How researchers found what they found: recon, analysis, proof of concept.
This is a walkthrough for the most common android pentesting labs on MobileHackingLab.com explained step by step from reverse engineering the app, spotting the vulnerability in the source code and generating a PoC for exploiting the vulnera...
By 0xsponge. Read the original on Medium. Most people's eyes slide straight past /cookie-policy/ on the way to the login flow, the file upload, the payment endpoint. This is about opening the debugger on that page anyway, out of stubbornnes...
A research note on evading network security measures using a Discord channel as an external redirector with MythicC2.
A crafted link can make a desktop app launch a coding-agent CLI inside a directory the attacker controls. The victim only has to click the app's normal "open in terminal?" prompt. Once the agent starts in that folder and the victim trusts i...
This is the story of a focused bug-hunting session in collaboration with my teammate @Rashed on an Intigriti target that led to two security findings -- in under 24 hours. --
Two endpoints, POST /get-secret1 and POST /get-secret3, on a target I’ll refer to as [REDACTED], took a JSON body with a field called gatewayHost. That field was meant to point at some internal secrets-retrieval service, but there was no va...
External writeup by Hamzadzworm (abdelkader mouaz): an account takeover on a passwordless SaaS, chaining an email-uniqueness bypass (a trailing space) with a session-invalidation gap that spared business-mode sessions. The basis for the Nim...
The write-up explains the Evil Rick challenge, which involves an insecure Python Pickle deserialization vulnerability. The researcher found hardcoded credentials hidden in the login page’s HTML comments, logged in, and discovered a remember...
RCE, Dependency confusion · 2,500 bounty Indexed by Pentester Land.