It was found that unexpected behaviors in the query’s escape function could cause a SQL injection in mysqljs/mysql

We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking notifications for iOS users and Apple’s Tracker Detect…

Today I wanted to talk about using the deception technology called New-HoneyHash.ps1. This is a tool that was inspired by Mark Baggett and authored by Matt Graeber, that will inject fake credential…

Command line fuzzer and bruteforcer 🌪 wfuzz for command - GitHub - ariary/cfuzz: Command line fuzzer and bruteforcer 🌪 wfuzz for command

Download the Practical Guide to Attacking JWT (JSON Web Tokens). Must read for pentesters, developers, security professionals and researchers.

We recently discovered a code vulnerability in Horde Webmail that can be used by attackers to take over email accounts by sending a malicious email.

Posted in r/netsec by u/0xdeadbeef0000 • 13 points and 0 comments

Posted in r/netsec by u/Neustradamus • 3 points and 0 comments

Posted in r/netsec by u/MysteriousHotel3017 • 1 point and 0 comments

Posted in r/netsec by u/VVX7 • 1 point and 0 comments

pfSense <= 2.5.2 allows authenticated users to inject arbitrary sed-specific code, which leads to an Arbitrary File Write, resulting in a Remote Code Execution. The vulnerability is also exploitable through a Cross-Site Request Forgery.

The advisory data can be readily adopted, adapted, and exchanged. Learn more here.

I have bad news. I first noticed this one day like any other, and once I noticed it, I couldn’t escape the reality. Hacking is boring. This may seem counter-intuitive at first. If you looked at your average hacker, they wouldn’t look bored. More like a mixture…

Application security issues found by Assetnote

Hello everyone. I am so excited to publish my second article in 2022 which is ‘Understanding Threat Actors’.

As geopolitical tensions continue to mount, reports are emerging of a new wiper malware targeting Ukrainian infrastructure, such as government departments. Symantec and ESET research first tweeted...

Posted in r/netsec by u/danyork • 10 points and 0 comments

Last year we found a lot of exciting vulnerabilities in VMware products. The vendor was notified and they have since been patched. This is the second part of our research. This article covers an Authentication Bypass in VMware Carbon Black Cloud Workload…

Simwigo is a cross-platform tool, written in Go, to simplify the deployment of a web service. - GitHub - 8iche/simwigo: Simwigo is a cross-platform tool, written in Go, to simplify the deployment o...