XSS vulnerability in the ASP.NET application: examining CVE-2023-24322 in mojoPortal CMS
https://ift.tt/JW1NhA9
Submitted May 31, 2023 at 03:00PM by Hell_walker13
via reddit https://ift.tt/s4gF0np
https://ift.tt/JW1NhA9
Submitted May 31, 2023 at 03:00PM by Hell_walker13
via reddit https://ift.tt/s4gF0np
PVS-Studio
XSS vulnerability in the ASP.NET application: examining CVE-2023…
In this article, we will thoroughly examine the XSS vulnerability in a CMS written in C#. Let′s recall the theory, figure out how the security defect looks from a user′s perspective and in …
chonked pt.1: MiniDLNA 1.3.2 HTTP Chunk Parsing Heap Overflow - Root Cause Analysis
https://ift.tt/aJZXf6b
Submitted June 01, 2023 at 07:45AM by ahigherporpoise
via reddit https://ift.tt/R1L7Juk
https://ift.tt/aJZXf6b
Submitted June 01, 2023 at 07:45AM by ahigherporpoise
via reddit https://ift.tt/R1L7Juk
hyprblog
chonked pt.1: MiniDLNA 1.3.2 HTTP Chunk Parsing Heap Overflow (CVE-2023-33476) Root Cause Analysis
first part in a two-part series going over a heap overflow in MiniDLNA, a media server commonly deployed in embedded environments. this post provides a summary and root cause analysis of the vulnerability.
[CVE-2021-33690] SSRF vulnerability in SAP NetWeaver DI || CVSS 9.9/10 || RedRays
https://ift.tt/9MRtY34
Submitted June 01, 2023 at 01:43PM by vah_13
via reddit https://ift.tt/xgayK9Y
https://ift.tt/9MRtY34
Submitted June 01, 2023 at 01:43PM by vah_13
via reddit https://ift.tt/xgayK9Y
RedRays - Your SAP Security Solution
[CVE-2021-33690] SSRF vulnerability in SAP NetWeaver DI
Explore the critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2021-33690, in SAP NetWeaver Development Infrastructure, affecting versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. This vulnerability allows attackers with server access to execute…
Welcome New Moderators!
Hey /r/netsec,I'm thrilled to bring some exciting news to you all today. We've expanded our moderation team to include a group of passionate information security professionals who are dedicated to helping /r/netsec continue to serve as your go-to resource for high-quality, technical security content.Please join me in extending a warm welcome to our new moderators:/u/rejuicekeve/u/netsec_burn/u/ustayready/u/qwerty0x41/u/infinitelogins/u/Gallus/u/shellsharks/u/jsonpile/u/voidnull/u/execveatAll of these folks have a shared passion for information security, and a shared vision for /r/netsec as a curated, community-sourced aggregator for top-tier security content and research. We're all here to help cut through the noise of fear-mongering and low quality clickbait, and stick to our roots by rewarding the folks who create high-quality original content.Our new moderators will be working closely with the existing team to uphold and enforce our content guidelines. We believe in open discussion and collaboration, and any disagreements about content removal, spam decisions, bans, or user-facing activity will be handled through conversation with the mod team.I am incredibly excited for this new chapter in /r/netsec, and I am grateful to each of you for making this community what it is. Let's continue to build a thriving and engaging space for high-quality, technical security discourse together.- /u/sanitybitGreetz to SophSec and Busticati worldwide.
Submitted June 01, 2023 at 01:19PM by sanitybit
via reddit https://ift.tt/nfTVgUY
Hey /r/netsec,I'm thrilled to bring some exciting news to you all today. We've expanded our moderation team to include a group of passionate information security professionals who are dedicated to helping /r/netsec continue to serve as your go-to resource for high-quality, technical security content.Please join me in extending a warm welcome to our new moderators:/u/rejuicekeve/u/netsec_burn/u/ustayready/u/qwerty0x41/u/infinitelogins/u/Gallus/u/shellsharks/u/jsonpile/u/voidnull/u/execveatAll of these folks have a shared passion for information security, and a shared vision for /r/netsec as a curated, community-sourced aggregator for top-tier security content and research. We're all here to help cut through the noise of fear-mongering and low quality clickbait, and stick to our roots by rewarding the folks who create high-quality original content.Our new moderators will be working closely with the existing team to uphold and enforce our content guidelines. We believe in open discussion and collaboration, and any disagreements about content removal, spam decisions, bans, or user-facing activity will be handled through conversation with the mod team.I am incredibly excited for this new chapter in /r/netsec, and I am grateful to each of you for making this community what it is. Let's continue to build a thriving and engaging space for high-quality, technical security discourse together.- /u/sanitybitGreetz to SophSec and Busticati worldwide.
Submitted June 01, 2023 at 01:19PM by sanitybit
via reddit https://ift.tt/nfTVgUY
Reddit
r/netsec on Reddit: Welcome New Moderators!
