digMeMore

https://twitter.com/WHHackersBR/status/1118393568656334850?s=19

1.15K viewsYasho, 20:12

https://securityaffairs.co/wordpress/84037/hacking/local-file-path-traversal-evernote.html

A local file path traversal issue exists in Evernote 7.9 for macOS which allows an attacker to execute arbitrary programs.

1.21K viewsYasho, 20:41

digMeMore

آسیب پذیری کشف شده در
Smartermail
و توضیحات فنی اون

https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
@digmemore

1.27K viewsپدرخوانده, 20:50

digMeMore

بررسی دور زدن مکانیزم احزار هویت GWT و توضیحات فنی این آسیب پذیری کشف شده در گوگل گروپ.

https://www.komodosec.com/post/google-groups-authorization-bypass
@digmemore

KomodoSec

Discovering Google Groups Auth-Bypass: My Security Research Journey

Tl;dr: I’ve recently been playing around with Google services, poking here and there for security vulnerabilities. It’s been a quite a roller-coaster experience with some interesting results as well as some devastating rejections (I should definitely write…

1.36K viewsپدرخوانده, 20:53

digMeMore

https://hackerone.com/reports/498964

HackerOne

GitLab disclosed on HackerOne: Full access to internal Gitlab...

Read about the test here: https://sites.google.com/securifyinc.com/secblogs/scary-tickets

1.22K viewsYasho, 11:33

digMeMore

عذرخواهی مدیرعامل تپسی از هک اخیر این شرکت، اما تا زمانی که برنامه بانتی نداشته باشن، امنیت‌شون پایین خواهد بود.
https://twitter.com/MMonshipour/status/1119214130794254343

1.26K viewsYasho, 12:48

digMeMore

https://twitter.com/asisctf/status/1119191264409333761?s=20

1.37K viewsپدرخوانده, 17:19

digMeMore

Cross-Site Request Forgery Cheat Sheet - TrustFoundry
https://trustfoundry.net/cross-site-request-forgery-cheat-sheet/
@digmemore

TrustFoundry

Cross-Site Request Forgery Cheat Sheet - TrustFoundry

Cross-Site Request Forgery Cheat Sheet The Cross-Site Request Forgery (CSRF) Cheat Sheet is a flowchart...

1.38K viewsپدرخوانده, edited 13:08

digMeMore

GitLab 11.4.7 Remote Code Execution

https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018

@digmemore

LiveOverflow

GitLab 11.4.7 Remote Code Execution

Video write-up about the Real World CTF challenge "flaglab" that involved exploiting a GitLab 1day. Actually two CVEs were combined to achieve full remote code execution...

1.76K viewsپدرخوانده, 17:15

digMeMore

https://t.co/wEenySkmyV?amp=1

HackerOne

Twitter disclosed on HackerOne: Twitter lite(Android): Vulnerable...

**Summary:** com.twitter.android.lite.TwitterLiteActivity is set to exported and doesn't validate data pass to intent due to which this activity vulnerable to steal users local files, javascript...

1.52K viewsYasho, 18:07

digMeMore

1.48K viewsYasho, 06:00

digMeMore

یه محقق امنیتی افشا کرده که اکسپلویت‌های Shadow Brokers یک سال قبل توسط یک گروه هکری چینی استفاده میشدن. واقعا قدرت هک لذت بخش.
https://twitter.com/TheHackersNews/status/1125683411627139072?s=19

1.65K viewsYasho, edited 22:01

digMeMore

یارو یه باگ پیدا کرده تعداد آبجوهای موجود توی شرکت رو افشا می‌کرده، ۸۰۰ دلار بانتی گرفت 😂

https://hackerone.com/reports/419883
@digmemore

HackerOne

Shopify disclosed on HackerOne: H1514 [beerify.shopifycloud.com]...

*Note: This report was submitted during our H1-514 live hacking event, which had an expanded scope compared to our public bug bounty program. The app mentioned in this report is not currently in...

