Study finds 5 out of 17 tested CAs underpinning web security are vulnerable to spoofed Domain Validation via IP fragmentation attack
https://ift.tt/2B6dcMp
Submitted December 11, 2018 at 08:39AM by SushiAndWoW
via reddit https://ift.tt/2zQWpgq
https://ift.tt/2B6dcMp
Submitted December 11, 2018 at 08:39AM by SushiAndWoW
via reddit https://ift.tt/2zQWpgq
The Daily Swig | Web security digest
CAs exposed as a weak point in web crypto
Study finds five in 17 Certificate Authorities vulnerable to IP fragmentation attack
Catalonia detects that there still are a great number of attacks to banks and criptocurrency exchange platforms
https://ift.tt/2L9WWhV
Submitted December 11, 2018 at 06:09PM by jpjourno
via reddit https://ift.tt/2Pz7I25
https://ift.tt/2L9WWhV
Submitted December 11, 2018 at 06:09PM by jpjourno
via reddit https://ift.tt/2Pz7I25
Centre de Seguretat de la Informació de Catalunya
Digital fraud
Third topic of the campaign 'Practica els hàbits cibersaludables'
Persistent XSRF on Kubernetes Dashboard using Redhat Keycloak Gatekeeper on Microsof Azure
https://ift.tt/2Gd8PF4
Submitted December 11, 2018 at 07:30PM by asanso
via reddit https://ift.tt/2rwuqxZ
https://ift.tt/2Gd8PF4
Submitted December 11, 2018 at 07:30PM by asanso
via reddit https://ift.tt/2rwuqxZ
Intothesymmetry
Persistent XSRF on Kubernetes Dashboard using Redhat Keycloak Gatekeeper on Microsof Azure
tl;dr I found an XSRF in the OAuth implementation of Redhat Keycloak Gatekeeper . This would be a bit worse for people using Gatekeeper t...
How I could steal your photos from Google - my first 3 bug bounty writeups
https://ift.tt/2QOu7wE
Submitted December 11, 2018 at 08:18PM by -G3R1-
via reddit https://ift.tt/2QqnWjj
https://ift.tt/2QOu7wE
Submitted December 11, 2018 at 08:18PM by -G3R1-
via reddit https://ift.tt/2QqnWjj
Avatao
How I could steal your photos from Google - my first 3 bug bounty writeups
IT security is a really huge topic and until you find your first bug you can’t be sure that you...
Logically Bypassing Browser Security Boundaries
https://youtu.be/B5ZyYTKp4gc
Submitted December 11, 2018 at 09:44PM by albinowax
via reddit https://ift.tt/2GczWQv
https://youtu.be/B5ZyYTKp4gc
Submitted December 11, 2018 at 09:44PM by albinowax
via reddit https://ift.tt/2GczWQv
YouTube
Logically Bypassing Browser Security Boundaries
This talk was presented at bugSWAT. Slide is at https://speakerdeck.com/shhnjk/logically-bypassing-browser-security-boundaries
Talk features:
Password manager issue with iframe/CSP sandbox
https://crbug.com/825258, https://bugzilla.mozilla.org/show_bug.cgi?id=1426767…
Talk features:
Password manager issue with iframe/CSP sandbox
https://crbug.com/825258, https://bugzilla.mozilla.org/show_bug.cgi?id=1426767…
How the Equifax breach happened
https://ift.tt/2rx8fYM
Submitted December 11, 2018 at 11:20PM by yesnoornext
via reddit https://ift.tt/2EgDXkf
https://ift.tt/2rx8fYM
Submitted December 11, 2018 at 11:20PM by yesnoornext
via reddit https://ift.tt/2EgDXkf
threader.app
A thread written by @GossiTheDog
Equifax report megathread while I'm on lunch! https://t.co/vkjj2QfxOm
Google+ Breach Affects 52.5 Million Users
https://ift.tt/2Ed5aoe
Submitted December 12, 2018 at 01:15AM by Fantastic_Fix
via reddit https://ift.tt/2L9mbRH
https://ift.tt/2Ed5aoe
Submitted December 12, 2018 at 01:15AM by Fantastic_Fix
via reddit https://ift.tt/2L9mbRH
InfoSec-IT
Google+ Breach Affects 52.5 Million Users | InfoSec-IT
Google+ has suffered another large data breach, affecting 52.5 million users. Leading to the acceleration of the closure for Google's social platform.