Posted by u/sanitybit - 89 votes and 9 comments
[Fixed] [CVE-2021-33690] SSRF vulnerability in SAP NetWeaver DI
https://ift.tt/9MRtY34
Submitted June 01, 2023 at 02:10PM by vah_13
via reddit https://ift.tt/CWQvk4A
https://ift.tt/9MRtY34
Submitted June 01, 2023 at 02:10PM by vah_13
via reddit https://ift.tt/CWQvk4A
RedRays - Your SAP Security Solution
[CVE-2021-33690] SSRF vulnerability in SAP NetWeaver DI
Explore the critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2021-33690, in SAP NetWeaver Development Infrastructure, affecting versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. This vulnerability allows attackers with server access to execute…
CSP Bypass Unveiled: The Hidden Threat of Bookmarklets
https://ift.tt/MkPUJ1f
Submitted June 01, 2023 at 03:25PM by ziyahanalbeniz
via reddit https://ift.tt/GAd5NYi
https://ift.tt/MkPUJ1f
Submitted June 01, 2023 at 03:25PM by ziyahanalbeniz
via reddit https://ift.tt/GAd5NYi
SOCRadar® Cyber Intelligence Inc.
CSP Bypass Unveiled: The Hidden Threat of Bookmarklets
A newly developed method for enticing victims involves the addition of bookmarklets and enticing them to click on specific websites.
ChatGPT for Pentesters - A few useful scenarios pentesters need daily
https://ift.tt/zJ0X7Kr
Submitted June 01, 2023 at 03:13PM by ziyahanalbeniz
via reddit https://ift.tt/ZGDcCmH
https://ift.tt/zJ0X7Kr
Submitted June 01, 2023 at 03:13PM by ziyahanalbeniz
via reddit https://ift.tt/ZGDcCmH
Medium
ChatGPT for Pentesters
Can we use generative AI or ChatGPT, the most known and used application for penetration testing?
[CVE-2023-33243] STARFACE: Authentication with Password Hash Possible
https://ift.tt/ACuO1lg
Submitted June 01, 2023 at 05:35PM by RedTeamPentesting
via reddit https://ift.tt/X4J7sN0
https://ift.tt/ACuO1lg
Submitted June 01, 2023 at 05:35PM by RedTeamPentesting
via reddit https://ift.tt/X4J7sN0
www.redteam-pentesting.de
STARFACE: Authentication with Password Hash Possible
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's…
Printerlogic Multiple Vulnerabilities - Published at Full Disclosure
https://ift.tt/9IUv1mp
Submitted June 01, 2023 at 06:54PM by 4SysAdmin
via reddit https://ift.tt/p5TnEXZ
https://ift.tt/9IUv1mp
Submitted June 01, 2023 at 06:54PM by 4SysAdmin
via reddit https://ift.tt/p5TnEXZ
seclists.org
Full Disclosure: Printerlogic multiple vulnerabilities
Reversing Python Pickles
https://ift.tt/JyZvfR8
Submitted June 01, 2023 at 09:24PM by nibblesec
via reddit https://ift.tt/vNYL8GR
https://ift.tt/JyZvfR8
Submitted June 01, 2023 at 09:24PM by nibblesec
via reddit https://ift.tt/vNYL8GR
Doyensec
Reversing Pickles with r2pickledec · Doyensec's Blog
Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.
TyphoonCon Capture The Flag 2023 - specially crafted challenges alongside fantastic prizes
https://ift.tt/gIocu9y
Submitted June 01, 2023 at 08:55PM by Marsy_star
via reddit https://ift.tt/vJYxA5t
https://ift.tt/gIocu9y
Submitted June 01, 2023 at 08:55PM by Marsy_star
via reddit https://ift.tt/vJYxA5t
Typhooncon
TyphoonCon Capture The Flag 2023
WELCOME TO TYPHOONCON CTF!Typhooncon CTF is back for the third year in a row! As part of TyphoonCon 2023, we’ll be hosting an on-site/online competition with specially crafted challenges alongside fantastic prizes
REGISTER NOW
…
REGISTER NOW
…
Gigabyte Bios Update System Insecure and Vulnerable to Supply Chain Attack
https://ift.tt/rgfep7A
Submitted June 02, 2023 at 02:25AM by asdf3
via reddit https://ift.tt/TR19ZDr
https://ift.tt/rgfep7A
Submitted June 02, 2023 at 02:25AM by asdf3
via reddit https://ift.tt/TR19ZDr
Eclypsium | Supply Chain Security for the Modern Enterprise
Supply Chain Risk from Gigabyte App Center Backdoor - Eclypsium | Supply Chain Security for the Modern Enterprise
Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild. These detections were driven by heuristic detection methods, which play an important role in detecting new, previously-unknown supply chain…
Free video course: Hacking DVWS (modern DVWA) with Burp Suite
https://www.youtube.com/playlist?list=PLz_SG4MKcA4m1p-QPvkLaX6gVrCIHwkCj
Submitted June 02, 2023 at 12:03PM by 0rsinium
via reddit https://ift.tt/6qMaUZH
https://www.youtube.com/playlist?list=PLz_SG4MKcA4m1p-QPvkLaX6gVrCIHwkCj
Submitted June 02, 2023 at 12:03PM by 0rsinium
via reddit https://ift.tt/6qMaUZH
Reddit
Free video course: Hacking DVWS (modern DVWA) with Burp Suite : r/netsec
481K subscribers in the netsec community. /r/netsec is a community-curated aggregator of technical information security content. Our mission is to…
Operation Triangulation: iOS devices targeted with previously unknown malware
https://ift.tt/lUK8dtg
Submitted June 04, 2023 at 08:29PM by execveat
via reddit https://ift.tt/32tVbpP
https://ift.tt/lUK8dtg
Submitted June 04, 2023 at 08:29PM by execveat
via reddit https://ift.tt/32tVbpP
Securelist
Operation Triangulation: iOS devices targeted with previously unknown malware
While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices…
Unpacking Shellcode with Ghidra Emulator
https://ift.tt/cHnVosl
Submitted June 04, 2023 at 10:40PM by cy1337
via reddit https://ift.tt/wfvQukN
https://ift.tt/cHnVosl
Submitted June 04, 2023 at 10:40PM by cy1337
via reddit https://ift.tt/wfvQukN
Medium
Unpacking Shellcode with Ghidra Emulator
In this post, I use Ghidra’s emulator to unpack a Metasploit XOR encoded reverse shell to get decompiled output with resolved syscalls.
