The FLARE team is once again
hosting its annual Flare-On challenge, now in its eighth year. Take
this opportunity to enjoy some extreme social distancing by solving
fun puzzles to test your mettle and learn new tricks on your path to
reverse…
The FLARE team is once again
hosting its annual Flare-On challenge, now in its eighth year. Take
this opportunity to enjoy some extreme social distancing by solving
fun puzzles to test your mettle and learn new tricks on your path to
reverse…
Applications running on android devices below 10 are vulnerable to task hijacking. Even though the issue is fixed from android 11 and above, we cannot tell our customers to upgrade the android version in order to fix the issue.
Some recomm…
Suppose this scenario:
You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and IPS/IDS are not a problem. You don’t nee…
Is there a way to prevent account enumeration on signup page if access to the site is not requiring you to verify your email?
The scenario is as following:
Sign up for a site with email+password, but allow to use the site immediately. Some…
Going for the Gold: Penetration Testing Tools Exploit Golden SAMLA contrived penetration testing scenario explores how attackers could exploit Active Directory Federated Services via Golden SAML and provides context for two Secureworks penetration test…
For the second time, the IDS Bypass contest was held at the Positive Hack Days conference. Just like last time (see blog.ptsecurity.com/2019/07/ids-bypass-contest-at-phdays-writeup.html), the players were supposed not only to find fla…
Type: BlogsDetecting Cobalt Strike: Penetration TestersEven if penetration testers are granted access that circumvents endpoint detections, countermeasures can detect their Cobalt Strike activity in the environment.Even if penetration testers are grant…
Context
I’m trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part process the request from my front-end which a…
I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following:
Host gitlab.com
UpdateHostKeys no
Unfortunately the author of the top…
