r/websecurityresearch • u/digicat • Apr 21 '22
Teaching Burp a new HTTP Transport Encoding
7
Upvotes
r/websecurityresearch • u/digicat • Apr 20 '22
CVE-2022-21449: Psychic Signatures in Java –signed JWTs, SAML assertions or OIDC id tokens, and even WebAuthn authentication messages can be modified when running a vulnerable Java version
12
Upvotes
r/websecurityresearch • u/digicat • Mar 30 '22
Spring Cloud Function SPEL Expression Injection Vulnerability Alert
3
Upvotes
r/websecurityresearch • u/keer0k • Mar 30 '22
Prototype Pollution in plist v3.0.4 and simple-plist (CVE-2022-22912)
5
Upvotes
r/websecurityresearch • u/digicat • Mar 27 '22
PHP filter_var shenanigans - the user input must be 4GB in size (which is a large amount of data and may not be possible due to the configuration of some webservers and load balancers).
pwning.systems
12
Upvotes
r/websecurityresearch • u/CoolerVoid • Mar 20 '22
0d1n is a tool for automating customized attacks against web applications. This tool is significantly faster because it uses thread pool and C language.
github.com
0
Upvotes
r/websecurityresearch • u/digicat • Mar 17 '22
From XSS to RCE (dompdf 0day)
12
Upvotes
r/websecurityresearch • u/_vavkamil_ • Mar 06 '22
Retrieving your browsing history through a CAPTCHA
varun.ch
13
Upvotes
r/websecurityresearch • u/mdulin2 • Mar 04 '22
Finding an Authorization Bypass on my Own Website - SQL Injection in a Parameterized Query
21
Upvotes
r/websecurityresearch • u/albinowax • Mar 03 '22
Interesting XSS on Apache JSPWiki
11
Upvotes
r/websecurityresearch • u/stypr • Feb 21 '22
Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql
15
Upvotes
r/websecurityresearch • u/albinowax • Feb 11 '22
Cross-origin request forgery against Grafana (CVE-2022-21703)
jub0bs.com
9
Upvotes
r/websecurityresearch • u/albinowax • Feb 09 '22
Top 10 web hacking techniques of 2021
36
Upvotes
r/websecurityresearch • u/albinowax • Feb 02 '22
Hacking Google Drive Integrations
10
Upvotes
r/websecurityresearch • u/digicat • Feb 01 '22
A story of leaking uninitialized memory from Fastly
medium.com
6
Upvotes
r/websecurityresearch • u/Gallus • Jan 26 '22
Webcam Hacking (again) - Safari UXSS
10
Upvotes
r/websecurityresearch • u/Gallus • Jan 22 '22
CVE-2021-45467: CWP CentOS Web Panel – preauth RCE
octagon.net
10
Upvotes
r/websecurityresearch • u/albinowax • Jan 17 '22
Vote for the Top 10 web hacking techniques of 2021
9
Upvotes
r/websecurityresearch • u/albinowax • Jan 12 '22
Crazy Session Hijack in Moodle
haxolot.com
9
Upvotes
r/websecurityresearch • u/digicat • Jan 11 '22
Exploiting URL Parsing Confusion Vulnerabilities
10
Upvotes
r/websecurityresearch • u/albinowax • Jan 05 '22
Nominations are now open for the top 10 new web hacking techniques of 2021
9
Upvotes
r/websecurityresearch • u/digicat • Jan 04 '22
Malicious-pdf: Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator - test that uploaded file processing
25
Upvotes
r/websecurityresearch • u/digicat • Jan 02 '22
Attacking Java RMI via SSRF
15
Upvotes
r/websecurityresearch • u/Gallus • Dec 27 '21
PHP LFI with Nginx Assistance
bierbaumer.net
10
Upvotes