vulnerability in PayPal apps and what the result could be.

Automatic and platform-independent unpacker for Windows binaries based on emulation - unipacker/unipacker

Hi! This is my first article […]

On Saturday, I managed to dump the firmware of the newly released Apple AirTags - and in this video I'll show how I did it.

I won't share firmware dumps or so, so please don't ask :)

Links:
- Colin on Twitter: http://twitter.com/colinoflynn
- Colin on YouTube:…

The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack that caused Colonial Pipeline to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on…

By default, domain joined Windows workstations allow access to the network selection UI from the lock screen.

An attacker with physical access to a locked device with WiFi capabilities (such as a laptop or a workstation) can abuse this functionality to force…

Maybe you heard that the domain dark.fail (@DarkDotFail ) got hijacked. Here's the story on how it happened. A thread! (I've pieced together the data I have so I might have some small errors in this thread, FYI.)

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. - 0vercl0k/CVE-2021-31166

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, ...

Part 1: Recon

Unit 42 discovers MuddyWater, a threat group targeting entities in the Middle East and beyond.

A curated list of awesome privilege escalation. Contribute to m0nad/awesome-privilege-escalation development by creating an account on GitHub.