SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications - antonioCoco/SharPyShell

Thanks to multiple combined vulnerabilities we are able to insert arbitrary files into anyone's Google Earth Studio Projects Archive.

MouseJack was publicly disclosed in 2016 & an exploit was later released named JackIt. Part 2 explains how to use SILENTTRINTIY + JackIt to bypass Defender.

sec4dev – the security Conference & Bootcamp for developers. Let's make security a first-class citizen in software development!
The sec4dev Conference & Bootcamp is a Vienna-based security event which targets one very specific group: people involved in software…

Last year you may have heard the news that I would soon become the world’s first trillionaire. I was being modest at the time because I…

A Rogue Device Detection Script with Email Alerts Functionality for Windows Subsystem - GitHub - iamrootsh3ll/AnchorWatch: A Rogue Device Detection Script with Email Alerts Functionality for Window...

The National Vulnerability Database is the leading resource for software vulnerabilities. We break down what you need to know to make the most of it.

Some time ago among security researchers, it was very “fashionable” to find improperly configured AWS cloud storages with various kinds of confidential inf...

We discovered hundreds of thousands of documents and terabytes of data exposed across hundreds of customers…

Most modern EDR solutions use behavioral detection, allowing to detect malware based on how it behaves instead of solely using static indicators of compromise (IoC) like file hashes or domain names. In this post, I give a VBA implementation of two techniques…

Posts about hacking, coding and other stuffs

Multi-cloud architecture is a huge trend in enterprise, and today F5 made a big move to bring its own business closer to it. The company, which provides cloud and security application services, announced that it has acquired NGINX, the commercial company…

Citrix Systems’ networks were infested with hackers, who stole terabytes of data. So says a security service provider who nobody’s heard of.

0 votes and 0 comments so far on Reddit

In the previous article, I obtained credentials to the domain three different ways. For most of this part of the series, I will use the rsmith user credentials, as they are low-level, forcing us to…

Orc is a post-exploitation framework for Linux written in Bash - zMarch/Orc

A walk-through of steps taken to go from an undisclosed CVE for a command injection vulnerability in the Apache tika-server to a complete exploit.