It's January 2024 and there is a new troublemaker in town! Meet Bandook, the sneaky remote access trojan that's causing a ruckus on Windows machines.

LDAP Watchdog: A real-time linux-compatible LDAP monitoring tool for detecting directory changes, providing visibility into additions, modifications, and deletions for administrators and security r...

We will use CyberChef to decode the integer array into hex and pad it with extra 0s if needed. Then, we can disassemble the code using an online tool or CyberChef.

A perfect project to hack an imperfect projector, including a hardware teardown, potential CLI injection, and some lessons learned.

Note: This blogpost was written in November 2023, but I was waiting for the TP Link Security Team to release a fix so now it’s published(Jan 2024).


Hello world! and happy new year. It’s been a long time since I last posted here.
I decided to take a new…

Windows Event logs are the main source of information for defensive security teams to identify threats and for administrators to troubleshoot errors. The logs are represented in a structured format…

Introduction

The Lantronix EDS-MS is an "IoT gateway for mission critical medical devices and equipment connectivity". It is affected by multiple vulnerabilities.

Leverage a flaw in Cognito's API to enumerate accounts in User Pools.

cve-2023-49070/51467 disclose authentication flaws leading to remote code execution (RCE) within Apache OFBiz. Learn how to attack and defend Apache OFBiz

MobSF Remote code execution (via CVE-2024-21633). Contribute to 0x33c0unt/CVE-2024-21633 development by creating an account on GitHub.

Phishing attacks are rapidly increasing against Microsoft 365 tenants. Why? Microsoft is used by many company’s and users, so targetting...

Update: The results are in! Check out the final top ten here or scroll down to view all nominations Over the last year, numerous security researchers have shared their discoveries with the community t

Presentation front page

How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event.
With an upbeat pling my console alerted me that my noscript had finished running, to be precise it was searching for exposed Firebase credentials on…

Explore how to detect and prevent log leaks in open-source projects such as Shopizer, Killbill, and Teammates, using a Piiano Flows scanner.

Overview CVE-2023-263060 was exploited in the wild in Adobe ColdFusion product, a commercial application server for rapid web application development. The vulnerability affects both the 2018 and...