The New York Times Exposed GitHub Token Breach
https://ift.tt/NdFrcjS
Submitted September 01, 2024 at 02:29PM by shahibrahem498
via reddit https://ift.tt/u2yj9H7
https://ift.tt/NdFrcjS
Submitted September 01, 2024 at 02:29PM by shahibrahem498
via reddit https://ift.tt/u2yj9H7
Clutch
Clutch | The New York Times Exposed GitHub Token Breach
Clutch - Resources Stay informed with the latest insights, trends, and updates on the Non-Human Identity landscape
WiFi auth with OsmoHLR/SIM cards
https://ift.tt/vH7bG2X
Submitted September 01, 2024 at 11:04PM by parski841
via reddit https://ift.tt/9wRVaZ6
https://ift.tt/vH7bG2X
Submitted September 01, 2024 at 11:04PM by parski841
via reddit https://ift.tt/9wRVaZ6
KittenLabs
WiFi auth with OsmoHLR/SIM cards
Using WPA-Enterprise with EAP-SIM to authenticate against a network using SIM cards
The state of sandbox evasion techniques in 2024
https://ift.tt/IfZQjKH
Submitted September 03, 2024 at 01:19AM by Fudgedotdotdot
via reddit https://ift.tt/tGXvm4r
https://ift.tt/IfZQjKH
Submitted September 03, 2024 at 01:19AM by Fudgedotdotdot
via reddit https://ift.tt/tGXvm4r
Learning Rust for fun and backdoo-rs
https://ift.tt/t75DzSE
Submitted September 03, 2024 at 01:21PM by 0xdea
via reddit https://ift.tt/ekQ94Vv
https://ift.tt/t75DzSE
Submitted September 03, 2024 at 01:21PM by 0xdea
via reddit https://ift.tt/ekQ94Vv
hn security
Learning Rust for fun and backdoo-rs - hn security
“Launch the Polaris The end doesn’t […]
Traceeshark: Deep Linux runtime visibility meets Wireshark
https://ift.tt/WFzywtU
Submitted September 03, 2024 at 02:28AM by Pale_Fly_2673
via reddit https://ift.tt/P42EIV5
https://ift.tt/WFzywtU
Submitted September 03, 2024 at 02:28AM by Pale_Fly_2673
via reddit https://ift.tt/P42EIV5
GitHub
GitHub - aquasecurity/traceeshark: Deep Linux runtime visibility meets Wireshark
Deep Linux runtime visibility meets Wireshark. Contribute to aquasecurity/traceeshark development by creating an account on GitHub.
AWS vs Azure: A "Secure by default" comparison
https://ift.tt/ChLEYrG
Submitted September 03, 2024 at 04:59PM by phoenixzeu
via reddit https://ift.tt/nFyOasN
https://ift.tt/ChLEYrG
Submitted September 03, 2024 at 04:59PM by phoenixzeu
via reddit https://ift.tt/nFyOasN
Security Café
AWS vs Azure: A “Secure by default” comparison
Whether you are in charge of deciding what Cloud solution to choose for your organization or you are a Security Professional trying to decide what Cloud technology to learn, when it comes to choosi…
Analysis of CVE-2024-37084: Spring Cloud Remote Code Execution
https://ift.tt/cO0skzV
Submitted September 03, 2024 at 04:56PM by SL7reach
via reddit https://ift.tt/cKaNjoC
https://ift.tt/cO0skzV
Submitted September 03, 2024 at 04:56PM by SL7reach
via reddit https://ift.tt/cKaNjoC
SecureLayer7 - Offensive Security, API Scanner & Attack Surface Management
CVE-2024-37084: Spring Cloud Remote Code Execution
CVE-2024-37084 is a critical security vulnerability in Spring Cloud Skipper, specifically related to how the application processes YAML input. The vulnerability arises from the use of the standard...
Why bother with argv[0]? It can deceive, break and corrupt your defences
https://ift.tt/Y9M3RGI
Submitted September 03, 2024 at 06:00PM by Wietze-
via reddit https://ift.tt/z2LxRvf
https://ift.tt/Y9M3RGI
Submitted September 03, 2024 at 06:00PM by Wietze-
via reddit https://ift.tt/z2LxRvf
www.wietzebeukema.nl
Why bother with argv[0]?
The first argument of a program’s command line, typically reflecting the program’s name/path and often referred to as argv[0], can in most cases be set to an arbitrary value without affecting the process’ flow. Making the case against argv[0], this post demonstrates…
From a GLPI patch bypass to RCE.
https://ift.tt/8kyWUMD
Submitted September 03, 2024 at 08:17PM by AlmondOffSec
via reddit https://ift.tt/RSlEr6b
https://ift.tt/8kyWUMD
Submitted September 03, 2024 at 08:17PM by AlmondOffSec
via reddit https://ift.tt/RSlEr6b
Sensepost
SensePost | From a glpi patch bypass to rce
Leaders in Information Security
Exploiting Misconfigured GitLab OIDC AWS IAM Roles
https://ift.tt/OGsZYdA
Submitted September 03, 2024 at 07:50PM by RedTermSession
via reddit https://ift.tt/HxJGX0v
https://ift.tt/OGsZYdA
Submitted September 03, 2024 at 07:50PM by RedTermSession
via reddit https://ift.tt/HxJGX0v
hackingthe.cloud
Exploiting Misconfigured GitLab OIDC AWS IAM Roles - Hacking The Cloud
Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.
