leveraging AiTM and the OAuth 2.0 authorization code flow to steal access and refresh tokens. Modified AITMWorker for steal refreshtokens.

Attached: 1 image

@gvy_dvpont@mastodon.social Got me thinking… can it be done without the lens? This one seems to work!

CVE-2024-49138 is a Windows vulnerability detected by CrowdStrike as exploited in the wild. Microsoft patched the vulnerability on December 10th, […]

Yeti is a Forensic Intelligence platform and pipeline for DFIR teams. Rhino Security Labs will detail 2 security flaws that, combined, lead to unauthenticated RCE.

Heap exploitation techniques like House of Force demonstrate the complexities and risks associated with memory management systems.

NetAlertX is an open-source Wi-Fi / Local Area Network (LAN) intruder detector that scans for devices connected to your network and alerts you if new and unknown devices are found.

Binary Security was awarded two CVEs (CVE-2024-45302 and CVE-2024-51501) for header injection vulnerabilities in the RestSharp and Refit .NET libraries. This blog post outlines the research which lead to discovering these vulnerabilities.

Reverse Engineering: I discovered a serious Remote Code Execution (RCE) vulnerability in a popular game that could let attackers run code on your PC. Watch how I found it, reported it, and what you can do to stay safe.

In July 2024, we identified a vulnerability that resulted in access to millions of live customer support messages for organizations using Cisco Webex Connect.

TLDR: SlackPirate has been defunct for a few years due to a breaking change in how the Slack client interacts with the Slack API. It has a…

How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.

The SLAP and FLOP Address and Value Prediction Attacks

Research on Kubernetes policy enforcement risks and how misconfigurations in seemingly secure rules like OPA Gatekeeper enable bypassing.

We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.

Utilizing the new technique of Path Masquerading to spoof malicious processes to closely resemble those of antivirus/EDR programs.

Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments…

Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year