Read our blog post about the motivation for the Ethereum smart contracts reverse engineering and our small efforts to automate the process.
https://blog.deteact.com/decompiling-ethereum-smart-contract-abi/
https://blog.deteact.com/decompiling-ethereum-smart-contract-abi/
Deteact - continuous information security services
Decompiling Ethereum smart contract ABI - Deteact - continuous information security services
Today there’s a number of publicly available EVM bytecode decompilers. However, many of them actually work only for toy examples and fail on real-world programs. This is one of the problems for Ethereum smart contracts continue reading
Long time no see! And we have sponsored one of the biggest infosec forums.
http://2019.phdays.com/en/about/sponsors/deteact/
http://2019.phdays.com/en/about/sponsors/deteact/
Phdays
DeteAct Exhibition Participant
Positive Hack Days is a unique global event. It is the only event which brings together the elite of the hackers' world, leaders of the information security industry and representatives of the Internet community to cooperate in addressing burning information…
More about PHDays 2019: https://www.facebook.com/deteact/posts/371803953434518
Medical Security Village on PHDays 2019: https://www.facebook.com/deteact/posts/372268986721348
Facebook
Deteact
During PHDays 2019, apart from our booth, we also participated in the Wearable & Medical Security Village, organized together with Positive Technologies and the cool guys (Tim Yunusov, Denis...
See our introductory post about Doctrine Query Language injections: https://blog.deteact.com/dql-injection/
Deteact - continuous information security services
DQL injection - Deteact - continuous information security services
In Russian: https://blog.deteact.com/ru/dql-injection Modern web applications are less prone to injections, everyone uses prepared queries and ORM, but we still encounter such vulnerabilities in the wild. SQL dialects built into ORM libraries are of particular…
Read our review of the Yandex.Clickhouse DBMS attack surface and exploitation techniques: https://blog.deteact.com/yandex-clickhouse-injection/
Deteact - continuous information security services
Yandex.ClickHouse injection - Deteact - continuous information security services
In Russian: https://blog.deteact.com/ru/yandex-clickhouse-injection/ In order to process a large amount of data in Yandex.Metrika, Yandex created a column-oriented DBMS ClickHouse. During penetration tests, we encountered ClickHouse in the systems of statistics…
A small take into SMS auth security pitfalls: https://blog.deteact.com/common-flaws-of-sms-auth/
Deteact - continuous information security services
Common flaws of SMS auth - Deteact - continuous information security services
In Russian: https://blog.deteact.com/ru/common-flaws-of-sms-auth/ Many online services use SMS to authenticate users. But subtle implementation mistakes may lead to major problems. This is what we will talk about in this article. Intro This authentication…
Do you need a pentest if your website is protected with a WAF? See for yourself: https://blog.deteact.com/bitrix-waf-bypass/
Deteact - continuous information security services
Bitrix WAF bypass - Deteact - continuous information security services
In Russian: https://blog.deteact.com/ru/bitrix-waf-bypass/ UPD: CVE-2020-13758 assigned Sometimes when exploiting reflected XSS the input parameters get injected directly into the body of the <noscript> tag. Typically, this means that the exploit is trivial:…
Beware of HTTP implementations: they can be incompatible and broken, see https://blog.deteact.com/gunicorn-http-request-smuggling/
Deteact - continuous information security services
HTTP Request Smuggling - Deteact - continuous information security services
A curious case of HTTP smuggling attack on mitmproxy+gunicorn setup
Mitigating XSS can be hard, learn more about Content Security Policy in our blog: https://blog.deteact.com/csp-bypass/
Deteact - continuous information security services
Bypassing Content Security Policy
About XSS mitigation and the security of Content Security Policy