An open source solution for secure automated certificate management
https://ift.tt/2QRtLW6
Submitted December 12, 2018 at 01:44AM by sourishkrout
via reddit https://ift.tt/2C5BmYU
https://ift.tt/2QRtLW6
Submitted December 12, 2018 at 01:44AM by sourishkrout
via reddit https://ift.tt/2C5BmYU
Smallstep
At smallstep we've been focused, lately, on building technology that makes it easier for you to access your stuff. As things stand today, access is really hard. It's really hard for developers to access internal services in production and pre-production environments…
Knowledge Is Power: Exploring Over 1,800 Calibre E-Book Servers.
https://ift.tt/2QnCy2R
Submitted December 12, 2018 at 01:42AM by bjorgein
via reddit https://ift.tt/2RS8jxN
https://ift.tt/2QnCy2R
Submitted December 12, 2018 at 01:42AM by bjorgein
via reddit https://ift.tt/2RS8jxN
blog.chrisbonk.ca
Knowledge Is Power: Exploring Over 1,800 Calibre E-Book Servers.
TLDR; Shodan can be used to find Calibre servers. I wrote an nmap noscript for identification and metadata analysis 2.5 million noscripts a...
Introducing ee-outliers: open-source framework to detect outliers in Elasticsearch events
https://ift.tt/2G7hI2S
Submitted December 12, 2018 at 02:56AM by daanraman
via reddit https://ift.tt/2rvmcpV
https://ift.tt/2G7hI2S
Submitted December 12, 2018 at 02:56AM by daanraman
via reddit https://ift.tt/2rvmcpV
NVISO Labs
Announcement: open-sourcing ee-outliers
Today, we are excited to announce we are open-sourcing ee-outliers, our in-house developed framework to detect outliers in events stored in Elasticsearch! The framework was developed for the purpos…
Binary Exploitation
https://ift.tt/2UD2kyk
Submitted December 12, 2018 at 05:08AM by johnhammond010
via reddit https://ift.tt/2RQvFUn
https://ift.tt/2UD2kyk
Submitted December 12, 2018 at 05:08AM by johnhammond010
via reddit https://ift.tt/2RQvFUn
Searching systematically for PHP disable_functions bypasses
https://ift.tt/2zT8T78
Submitted December 12, 2018 at 05:34AM by gid0rah
via reddit https://ift.tt/2rzf2kB
https://ift.tt/2zT8T78
Submitted December 12, 2018 at 05:34AM by gid0rah
via reddit https://ift.tt/2rzf2kB
x-c3ll.github.io
Searching systematically for PHP disable_functions bypasses ::
DoomsDay Vault
DoomsDay Vault
Some ideas about how to extract hidden parameters in PHP functions and how to find potential bypasses
Jailbreaking RouterOS & misc GNU inetutils <= 1.9.4 vulnerabilities.
Here are steps to jailbreak Mikrotik routers using arbitrary file creation vulnerabilities through telnethttps://hacker.house/releasez/expl0itz/mikrotik-jailbreak.txtHere are heap and stack overflows in GNU inetutils <= 1.9.4 telnet.c client in the handling environment variables. Stack overflow is present in TELOPT_XDISPLOC optionhttps://hacker.house/releasez/expl0itz/inetutils-telnet.txtThese issues can be found all over embedded devices and in mainstream Linux distributions like Arch Linux due to the proliferation of GNU code re-use.
Submitted December 12, 2018 at 12:20AM by hackerfantastic
via reddit https://ift.tt/2LdQMxl
Here are steps to jailbreak Mikrotik routers using arbitrary file creation vulnerabilities through telnethttps://hacker.house/releasez/expl0itz/mikrotik-jailbreak.txtHere are heap and stack overflows in GNU inetutils <= 1.9.4 telnet.c client in the handling environment variables. Stack overflow is present in TELOPT_XDISPLOC optionhttps://hacker.house/releasez/expl0itz/inetutils-telnet.txtThese issues can be found all over embedded devices and in mainstream Linux distributions like Arch Linux due to the proliferation of GNU code re-use.
Submitted December 12, 2018 at 12:20AM by hackerfantastic
via reddit https://ift.tt/2LdQMxl
reddit
r/netsec - Jailbreaking RouterOS & misc GNU inetutils <= 1.9.4 vulnerabilities.
