a smart DNS response-guided subdomain fuzzer. Contribute to elceef/subzuf development by creating an account on GitHub.

More car hacking!

Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.

Here's how we found…

In this post, we'll briefly review how service worker hijacking works, then introduce a variant that can be triggered via DOM clobbering thanks to a quirk in document.getElementById(). Understanding s

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A cheat sheet that contains advanced queries for SQL Injection of all types. - kleiton0x00/Advanced-SQL-Injection-Cheatsheet

I never planned for any of this or had any clue that my path would move toward cyber security, But some things are just meant to be…

Share your videos with friends, family, and the world

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD . Every week, she keeps us up to date with a comprehensive list of write-up...

How IBM Cloud caught us exploring its infrastructure and how a hardcoded secret eventually led to build artifact access and manipulation

This advisory contains information about the following vulnerabilities:
- OOB Accesses Using the Logging System

Read writing from Luke Young on Medium. I find bugs and exploit them. Sometimes for money, mainly for T-Shirts. https://www.linkedin.com/in/bored-engineer/.

Last month, during Ekoparty, Blue Frost Security published a Windows challenge. Since having a Windows exploitation challenge, is one of a kind in CTFs, and since I’ve found the challenge interesting and very clever, I’ve decided to post about my reverse…

NVIDIA released a security update fixing 25 GPU display driver vulnerabilities that could lead to code execution, denial of service, and more.

This write-up won’t be an intense discussion on security code review techniques this time. We’ll simply let do all the hard work by a third party: CodeQL.

Summary :

Hey everyone! This is Haroon Hameed and I’m here to share about my recent finding on Synack Red Team about Reflected DOM-based XSS. In this…

This blog explains to you how I found a rare injection bug called cypher injection and how I exploited it.

Summary  The research for this post was done sometime in January of 2022, I was diagnosed with Cancer in February of 2022, and have been str...

Who are you?My name is Raviraj; I'm from Gujarat, India. I go by the handle, Emperor. My handle came from an anime called "Kuruko no Basuke." It references the character Akashi Sejuro's special ability, "Emperor Eye." Hence, giving him the nickname "The emperor"…

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.