We recently uncovered two critical code vulnerabilities in the personal cloud system CasaOS. Let's see what we can learn from them.

Learn how SaaS super admins targeted Okta in a social engineering campaign, and how to keep your Okta tenant and highly privileged SaaS identities secure using Reco’s AI-driven approach and comprehensive mapping of data, apps, and identities.

So far, it was possible to spam through proximity paring messages only iOS devices, either using Flipper Zero, Arduino board or any Android as explained in my previous blog here. However, recently developers of Xtreme firmware for Flipper Zero pushed and…

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

So far, it was possible to spam through proximity paring messages only iOS devices, either using Flipper Zero, Arduino board or any Android as explained in my previous blog here. However, recently developers of Xtreme firmware for Flipper Zero pushed and…

Tool to perform GCP Domain Wide Delegation abuse and access Gmail and Drive data - lutzenfried/Delegate

Dominate Active Directory with PowerShell. . Contribute to The-Viper-One/PsMapExec development by creating an account on GitHub.

In this post, I'll exploit CVE-2023-4069, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.

Although there is public research on Direct Composition, only a few discuss fuzzing this feature, and none, to our knowledge, that covers snapshot fuzzing.

The single-packet attack is a new technique for triggering web race conditions. It works by completing multiple HTTP/2 requests with a single TCP packet, which effectively eliminates network jitter an

POC for a DLL spoofer to determine DLL Hijacking. Contribute to MitchHS/DLL-Spoofer development by creating an account on GitHub.

An uber fast and simple subdomain enumeration tool using DNS and web requests with support for detecting wildcard DNS records. - GitHub - n0mi1k/subby: An uber fast and simple subdomain enumeration...

Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability. Given supply chain attacks carried out by these threat…

In today’s dynamic technological landscape, the shift to cloud environments has become a cornerstone of business innovation. As companies…

15 votes, 11 comments. 492K subscribers in the netsec community. /r/netsec is a community-curated aggregator of technical information security…

Contribute to DeiteriyLab/protobuf-magic development by creating an account on GitHub.

Contribute to IoTSecurity101/IoT-Lab-Setup-Guide development by creating an account on GitHub.

Here at watchTowr, we just love attacking high-privilege devices (and spending hours thinking of awful noscripts [see above]).

A good example of these is the device class of ‘next generation’ firewalls, which usually include VPN termination functionality (meaning…