TL;DR The presence of the TRACE method is generally considered to be at best an informational finding (and in isolation, I wouldn’t disagree with that). But before you deploy your meh, if you know what to look for, the TRACE method (and any other mechanism…

TL;DR According to data from RIPE, over 40% of computers attached to the Internet have a few seconds of clock drift, which with the right combination of headers, will make an HTTP response unintentionally cacheable. Background Like many parts of the HTTP…

Introduction While doing some research about file formats, I occasionally found some references about the DICOM file format. Since I never heard about it I’ve decided to dig deeper.
16/02/2024 Update It seems that the developer was already aware of the Double…

The best safe place for your files. Contribute to ElroubyMagnos/ElroubyDecryptedDesktop development by creating an account on GitHub.

This article provides practical recommendations for configuring Docker platform aimed at increasing its security. It also suggests tools helpful in automation of some tasks related to securing Docker.

Overview  Recently, five CVEs have been discovered in Ivanti Connect Secure, a software product designed to offer secure remote access to corporate resources and applications. This product is...

Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

Discover how to uncover vulnerabilities in source code applications and learn key techniques to identify and mitigate security risks effectively.

Overview  Recently, five CVEs have been discovered in Ivanti Connect Secure, a software product designed to offer secure remote access to corporate resources and applications. This product is...

Active Directory users that have the Kerberos pre-authentication enabled and require access to a resource initiate the Kerberos authentication process by sending an Authentication Server Request (A…

I will delve into using Android smartphone while charging from computer to perform automated DNS poisoning attack without any user interaction. I go through its results, downsides and effective prevention tips.

Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies - naksyn/Embedder

TL;DR The main browsers share their cache between Fetch requests and normal navigation.

Spoofing desktop login applications with WinForms and WPF - mlcsec/FormThief

With indictments and arrests.

Two new WiFi vulnerabilities allow hackers to trick you into connecting to fake hotspots and steal your data, and join secure networks without the password.

Organizations who invest in detection engineering have an edge towards identification of threats. However, there is no industry standard to define the framework around the development of detection …