RedRays Uncovers Alarming Scope of Breach: Urgent Action Required to Safeguard Critical Systems
https://ift.tt/3V48qeL
Submitted June 05, 2023 at 02:28AM by vah_13
via reddit https://ift.tt/42UfYlG
https://ift.tt/3V48qeL
Submitted June 05, 2023 at 02:28AM by vah_13
via reddit https://ift.tt/42UfYlG
RedRays - Your SAP Security Solution
Press release: RedRays discovered major cybersecurity leak affects 4800 domains
RedRays uncovers major breach: 4,800+ domains affected, including top crypto exchanges, Google accounts, and government entities. 2,000+ impacted enterprise software users and over 100 banks. Urgent action needed to strengthen cybersecurity defenses. RedRays…
kitabisa/teler-waf: Introduces external custom rules & DSL expression support!
https://ift.tt/PbwB8to
Submitted June 05, 2023 at 08:05AM by dwisiswant0
via reddit https://ift.tt/KH0CFxB
https://ift.tt/PbwB8to
Submitted June 05, 2023 at 08:05AM by dwisiswant0
via reddit https://ift.tt/KH0CFxB
GitHub
Introduces external custom rules & DSL expression support! · teler-sh/teler-waf · Discussion #45
I'm thrilled to announce the new release of teler-waf v1 (beta) just hit the streets with highly anticipated and powerful features: the ability to load external custom rules and full support fo...
Storing Passwords - A Journey of Common Pitfalls
https://ift.tt/bL9Iqih
Submitted June 05, 2023 at 07:08PM by RedTeamPentesting
via reddit https://ift.tt/imWQCjs
https://ift.tt/bL9Iqih
Submitted June 05, 2023 at 07:08PM by RedTeamPentesting
via reddit https://ift.tt/imWQCjs
RedTeam Pentesting - Blog
Storing Passwords - A Journey of Common Pitfalls
As pentesters, we regularly see creative ways of handling authentication and almost as often we see the pitfalls that come along with these unconventional ways. For instance, we recently discovered a vulnerability in the web interface of STARFACE PBX …
Using PANDA to search for F.L.I.R.T. signatures during process execution
https://ift.tt/umZ0lUW
Submitted June 05, 2023 at 09:28PM by whisperingmime
via reddit https://ift.tt/qhkvJ6W
https://ift.tt/umZ0lUW
Submitted June 05, 2023 at 09:28PM by whisperingmime
via reddit https://ift.tt/qhkvJ6W
Blog by Joren Vrancken
Using PANDA to search for F.L.I.R.T. signatures during process execution
When a malware analyst gets a new malware sample to analyze, one of the first questions they might have, is what functions are called during the execution of the sample. To solve this problem, we can use any old debugger to walk through the sample manually…
Ripping Off Professional Criminals by Fermenting Onions - Phishing Darknet Users for Bitcoins
https://ift.tt/qRiZhI8
Submitted June 05, 2023 at 10:38PM by Salmiakkilakritsi
via reddit https://ift.tt/KmDoxaR
https://ift.tt/qRiZhI8
Submitted June 05, 2023 at 10:38PM by Salmiakkilakritsi
via reddit https://ift.tt/KmDoxaR
Shufflingbytes
Ripping Off Professional Criminals by Fermenting Onions - Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale
RCE via LDAP truncation on hg.mozilla.org
https://ift.tt/KDMNH7p
Submitted June 06, 2023 at 12:40PM by albinowax
via reddit https://ift.tt/cX3PHaG
https://ift.tt/KDMNH7p
Submitted June 06, 2023 at 12:40PM by albinowax
via reddit https://ift.tt/cX3PHaG
0day.click
RCE via LDAP truncation on hg.mozilla.org
Given my interest in SCM and CI systems I was a little keen to see how this is done at Mozilla as part of their bug bounty program. Thanks to freddy I was granted Level 1 access to Mozilla’s SCM at hg.mozilla.org in late 2022. As Mozilla is a pretty transparent…