I have reviewed several solutions for our fix the flag contests, contributed by seasoned developers and prominent CTF players. What has been the most commonly adopted approach to address security vulnerabilities? The answer is Input Validation. This doesn’t…

r/offensive_security: Welcome to the Official Offensive Security now known as OffSec! Learn, share, and connect with others in preparation for OSCP …

The article presents how to store and analyse Software Bill of Materials with OWASP Dependency-Track to identify security vulnerabilities…

Introduction

I spent a recent flight finding out what I could do with an connection to the flight’s wifi, but without access to the internet.
I was on my way home from Strange Loop, on a flight from St. Louis to Oakland. It’s a long enough flight that I planned to purchase…

The 3AM ransomware group has recently been spotlighted for its cybercriminal activities. However, why it is the topic of the day is their choice of

Contribute to fireblocks/mpc-lib development by creating an account on GitHub.

ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.

The Marvin Attack is a return of a timing variant of a 25-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.

This blog post will give a short overview of how in-memory .NET assembly execution commonly works and what detection mechanisms exist.

cloudgrep is grep for cloud storage. Contribute to cado-security/cloudgrep development by creating an account on GitHub.

Meet @htmalgae, an anonymous security researcher with a wealth of experience in web application development. In the digital realm, htmalgae operates under

The scenario is this: a brand new Ubuntu 22.04 server has an account which is restricted to running sudo logrotate *. Can we get root? Short answer: Yes. I couldn’t find much online about this type of exploitation of logrotate, so let’s document something…

We were told a story which piqued our curiosity. Our customer’s security team started to get a flood of Beacon alerts from one of their…