EUCLEAK is a side-channel vulnerability that requires physical access to a YubiKey 5 Series prior to version 5.7 and (other Infineon based microcontrollers) allowing private key extraction. YSA-2024-03
https://ift.tt/UPN4qoQ
Submitted September 03, 2024 at 11:33PM by lawrencesystems
via reddit https://ift.tt/dYmwZgG
https://ift.tt/UPN4qoQ
Submitted September 03, 2024 at 11:33PM by lawrencesystems
via reddit https://ift.tt/dYmwZgG
NinjaLab
EUCLEAK - NinjaLab
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest…
Revival Hijack - PyPI hijack technique exploited in the wild, puts 22K packages at risk
https://ift.tt/gmQlwYG
Submitted September 04, 2024 at 07:25PM by SRMish3
via reddit https://ift.tt/0QcFsuh
https://ift.tt/gmQlwYG
Submitted September 04, 2024 at 07:25PM by SRMish3
via reddit https://ift.tt/0QcFsuh
JFrog
Revival Hijack - PyPI hijack technique exploited in the wild, puts 22K packages at risk
JFrog’s security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment.…
EUCLEAK Impact on Hardware Wallet Security
https://ift.tt/EmGnyhN
Submitted September 04, 2024 at 10:08PM by coinspect
via reddit https://ift.tt/RcgEnr8
https://ift.tt/EmGnyhN
Submitted September 04, 2024 at 10:08PM by coinspect
via reddit https://ift.tt/RcgEnr8
Coinspect Security
EUCLEAK Impact on Hardware Wallet Security
The EUCLEAK attack allows attackers to steal private keys with just minutes of physical access and bypassing crucial secure hardware attestation protocols.
Windows Wi-Fi Driver RCE Vulnerability - CVE-2024-30078
https://ift.tt/CGVpoMU
Submitted September 05, 2024 at 09:41PM by Void_Sec
via reddit https://ift.tt/VFBdW0Z
https://ift.tt/CGVpoMU
Submitted September 05, 2024 at 09:41PM by Void_Sec
via reddit https://ift.tt/VFBdW0Z
Crowdfense
Windows Wi-Fi Driver RCE Vulnerability - CVE-2024-30078 - Crowdfense
Analysis of CVE-2024-30078, a Windows Wi-Fi driver vulnerability. Detailed root cause analysis and exploitation constraints.
A Security Analysis of Azure DevOps Job Execution
https://ift.tt/Z3f7cCY
Submitted September 05, 2024 at 11:52PM by jat0369
via reddit https://ift.tt/dmUifLu
https://ift.tt/Z3f7cCY
Submitted September 05, 2024 at 11:52PM by jat0369
via reddit https://ift.tt/dmUifLu
Cyberark
A Security Analysis of Azure DevOps Job Execution
In software development, CI/CD practices are now standard, helping to move code quickly and efficiently from development to production. Azure DevOps, previously known as Team Foundation Server...
Frida 16.5 is out with new hardware breakpoint and watchpoint APIs, Windows ARM support, and other goodies
https://ift.tt/FOzNdBT
Submitted September 07, 2024 at 08:53PM by oleavr
via reddit https://ift.tt/E1jKytR
https://ift.tt/FOzNdBT
Submitted September 07, 2024 at 08:53PM by oleavr
via reddit https://ift.tt/E1jKytR
Frida • A world-class dynamic instrumentation toolkit
Frida 16.5.0 Released
Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX
Exploiting CI / CD Pipelines for fun and profit
https://ift.tt/2DXyRJz
Submitted September 09, 2024 at 05:19AM by mukesh610
via reddit https://ift.tt/v5JKhGi
https://ift.tt/2DXyRJz
Submitted September 09, 2024 at 05:19AM by mukesh610
via reddit https://ift.tt/v5JKhGi
How EDR works: the (Anti-)EDR Compendium
https://ift.tt/kt71OLy
Submitted September 09, 2024 at 03:22PM by AlmondOffSec
via reddit https://ift.tt/0ELKCOi
https://ift.tt/kt71OLy
Submitted September 09, 2024 at 03:22PM by AlmondOffSec
via reddit https://ift.tt/0ELKCOi
Companion scanner for mockingjay injection - My approach to DLL scanning in search for RWX regions
https://ift.tt/OkDQhnR
Submitted September 09, 2024 at 06:19PM by flamedpt
via reddit https://ift.tt/ClkEIpw
https://ift.tt/OkDQhnR
Submitted September 09, 2024 at 06:19PM by flamedpt
via reddit https://ift.tt/ClkEIpw
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
https://ift.tt/O0w5L2k
Submitted September 09, 2024 at 08:32PM by AlmondOffSec
via reddit https://ift.tt/puz5UCQ
https://ift.tt/O0w5L2k
Submitted September 09, 2024 at 08:32PM by AlmondOffSec
via reddit https://ift.tt/puz5UCQ
watchTowr Labs
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup & Replication’. Unfortunately, so is every ransomware operator, given it's somewhat 'privileged position' in the storage world of most enterprise's networks. There's…
Hunting for hidden Paths
https://ift.tt/w1oiCcV
Submitted September 09, 2024 at 07:39PM by anasbetis94
via reddit https://ift.tt/WjaHn41
https://ift.tt/w1oiCcV
Submitted September 09, 2024 at 07:39PM by anasbetis94
via reddit https://ift.tt/WjaHn41
Medium
Hunting for Hidden API Endpoints Using Katana and Hakraler
Good day!