1.64K viewsYasho, edited 08:20

digMeMore

WordPress 5.1 CSRF to Remote Code Execution
https://blog.ripstech.com/2019/wordpress-csrf-to-rce/

1.41K viewsپدرخوانده, 19:42

digMeMore

https://twitter.com/malwareunicorn/status/1128344523942154240?s=19

1.25K viewsپدرخوانده, 17:09

digMeMore

پاک کردن کامنت در فیسبوک، ۱۲ هزار دلار بانتی
https://bugreader.com/joebalhis@18

Bugreader

Delete any comment on Facebook

This bug allowed a malicious user to delete any comment on Facebook .

1.29K viewsYasho, 17:29

digMeMore

جزییات فنی هک اخیر کافه‌بازار
https://virgool.io/@alirezamika/%D8%B3%D8%B1%D9%88-%D8%B4%D8%AF%D9%86-%D9%BE%D9%88%D8%B4%D9%87%D9%94-%DA%AF%DB%8C%D8%AA-%D8%AA%D8%AC%D8%B1%D8%A8%D9%87%D8%A7%DB%8C-%D8%A7%D8%B2-%D9%85%D9%88%D8%A7%D8%AC%D9%87%D9%87-%D8%A8%D8%A7-%DB%8C%DA%A9-%D8%A2%D8%B3%DB%8C%D8%A8%D9%BE%D8%B0%DB%8C%D8%B1%DB%8C-wcvzaw95dqor

ویرگول

سرو شدن پوشهٔ گیت: تجربه‌ای از مواجهه با یک آسیب‌پذیری

فرضیاتی که داشتیم و اقداماتی که انجام دادیم.

1.49K viewsYasho, 06:15

digMeMore

از خطای ۴۰۴ تا RCE روی Starbucks، جالب بود.

https://hackerone.com/reports/502758

HackerOne

Starbucks disclosed on HackerOne: RCE and Complete Server Takeover...

This report from @spaceraccoon demonstrated a valid attack resulting in RCE and full compromise of the target. The detailed and thorough report was especially helpful throughout the triage process,...

1.31K viewsYasho, edited 15:38

digMeMore

نظر پاول دروف راجع به آسیب‌پذیری اخیر Whatsapp. خیلی قشنگ گفته، کاش فرصت شه یکم راجع بش بنویسم.

https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15

Telegraph – Pavel Durov

Why WhatsApp Will Never Be Secure

The world seems to be shocked by the news that WhatsApp turned any phone into spyware. Everything on your phone – including photos, emails and texts – could be accessed by attackers just because you had WhatsApp installed [1]. This news didn’t surprise…

1.59K viewsYasho, edited 21:33

digMeMore

حمله‌ای بسیار قشنگ روی اپلیکیشن دسکتاپ Slack، مهاجم با ساختن یک لینک مخرب، تنها نیاز دارد که قربانی روی لینک کلید کند. بعد از آن، محل دانلود فایل‌های Slack به آدرس سرور مهاجم تغییر می‌کند و از طریق SMB فایل‌ها ارسال می‌شود. نحوه کشف و اکسپلویت واقعا قشنگ، پیشنهاد می‌کنم بخونید:
https://medium.com/tenable-techblog/stealing-downloads-from-slack-users-be6829a55f63

Medium

Stealing Downloads from Slack Users

I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app on Windows. The vulnerability was…

8.14K viewsYasho, 18:27

digMeMore

defcon qualifiers 2019 pwn challenges walkthrough
https://www.youtube.com/watch?v=FWLD3Ne_CUc

YouTube

Defcon Quals 2019 (oooverflow.io) Speedrun pwn challenges || rop chaining || ret2libc || shellcoding

Walk-through of speedrun-001 speedrun-002 speedrun-003 pwn challenges from defcon qualifiers round 2019.
link: https://oooverflow.io/
ctftime: https://ctftime.org/event/762

Speedrun-001 is basically a statically compiled 64 bit binary. nx is enabled. we need…

1.83K viewsپدرخوانده, 12:26

About

Blog

Apps

Platform