1 vote and 0 comments so far on Reddit
Cyberbullying is worringly rising in Spain
https://ift.tt/2RThxK7
Submitted December 12, 2018 at 06:29PM by jpjourno
via reddit https://ift.tt/2Qt3tKD
https://ift.tt/2RThxK7
Submitted December 12, 2018 at 06:29PM by jpjourno
via reddit https://ift.tt/2Qt3tKD
Centre de Seguretat de la Informació de Catalunya
El civismo en la red
Cuarto eje de la campaña 'Practica els hàbits cibersaludables'
From blind XXE to root-level file read access
https://ift.tt/2EgZPfB
Submitted December 12, 2018 at 07:16PM by albinowax
via reddit https://ift.tt/2rzxWI2
https://ift.tt/2EgZPfB
Submitted December 12, 2018 at 07:16PM by albinowax
via reddit https://ift.tt/2rzxWI2
Honoki
From blind XXE to root-level file read access
Polyphemus, by Johann Heinrich Wilhelm Tischbein, 1802 (Landesmuseum Oldenburg) On a recent bug bounty adventure, I came across an XML endpoint that responded interestingly to attempted XXE exploit…
IKOS 2.1: an open source static analyzer for C and C++
https://ift.tt/2Gd1HZr
Submitted December 12, 2018 at 07:54PM by makeshift8
via reddit https://ift.tt/2PyxKSJ
https://ift.tt/2Gd1HZr
Submitted December 12, 2018 at 07:54PM by makeshift8
via reddit https://ift.tt/2PyxKSJ
reddit
r/C_Programming - IKOS 2.1: an open source static analyzer for C and C++
30 votes and 8 comments so far on Reddit
How we discovered over 50 critical vulnerabilities in Adobe Reader in 50 days.
https://ift.tt/2Gf2hFY
Submitted December 12, 2018 at 08:59PM by ynvb
via reddit https://ift.tt/2rznznC
https://ift.tt/2Gf2hFY
Submitted December 12, 2018 at 08:59PM by ynvb
via reddit https://ift.tt/2rznznC
Check Point Research
50 CVEs in 50 Days: Fuzzing Adobe Reader - Check Point Research
A Fuzzing Drill Hits the Motherlode Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the…
GitHub - NASA-SW-VnV/ikos: Static analyzer for C/C++ based on the theory of Abstract Interpretation.
https://ift.tt/2PAWlXr
Submitted December 12, 2018 at 08:28PM by makeshift8
via reddit https://ift.tt/2QLJWEx
https://ift.tt/2PAWlXr
Submitted December 12, 2018 at 08:28PM by makeshift8
via reddit https://ift.tt/2QLJWEx
GitHub
NASA-SW-VnV/ikos
Static analyzer for C/C++ based on the theory of Abstract Interpretation. - NASA-SW-VnV/ikos
Owning the Virgin Media Hub 3.0
https://ift.tt/2RVxteM
Submitted December 12, 2018 at 10:45PM by digicat
via reddit https://ift.tt/2zUmV8K
https://ift.tt/2RVxteM
Submitted December 12, 2018 at 10:45PM by digicat
via reddit https://ift.tt/2zUmV8K
reddit
r/netsec - Owning the Virgin Media Hub 3.0
2 votes and 0 comments so far on Reddit
CVE-2018-8626 | Windows DNS Server Heap Overflow Vulnerability
https://ift.tt/2Eiw1iI
Submitted December 13, 2018 at 01:03AM by wcon
via reddit https://ift.tt/2Puvkop
https://ift.tt/2Eiw1iI
Submitted December 13, 2018 at 01:03AM by wcon
via reddit https://ift.tt/2Puvkop
reddit
r/netsec - CVE-2018-8626 | Windows DNS Server Heap Overflow Vulnerability
5 votes and 2 comments so far on Reddit
Password strength estimation in nonwestern languages - iacr eprint
https://ift.tt/2QvI936
Submitted December 13, 2018 at 12:31AM by ahazred8vt
via reddit https://ift.tt/2C9vVs9
https://ift.tt/2QvI936
Submitted December 13, 2018 at 12:31AM by ahazred8vt
via reddit https://ift.tt/2C9vVs9
reddit
r/netsec - Password strength estimation in nonwestern languages - iacr eprint
2 votes and 0 comments so far on Reddit