Lately, I’ve been reverse engineering a reasonably complex network protocol, and I ran into a mystery - while the protocol is generally an unencrypted binary protocol, one of the messages was large and random. In an otherwise unencrypted protocol, why is…

The issue could then allow the malicious actor to generate arbitrary logs which can trigger malicious commands to be run with elevated privileges.

Security scanning orchestration and results enrichment framework -- forked and rewritten from @thought-machine/dracon - GitHub - ocurity/dracon: Security scanning orchestration and results enrichme...

Learn how the new OpenPubkey protocol advances cryptographic signature technology while bolstering OpenID Connect MFA.

By: Arnar Birgisson and Diana K Smetters, Identity Ecosystems and Google Account Security and Safety teams Starting today , you can create a...

How to use a new model to build trust in your software supply chain elements through a comprehensive compliance platform turning building blocks into verifiable evidence.

The threat intelligence team of Cleafy analyzed undercovering drIBAN fraud operations. Read here the first episode of the series of technical analysis.

GitHub Gist: instantly share code, notes, and snippets.

Advance web spider/crawler for cyber security professionals - GitHub - 3nock/SpiderSuite: Advance web spider/crawler for cyber security professionals

Public exploits and detections for CVE-2023-27350 focus on code execution using the PaperCut print noscripting interface. In this blog, VulnCheck shares a new code execution vector and demonstrates how existing detections aren't robust enough to flag the new…

bitdrain - remote p2p bandwidth/cpu overage attack against bitcoin, dogecoin, etc. - GitHub - visualbasic6/drain: bitdrain - remote p2p bandwidth/cpu overage attack against bitcoin, dogecoin, etc.

Redash is a popular data analysis and visualization tool. We recently reported a critical SAML authentication bypass vulnerability affecting it latest version (10.1.0). The vulnerability could be exploited by anyone to gain highest possible privileges on…

whois command implemented by golang with awesome whois servers list - famasoon/gowhois

Research on how browsers encode & send cookies, how they are parsed by various web frameworks, and some bugs

Resources for Application Security including Web, API, Android, iOS and Thick Client - Anof-cyber/Application-Security

In pentesting assessments and CTFs we always need reverse shells to execute commands on target machine once we have exploited a system and have a command injection at some point in our engagement.
For that we have an awesome project: revshells.com or reverse…